Depth and recurrence of a Threat Emulation
Last updated: October 20, 2026
In a Full security Threat Emulation, you define two parameters that determine testing coverage and credit consumption: depth (Depth) and recurrence (Recurrence). You configure them in the Test configuration step when you create the Threat Emulation.
Focused and Change-based Threat Emulations do not have configurable depth or recurrence because their scope and execution timing are already defined in another way: a Focused one runs only once and focuses on the target you define in Goal, and a Change-based one runs automatically with every pull request or release, focused on the changes included.
Depth
Depth defines the level of analysis that Strike's AI agent applies to the assets in scope. There are two levels:
Level | What it includes | Ideal for |
|---|---|---|
Medium | A complete pass over the entire surface in scope. | Regular security checks and assets with moderate exposure, such as internal tools or staging environments. |
Deep | Includes exploitation chains, business logic, and authentication abuse. | Critical assets, such as production APIs, payment systems, or authentication systems. |
The general rule: the more critical the asset is for your business, the greater the depth.
Recurrence
With the Recurrence switch turned on, the Threat Emulation runs automatically at the frequency you choose. If you leave it off, it runs only once.
Option | Executions per year | When to use it |
|---|---|---|
Monthly | 12 | Assets that change often or have high exposure. Maximum coverage over time. |
Quarterly | 4 | Balance between frequency and credit consumption. |
Semiannual | 2 | Stable assets or assets with lower exposure. |
Recurrence off | 1 | A one-time complete validation, for example an annual test or one before a launch. |
In environments that change constantly, a one-time test quickly loses validity: new vulnerabilities can appear with every deploy. Recurrence lets you detect risks as they emerge and reduce exposure time.
Recommendation: if you do not know which one to choose, we recommend Quarterly. You keep your assets validated throughout the year, with a good balance between coverage and credit consumption.
How to combine them
The final coverage depends on the combination of depth and recurrence. To choose, consider:
How critical the scope is for your business: the data it handles, its exposure, and the impact of a breach.
How often it changes.
How many credits you have available in your plan.
Examples:
Critical scope with frequent changes: Deep with Monthly recurrence.
Stable scope or scope with lower exposure: Medium with Quarterly or Semiannual recurrence.
Impact on credits
The consumption of a Full security Threat Emulation is calculated as follows:
Paths in scope × depth × executions per year
For depth, Medium multiplies by 1 and Deep multiplies by 2.
Example: a Threat Emulation with 40 paths in scope, Deep depth, and Quarterly recurrence consumes 40 × 2 = 80 credits per execution, that is, 320 credits per year.
While you configure the Threat Emulation, the estimate card shows the consumption and is recalculated with every change. For more detail, see Credits: what they are and how they are consumed.
Frequently asked questions
Can I run a Full security test only once?
Yes. Leave the Recurrence switch off.
Do Focused or Change-based Threat Emulations have depth or recurrence?
No. A Focused Threat Emulation runs only once on a specific target, and a Change-based one runs with every pull request or release. To see the differences, see Full security, Focused, and Change-based: how they differ and when to use each.
Where do I configure depth and recurrence?
When you create the Threat Emulation, in the Test configuration step. For the step-by-step guide, see How to create a Threat Emulation.