Client-side testing (DOM-based XSS, HTML5 security) - Business logic testing (critical addition --- automated tools cannot test business logic) - Web services testing (SOAP, REST) - API-specific test cases