Frequently asked questions (FAQs)

This section brings together the most common questions about how the platform works, its capabilities, and its use in different contexts.

The goal is to answer common questions and make it easier to adopt the continuous testing model, providing clarity on how Strike operates and what you can expect from the platform.

About the platform

What exactly does Strike do?
Strike lets you continuously discover, test, and validate the security of your digital assets, combining artificial intelligence with expert validation. It works like an always-on pentester across your attack surface.

Testing is organized into Threat Emulations: each one groups one or more assets and defines how and when they are tested. For more details, see What a Threat Emulation is and how to read it.

Do I have to run testing manually?
No. Once you create a Threat Emulation, it runs according to its type:

• Full security: runs automatically on the recurrence you choose (Monthly, Quarterly, or Semiannual), or once if you don't turn on recurrence.

• Change-based: runs automatically when there are changes in the repositories you choose.

• Focused: a one-off run you launch whenever you need it.

On each run, the platform also automatically revalidates reported vulnerabilities.

What types of assets can it test?
The platform mainly assesses:

• Web applications

• APIs

• Backend services

It can also operate in private environments through VPN or access configurations.

About testing

How does it detect new assets?
The platform uses mechanisms such as External Radar and Cloud Radar to continuously discover assets and changes in your attack surface. This keeps your inventory up to date without manual processes.

What if my systems are protected (VPN, authentication, etc.)?
Strike can adapt to different levels of access:

• Testing the public surface, without credentials (blackbox mode).

• Controlled access through VPN.

• Using credentials or tokens to test what is behind the login.

The level of coverage depends on the access you configure. For more details, see How to add credentials for testing.

How are false positives handled?
All findings go through triage by Strike's Hacking Team before being reported, and critical ones are also reproduced and validated manually. This significantly reduces noise and ensures results are actionable.

Can AI detect complex vulnerabilities?
Yes. The platform is not limited to automated scanning:

• It reasons about system behavior.

• It runs attack techniques like a real attacker.

• It can detect business logic flaws.

The hybrid model (AI and experts) achieves coverage similar to or greater than a traditional pentest.

About operations

Can it affect the operation of my systems?
The platform is designed to operate safely in production environments:

• It does not perform destructive actions.

• It respects the limits you set, such as rate limit and time restrictions.

• It includes real-time monitoring.

• It stops automatically when it detects anomalous behavior.

• It has an immediate stop mechanism (kill switch): Cancel execution.

For more details, see How Strike's AI agent operates on your assets: scope, limits, and controls.

Can I stop the testing?
Yes. You can pause a Threat Emulation with Pause so it doesn't run until you resume it, or stop the run in progress with Cancel execution. For more details, see How to pause a Threat Emulation or cancel a run.

Can it be used to validate new releases?
Yes. With a Change-based Threat Emulation, testing runs automatically with every pull request or every new release, depending on how you configure it. You can also launch a Focused Threat Emulation to test a specific feature. For more details, see How to set up a Change-based Threat Emulation and What a Focused Threat Emulation is and how to run one.

About security and data

Is my data protected?
Yes. The platform implements security controls, encryption, and isolation to protect your information, and it does not use customer data to train models. Strike is certified in ISO 27001, SOC 2, and HIPAA. For more details, see Security and data protection (Trust).

This section is continuously updated to reflect new capabilities, features, and usage best practices.