Security starts way before testing actually. Make sure security is already part of the way you develop. We use an external bureau that does our security tests. That guarantees us an independant view of our security.

I basically agree with this review. The 'Other Advice' is one of the most valuable parts. Whatever you are using, you need to understand what you are doing. A representative load test environment and sufficient coverage of the application being tested are often ignored…

You say you want to use load runner in the cloud. Load runner is offered in the cloud (enter "Loadrunner in the cloud" at your favorite search engine for vendors). Unless of course you want to test from your own cloud vendor. HP licensing might be a bit tricky for that.

The real plus of Neoload IMO is the script-ability. This makes it much easier to use than say HP Loadrunner. The tool has some serious work in the maturity department though. On the other hand, if you find a an issue and report it, its treated very seriously and its usually…

I consider integration (both within the suite and with external tooling) and complete application chain coverage essential for ALM suites.