How to build a desktop application test automation strategy

Rob McNeil

November 11, 2026

Quick answer: Desktop and legacy applications resist automation for three reasons:

The UI: Their interfaces use custom or older controls that most automation tools can’t identify.
The APIs: Their services run on REST, SOAP, Kafka, GraphQL, JDBC, or JMS, and they depend on backend systems you can’t touch in a test environment.
Security policy: Policies block the cloud-based tools that most AI testing depends on.

To build a desktop application test automation strategy, cover both two layers: use SmartBear ReadyAPI® to test the APIs and services behind the app and SmartBear TestComplete® to automate the desktop UI. Run both on your own infrastructure, and start with the manual regression cycle that costs your team the most time.

How AI development impacts testing for desktop apps

AI coding assistants have sped up development, and the volume of change reaching testers grows every sprint. Most AI testing tools assume a browser, a cloud account, and an internet connection, so testing for desktop and legacy apps hasn’t sped up with it.

That imbalance already shows up in quality. In SmartBear’s State of Software Quality and Testing 2026 report, 55% of respondents said they had quality issues in the past year that they attribute to development outpacing testing. When asked what holds them back from scaling automated testing, respondents named integration with existing tools and governance or compliance concerns among the top barriers. Those are the same two walls teams hit when they try to bring cloud-first tools into a locked-down environment.

What makes desktop and enterprise apps challenging to automate?

Desktop and enterprise apps rarely have just one layer to test. The screen your users see sits on top of services, message queues, and backend systems built over many years, and a single business transaction usually crosses all of them. Browser-first and cloud-first tools don’t fit that stack. Developers and testers in online forums describe the same challenges:

Technology most tools can’t read: On the screen, SAP GUI, Oracle Forms, Java Swing, and custom WinForms or WPF controls often give an object spy nothing to identify. Citrix delivers the whole app as one flat image. Behind the screen, SOAP services and JMS or Kafka queues sit next to newer REST APIs. Tools like Playwright and Selenium stop at the browser, and REST-first API tools treat older protocols as an afterthought.
Systems and environments you don’t control: Mainframes, third-party services, and shared downstream systems are often unavailable in test. Teams overwrite each other’s test data, and tests have to run unattended inside restricted or air-gapped networks.
Changes that break tests unknowingly : A renamed control breaks a UI test. A service change can pass code review and still break the desktop client that calls it. Faster, AI-assisted development puts more of these changes into every release.
Security and audit requirements: Tools that sync payloads, secrets, or screenshots to a vendor’s cloud often fail security review. Auditors still expect evidence of functional and security testing, and teams often assemble it by hand.

Custom legacy systems raise the stakes. A decade-old claims system often comes with undocumented services, third-party controls nobody has source code for, and years of technical debt, and it still runs the business. Automation must work with the app as it is.

When tests can’t reliably reach the screen or the services behind it, they break and the regression suite keeps growing. A four-hour run turns into a weekend, and every patch cycle repeats it.

Legacy testing challenge focus areas: API vs. UI

To solve the testing challenges that come with legacy apps, it’s best to break them down into two focus areas: APIs and UIs.

API and service-layer challenges include:

Mixed and older protocols. SOAP and WSDL sit alongside REST, JMS, Kafka, and GraphQL, often inside the same business transaction.
Dependencies you can’t touch. Mainframes, third-party services, and downstream systems are unavailable, expensive, or off-limits in test environments.
Shared test data. Teams overwrite each other’s data in the same environment.
Contract breaks. An AI-assisted change to a service passes code review and breaks a consumer at runtime.
Security testing as a compliance requirement. Auditors expect evidence that you tested for common vulnerabilities.
Cloud-synced API clients ruled out. Security teams block tools that sync payloads or secrets to a vendor’s cloud.

UI and front-end challenges include:

Object recognition failures on custom controls, third-party grids, context menus, and untagged elements.
Remote and virtualized delivery through Citrix or Remote Desktop.
Stalled open-source desktop drivers that leave no supported path forward.
Testers who don’t write code but know the application better than anyone.
Locked-down execution. Tests need to run unattended inside air-gapped or restricted networks.
Audit evidence that someone assembles by hand from screenshots.

Each list calls for a different kind of automation. The API challenges need something that speaks older protocols and runs without the real backend, and the UI challenges need something that can identify custom desktop controls. The next two sections cover how ReadyAPI and TestComplete handle each layer, starting with the services.

Test every API on-premises, even when dependencies are off-limits

ReadyAPI delivers application integrity for on-premises APIs with functional, security, and performance testing, plus service virtualization, in one product. Teams can trust their APIs work as intended and ship them at AI speed and scale. It installs in your environment and tests REST, SOAP, GraphQL, Kafka, and JMS APIs, with AI features you can switch off. That matters as on-premises estates grow. In a February 2026 Cloudian survey, 89% of organizations planned to expand their on-premises footprint.

Service virtualization for dependencies you can’t reach. ReadyAPI records REST and SOAP traffic and turns it into virtual services. You can also build JMS, TCP, and JDBC virtual services, and simulate failures and slow networks. Your tests keep running when the real system is shared, down, or off-limits.
Data-driven tests in an environment you control. ReadyAPI installs in your environment and pulls test data from the spreadsheets and databases your team already manages.
You decide on AI. AI features are optional. Administrators can switch them off for one user, a managed image, or the whole organization.
Load testing from the functional tests you already have. Turn functional test cases into load tests and generate load from agents on Windows or Linux machines inside your network. ReadyAPI monitors your servers for bottlenecks during the run.
Security scans that run alongside your tests. Run SQL injection, cross-site scripting, fuzzing, and weak-authentication scans in the same project, with reports ready for audit. Akamai’s 2026 study found 87% of respondents had an API-related security incident in the past year.
Pipeline runs with the CI tools you use. Run ReadyAPI tests from Azure DevOps, Jenkins, TeamCity, or Maven.

Book a ReadyAPI demo to see it run in your environment.

ReadyAPI MCP Server: Keep tests in sync with changing specs

Specs change faster than test suites. Some tests fail loudly, and others keep passing against a contract that has moved. The SmartBear ReadyAPI MCP Server closes that gap from the AI assistant your team already uses. Install it as a local plugin from the Integrations tab, then connect Claude, GitHub Copilot, Cursor, or another MCP-compatible assistant. No scripting required.

From your assistant, you can:

Browse projects, APIs, test suites, environments, and auth profiles.
Create projects, import API definitions, and generate tests from the spec.
Diff two spec versions to find affected tests, then apply the recommended fixes.
Run tests, diagnose failures, and heal them.

You stay in control. The plugin is opt-in, binds to localhost, and authenticates every client with a bearer token. ReadyAPI’s own engine decides pass or fail, and every tool call is recorded in an audit log. Pair it with a self-hosted model and the whole loop stays inside your network. Work on a Git branch to review each diff before you merge.

Best for: Teams with REST and Kafka APIs that change often, large functional suites to maintain, and a compliance team that expects an audit trail.

Automate desktop and legacy UIs your other tools can’t see

TestComplete delivers application integrity for desktop, web, mobile, and packaged applications with secure and stable UI test automation. Teams can trust their apps work as intended and stay audit-ready at AI speed and scale. It installs locally and runs on your machines and VMs, including in air-gapped networks. All core functionality works offline.

Object recognition for complex UIs. TestComplete identifies objects by their properties and uses name mapping to keep tests readable. For controls that don’t expose properties, add OCR and image checkpoints, or use optional AI-powered visual object detection to identify controls by how they look. Many browser-first tools stop at the window frame.
Self-healing for UI changes. If a name-mapped object moves or gets renamed, TestComplete tries other ways to find it during the run and suggests an update to the test. You’ll still review some changes yourself.
Built for testers who do and don’t code. Record and replay, build keyword tests, or write scripts in Python, JavaScript, or VBScript. Manual testers and engineers share the same projects.
Unattended runs in locked-down environments. TestExecute runs your tests on a schedule from Jenkins, Azure DevOps, or GitHub Actions, on runners inside your network.
Audit-ready results. Every run produces a log with pass/fail detail and screenshots. Send results to the test management tool you already use, such as SmartBear Zephyr® or SmartBear QMetry™ as your testing system of record.
You decide on AI. AI features ship in an optional add-on that you can switch off, which gives your security team a clear answer for the approved software list. SmartBear never uses your data to train models.

Book a TestComplete demo to see it run in an environment like yours.

TestComplete MCP Server

The TestComplete MCP Server lets you work with the LLM of your choice. It gives your AI assistant more than a dozen tools for working with your test projects and results. Your assistant can:

Open project suites.
Run execution plans, keyword tests, and scripts.
Compile results across every test log in a suite.
Pull data from distributed test environments into one view of your testing health (with the right network configuration).

Already using Playwright? Keep it for your web apps. TestComplete covers the desktop and packaged apps it can’t reach.

Best for: Teams moving business-critical desktop, legacy, or packaged apps off manual regression testing.

ReadyAPI vs. TestComplete: Which one do you need?

	ReadyAPI	TestComplete
What it tests	APIs and services	User interfaces
Technologies	REST, SOAP, GraphQL, Kafka, JMS	Desktop, web, mobile, and packaged apps
Problems it solves	Contract breaks, unavailable dependencies, API security	Object recognition, manual regression, unattended UI runs
Key capabilities	Functional, performance, and security testing; service virtualization	Name mapping, OCR and image checkpoints, AI-powered visual object detection, self-healing
Who builds tests	Testers (no-code) and engineers (scripted)	Manual testers (record and replay) and engineers (Python, JavaScript, VBScript)
Deployment	Installed on-premises	Installed locally; works offline and in air-gapped networks
MCP server	Generate, run, and heal API tests and detect the impact of API changes	12+ tools to open projects, run tests, and compile results

If your biggest risk is the services behind the screen, start with ReadyAPI. If it’s the screen itself, start with TestComplete. Each one stands on its own.

How do ReadyAPI and TestComplete work together?

Take a claims app with a WinForms front end that calls SOAP services, which in turn call a mainframe:

ReadyAPI covers functional, security, and performance testing in one product, with service virtualization for the mainframe, so fewer unexpected errors reach production.
TestComplete drives the claims workflow through the actual UI, the way an adjuster would, and confirms the screen shows what the services returned.

When a defect appears, you know which layer it came from. In-depth API tests catch most breaks early, and your UI suite focuses on the workflows users depend on.

A wealth management software provider took this approach with its WPF desktop and web applications. It uses TestComplete for UI regression and ReadyAPI for API validation and performance testing. Its vice president of software engineering explains:

“We needed a lot of automated testing. [With SmartBear] our testing suite is 90% automated now. Each night there is a suite running with Jenkins Orchestrator, and we will have the results in the morning to work on.”

Read the full case study.

How you can create a practical path to scalable automation

Start with your highest-cost manual work, like a weekend-long regression cycle.
Automate the layer where the pain lives. Use ReadyAPI for services and TestComplete for screens.
Run it on your own infrastructure. Schedule both tools in CI inside your network and keep their reports for audits.
Add AI at your pace. Connect your approved assistant through MCP when your governance team is ready.

The result is fewer defects reaching production in the complex apps cloud-first tools can’t reach.

Talk to us about testing your desktop and legacy apps

Tell us which application keeps your team in manual testing. We’ll show you how ReadyAPI, TestComplete, or both would handle it in your environment.

Click here to schedule a talk with an expert today.

Frequently asked questions about desktop application test automation

What should a desktop application test automation strategy include?
A good desktop application test automation strategy covers both the screen and the services behind it. It includes an inventory of the apps that need coverage, a plan for the API and UI layers, and tools that run on-premises or offline. Tests run in CI inside your network, and you retain test evidence for audits.

Can you automate testing for legacy and desktop applications?
Yes. Tools like TestComplete recognize objects in WinForms, WPF, Java, Delphi, and other desktop frameworks. For custom or remotely delivered UIs, they add image checkpoints, OCR, and AI-powered visual object detection.

How do you test REST, as well as SOAP and other legacy APIs on-premises?
Use an API testing tool that installs inside your environment. ReadyAPI tests SOAP and WSDL-based services alongside REST, GraphQL, Kafka, and JMS from one place. Requests, payloads, and credentials stay inside your network.

How do you test an app when the mainframe or third-party system behind it isn’t available?
Use service virtualization. ReadyAPI records REST and SOAP traffic and builds JMS, TCP, and JDBC virtual services that stand in for systems you can’t reach. It can also simulate failures and slow networks, so tests run whether or not the real system is available.

Can AI testing tools work in air-gapped environments?
Some can. TestComplete’s MCP server runs locally with an LLM you host, and you can switch its other AI features off entirely. ReadyAPI’s MCP server binds to localhost and works with a self-hosted model, and administrators can turn its AI features off for a user, a managed image, or the whole organization.

Do I need both ReadyAPI and TestComplete?
Most desktop transactions cross both layers, so covering both gives you the most confidence before release. ReadyAPI tests the services, TestComplete tests the screen, and both run in the same CI pipeline inside your network. Many teams start with the layer that causes the most manual work and add the other as they scale.