Join our Newsletter — 33% off our NHI Course
Home› FAQ› Cyber Security› What are the signs that locator strategy is…
Cyber Security

What are the signs that locator strategy is becoming brittle?

← Back to all FAQ
By NHI Mgmt Group Editorial Team Updated October 11, 2026 Domain: Cyber Security

Frequent failures on unchanged app flows, tests that pass in one build and fail in the next, and heavy dependence on XPath or internal hierarchy paths are strong warning signs. If the same control appears under different names or tree positions after minor releases, the locator model is too fragile.

When does locator strategy start to break down?

Locator brittleness usually shows up when the test suite is tied too closely to implementation details instead of stable user-facing structure. A resilient locator identifies the same element consistently across minor UI changes, while a brittle one depends on hierarchy, generated attributes, or page order that shifts during routine releases.

What patterns usually reveal brittle locators?

The clearest pattern is instability without a real product change. When the same test starts failing after harmless refactors, visual tweaks, or renaming of containers, the locator is probably anchored to structure rather than intent. That is a reliability problem, because the locator is now tracking the DOM shape instead of the control the user actually interacts with.

Another warning sign is locator drift across environments or builds. If one run passes and the next run fails on the same flow, the locator may be too dependent on transient attributes, dynamic IDs, or tree depth. A good locator should survive ordinary release churn, not require constant repair after every small adjustment.

Heavy use of absolute XPath, index-based paths, or deeply nested hierarchy references is also a practical red flag. These patterns are often fast to write but expensive to maintain, because any inserted wrapper, reordered sibling, or renamed container can invalidate them. Stable attributes, semantic roles, and accessible labels usually age better than positional paths.

What makes a brittle locator especially risky for automation?

Brittle locators create false signal in the test suite. They can hide real regressions behind locator breakage, or worse, they can pass in one build and miss a UI defect in another because the selector latched onto the wrong matching element. That weakens trust in the suite and increases the maintenance burden on the team.

They also encourage a repair cycle where teams keep patching selectors instead of improving locator design. Over time, that shifts effort from verification to upkeep, and it makes the suite more sensitive to minor markup changes than to genuine functional change. The result is lower confidence in test outcomes and slower feedback when a real defect appears.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.

FrameworkControl / ReferenceRelevance
OWASP ASVSV3 — Web Frontend SecurityLocator robustness depends on stable frontend structure and semantics.
V15 — Secure Coding and ArchitectureBrittle locators often come from implementation-detail coupling in the app.
Recommendation — Use stable UI hooks and semantic selectors instead of fragile DOM paths. Design testable components with stable identifiers and low UI coupling.
CIS Controls v8CIS-16 — Application Software SecurityMaintaining reliable test automation is part of secure, resilient application delivery.
Recommendation — Add selector stability checks to application testing and release validation.

Practitioner Guidance

What to prioritise: Prefer locators that express user intent, such as stable labels, roles, or data attributes that are designed for automation. If a selector only works because the current DOM happens to be arranged a certain way, treat it as temporary.

What to verify: Check whether the locator still identifies the same control after minor UI refactors, renaming, and reordering of sibling elements. If small, non-functional changes repeatedly break it, the selector is already too fragile for long-term use.

Common mistake: Teams often accept a working XPath as “good enough” because it passes today. The better question is whether the locator is stable under expected product change, since that is what determines its maintenance cost.

Practitioner takeaway: A brittle locator is not just a test nuisance, it is a signal that the suite is coupled to presentation details instead of stable semantics, and that coupling will keep surfacing as avoidable breakage.

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org