What is an infrastructure Threat Emulation

In addition to web applications and APIs, you can continuously test your infrastructure on the platform: servers and exposed IPs. To do this, create a Threat Emulation of type Infrastructure and add the IPs you want to test.

How it works

Strike's AI agent analyzes each host separately:

1. Identifies the exposed surface: which ports, services and versions are exposed, for example SSH, SMTP, web services and admin panels, databases, SMB/NFS shares or Active Directory.

2. Plans what to explore: based on what it finds, it decides which vulnerabilities to test, for example known CVEs, default credentials, anonymous access or weak TLS configurations.

3. Validates through real exploitation: it confirms findings with real exploitation, not just because a service version matches a vulnerable version.

4. Moves through the rest of the scope: it reuses the credentials it obtains to keep advancing across the other hosts and services.

Each finding is reported with a description, reproduction steps, impact, remediation and CVSS severity.

What you can test

In this version, an infrastructure Threat Emulation accepts static IPs (IPv4):

• Public IPs exposed to the internet: for example Windows and Linux servers, edge appliances (VPN, firewalls, gateways), network devices and application services exposed by IP.

• Private IPs on your internal network: as long as there is compatible VPN access and the IPs are reachable through that tunnel.

Each asset corresponds to a single IP, and a Threat Emulation can include as many IPs as you need.

To guide the attack, the agent uses the context you add to the asset: the role of the host, the type of device and the technical documentation. For more details, see What to include in an asset's Description and in Additional information.

Network ranges and domains are not yet available as infrastructure assets. If you need to test them, contact your CSM to do it through a Project.

Infrastructure or Web/API, not both

When you create a Threat Emulation, you choose what you want to test: Web/API or Infrastructure. That choice defines which assets you can include:

• An infrastructure Threat Emulation only accepts static IPs.

• A Web/API Threat Emulation only accepts web and API assets, which can be combined with each other as before.

If you need to test both infrastructure and web applications or APIs, create two separate Threat Emulations.

Credit consumption

Each IP included in the Threat Emulation consumes 85 credits per execution. The calculation is:

IPs in scope × 85 credits × executions per year

• IPs in scope: all the IPs you included in the Threat Emulation are counted.

• Executions per year: depend on the recurrence. Monthly equals 12 executions per year, quarterly 4 and semiannual 2. With recurrence turned off, it is a single execution.

Example: a Threat Emulation with 3 IPs and quarterly recurrence consumes 3 × 85 = 255 credits per execution, or 1,020 credits per year.

If you turn on Human hacking, each execution adds a human review, the same as in Web/API. While you configure it, the estimate card shows the total consumption. For more details, see Credits: what they are and how they are consumed.

Before the first execution

• Add Strike's IPs to your firewall. For more details, see How to authorize Strike's IPs.

• If the IPs are on a private network, set up VPN access. For more details, see Access to your internal network via VPN.

The Pre-flight Check does not apply to infrastructure Threat Emulations. If an IP is not reachable, the problem is detected during the execution. That is why it is important to check connectivity before confirming.

Frequently asked questions

Can I include IPs and web applications in the same Threat Emulation?

No. A Threat Emulation is either infrastructure or Web/API. If you need both, create two Threat Emulations.

Can I test an IP range or a domain?

Not yet as an infrastructure asset. For now, you can test them through a Project. Contact your CSM to coordinate it.

Can I set up a Focused or Change-based Threat Emulation on infrastructure?

No. Infrastructure Threat Emulations are of type Full security.

Can I upload SSH or Active Directory credentials for authenticated testing?

Not yet. For now, infrastructure Threat Emulations run without credentials.

Can I request a retest of an infrastructure vulnerability?

For now, retest is not available for infrastructure vulnerabilities.

Does an IP that does not respond consume credits?

Yes. All the IPs included in the Threat Emulation are counted, even if one is not reachable during the execution. If this happens, contact your CSM to review your case and decide how to proceed.