Add-ons: extra testing layers

A Full security Threat Emulation is the foundation of continuous testing: it evaluates the entire surface in scope, on a recurring basis or in a single run. To cover specific moments between cycles, such as a release or a new feature, you can complement it with other types of Threat Emulation and with manual testing.

There are no additional services to purchase separately: you buy credits and use them on the type of testing you need at any given time.

Focused Threat Emulation

A one-time run on a goal you define, for example a flow, a feature, or a vulnerability area. It is useful when you need to validate something specific without waiting for the next Full security cycle.

For more details, see What a Focused Threat Emulation is and how to run one.

Change-based Threat Emulation

It runs automatically when there are changes in the repositories you choose, with each pull request or with each new release. It is useful if you release frequently and want to reduce the exposure window between cycles. You need to have GitHub connected at the organization level.

For more details, see How to set up a Change-based Threat Emulation.

To see when each one makes sense, see Focused and Change-based Threat Emulation: how they differ and when to use each one.

Human hacking

Human hacking is a switch you turn on in the configuration of a Threat Emulation. With Human hacking, an offensive security specialist manually tests the assets in scope, together with Strike's AI agent.

It is recommended for:

• High-criticality assets.

• Compliance requirements.

• Cases where you need a higher level of confidence in the results.

Turning on Human hacking increases the credit consumption of the Threat Emulation.

How credits are consumed

All types of testing are paid for with the same credits from your plan:

• Full security: consumption depends on the number of paths, the depth, and the number of runs per year.

• Focused and Change-based: consume a fixed number of credits per run.

• Human hacking: increases the consumption of the Threat Emulation where you turn it on.

While you configure a Threat Emulation, the estimate card shows you how many credits it will consume. For more details, see Credits: what they are and how they are consumed.

When to combine each one

Frequently asked questions

Do I need to purchase anything separately to use Focused, Change-based, or Human hacking?

No. You use the same credits from your plan on the type of testing you need.

Does Human hacking consume more credits?

Yes. Turning it on increases the consumption of the Threat Emulation. You can see the impact on the estimate card before confirming.

Do Focused and Change-based replace the Full security?

No. The Full security evaluates the entire surface in scope. Focused and Change-based cover specific goals or changes between cycles.