Full security, Focused, and Change-based: how they differ and when to use each
Last updated: October 20, 2026
When you configure a Threat Emulation, you choose between three testing types: Full security, Focused, and Change-based. All three use Strike's AI agent and consume credits from the same plan. The difference is in what they test, when they run, and how they consume credits.
How they differ
Attribute | Full security | Focused | Change-based |
|---|---|---|---|
What it does | Complete testing of the entire surface in scope | Specific validation of a specific, limited target | Automatic execution when there are changes in your repositories |
When it runs | According to the recurrence (monthly, quarterly, or semiannual) or only once | Only once, when you launch it | For every pull request or release |
Human hacking | Available | Not available | Not available |
Restrictions | Yes | Yes | No |
Credit consumption | Paths in scope × depth × executions per year | Fixed amount per execution | Fixed amount for each execution triggered by a pull request or release |
Typical use case | Complete testing exercise, continuous or one-time | Digging deeper into or validating something very specific | Shortening the time between a deploy and its validation |
When to use each
Full security is the option for a complete testing exercise. Use it to cover the entire surface of your assets, either recurrently or in a single execution. For more detail, see How to create a Threat Emulation.
Focused is for small, specific scopes. Use it when you want to dig deeper into or validate something very specific, such as a flow or an endpoint. It does not replace complete testing. For more detail, see What a Focused Threat Emulation is and how to run it.
Change-based reacts to code changes. Use it if you deploy frequently and want each change to be validated close to the moment it is introduced. For more detail, see How to configure a Change-based Threat Emulation.
It is not an either-or decision
The three types complement each other. Many teams combine a Threat Emulation of the Full security type for continuous coverage, a Change-based one to validate each change, and Focused executions for specific validations. Since they all consume from the same plan, you can distribute your credits according to what you need at each moment.
You can also launch a Focused or Full security execution on demand from an existing Threat Emulation with Run now, without affecting its scheduled executions.
For more detail on consumption, see Credits: what they are and how they are consumed.