Access to your internal network via VPN

For Strike to test assets that are only accessible from your internal network, it needs VPN access. This article explains which methods we support, what to have ready before you start, and what options exist if your organization uses a different tool.

Supported access methods

Strike currently supports two VPN methods:

Files are stored encrypted and masked across the entire platform.

Before you start

Have this information on hand:

• Which assets in your Threat Emulations are only accessible through your VPN.

• A WireGuard (.conf) or OpenVPN (.ovpn) profile generated for Strike. We recommend creating a dedicated profile, separate from the one your internal users use.

• Who on your team can generate or modify that profile if needed.

Your Strike contact will tell you how to share the profile during onboarding. Before testing starts, we validate that Strike can connect to your network correctly.

If you use a different access method

If your organization uses a different remote access tool, for example Fortinet, Palo Alto GlobalProtect, Cisco AnyConnect or a ZTNA solution, contact your Strike contact. Our team will review your setup and confirm whether your access method can be enabled. If it is feasible, setup usually takes about 5 business days.

In the meantime, or if you prefer not to wait, these options usually work:

• Generate a WireGuard or OpenVPN profile for Strike. Many teams can enable one for an external testing provider, even if they use a different tool internally.

• Start with the assets that don't need a VPN, such as internet-facing web applications and APIs. Testing can start right away, and the assets behind your VPN are added once access is resolved.

In addition to the VPN, remember to allowlist Strike's IPs. For more details, see How to allowlist Strike's IPs and Requirements for an effective Threat Emulation.