How to create an infrastructure Threat Emulation

Last updated: October 26, 2026

An infrastructure Threat Emulation tests one or more static IPs as a single unit. The flow is the same as for a Web/API Threat Emulation, with a few differences in the scope and the configuration. To see what it includes and how it differs, see What is an infrastructure Threat Emulation.

Step 1: Create the Threat Emulation

Go to Threat Emulations in the sidebar.
Click + New threat emulation.
Enter a title in Title, for example "Production servers" or "Corporate VPN".
In What do you want to test?, choose Infrastructure.
Click Start scoping.

Once created, the Threat Emulation only accepts static IPs. If you later need to test web applications or APIs, create another Threat Emulation of type Web/API.

Step 2: Define the scope

In the Scoping step you choose which IPs to include. You can combine new IPs with IPs you already have in your inventory.

Add a new IP: click Add new asset. A side panel opens with the form to add the asset. Enter the IP, for example 201.234.62.10, and fill in the rest of the form.
Add IPs from your inventory: click Browse inventory and select the IPs you want to include. You will only see infrastructure assets.

Each IP is an asset. You can include as many as you need.

Before testing

In the Before we test panel, check two things:

Requires VPN / jump host: turn it on if the IPs are on a private network. Choose the protocol type and upload the configuration file. For more details, see Access to your internal network via VPN.
Allowlist these IPs: add Strike's IPs to your firewall. For more details, see How to authorize Strike's IPs.

The Pre-flight Check does not apply to infrastructure Threat Emulations. If an IP is not reachable, the problem is detected during the execution, so check these two points before continuing.

When you are done, click Continue to configuration.

Step 3: Configure the testing

Infrastructure Threat Emulations are of type Full security and run at Deep depth. The Focused and Change-based options and the Medium depth are not shown for this type of Threat Emulation.

You can configure:

Recurrence: turn it on so the Threat Emulation runs automatically every month, quarter or semester (Monthly, Quarterly or Semiannual). If you leave it off, it runs only once.
Human hacking: turn it on so a security specialist manually tests the IPs in scope, together with Strike's AI agent.
Schedule start: turn it on to choose the start date and time of the testing. If you leave it off, the testing starts when you confirm.
Additional information: optional. Tell us the details that apply only to this Threat Emulation. The context of each IP, such as the role of the host, the type of device and the technical documentation, goes in the asset. For more ideas, see What to include in an asset's Description and in Additional information.

Restrictions

They are optional and apply to the whole Threat Emulation:

Exclude tests: choose the intrusive test types you do not want to run, for example Denial of Service (DoS) & Stress Testing or Destructive Payloads.
Schedule restrictions: block time windows when testing is not allowed.
Rate limit: set the maximum number of requests per minute the testing can send.

Credit estimate

The estimate card shows how many credits the Threat Emulation will consume and is recalculated with every change. Each IP consumes 85 credits per execution:

IPs in scope × 85 credits × executions per year

If you turn on Human hacking, each execution adds a human review. In How it is calculated you can see the breakdown. For more information, see Credits: what they are and how they are consumed.

Step 4: Review and confirm

Click Review & confirm.
Review the summary: IPs in scope, when it runs and the estimated cost.
Click Confirm and run.

If a schedule restriction is active at that moment, the Threat Emulation waits until the next allowed window.

Frequently asked questions

Why don't I see my web applications in Browse inventory?

Because the Threat Emulation is an infrastructure one and only accepts static IPs. To test web applications or APIs, create a Threat Emulation of type Web/API.

Can I change a Web/API Threat Emulation to infrastructure?

Only while the Threat Emulation is in Draft status. Once confirmed, the type can no longer be changed. If you need to test another type of asset, create a new Threat Emulation.

Why don't I see the Medium, Focused or Change-based options?

Because only Full security and Deep depth are available in infrastructure Threat Emulations.

Can I add an IP range?

Not yet. Each asset corresponds to a single IP. To test network ranges, contact your CSM to do it through a Project.