How to cancel, pause, or reschedule a Threat Emulation

Last updated: July 20, 2026

Sometimes you need to stop an assessment that's in progress. This article explains what you can do today directly from the platform and how to manage any other adjustment.

Today, the only action available directly in the platform is canceling a Threat Emulation that's running. Any other adjustment to an assessment — pausing it, rescheduling it, or coordinating a different window — is managed through your CSM (Customer Success Manager).

Canceling a Threat Emulation

The Threat Emulation is the automated testing execution. In a critical scenario — for example, an incident in the environment — you can cancel it.

Canceling permanently stops the execution in progress. It's not a pause: the execution doesn't resume later and isn't put on hold.

From the Threat Emulation detail view:

  1. Go to the detail view of the Threat Emulation that's running.

  2. Click Cancelar emulación, in the upper right corner.

  3. Confirm the action.

The execution stops permanently.

Pausing or rescheduling an assessment

The platform doesn't currently have a pause or reschedule option. If you need to temporarily stop an assessment, move it to a different window, or coordinate any other adjustment, contact your CSM (Customer Success Manager).

Frequently Asked Questions

Is canceling a Threat Emulation the same as pausing it? No. Canceling permanently stops the execution and it doesn't resume. The platform doesn't have a pause option.

Can I resume a Threat Emulation I canceled? No. Cancellation is permanent: it doesn't resume. To run another assessment, you need to coordinate a new execution. Manage this with your Customer Success Manager.

Can I pause a Threat Emulation instead of canceling it? The platform doesn't currently have a pause option: the only action available is canceling. If you need to coordinate an alternative, talk to your CSM.