Statuses of a Threat Emulation and its executions
Last updated: October 19, 2026
Each Threat Emulation has a status that shows what stage it is in and which actions you can take. You can see it in the Status column of the Threat Emulations list and next to the title in the detail view.
In addition, each run has its own status, which you can see in the Executions tab of the detail view.
Threat Emulation statuses
Status | What it means |
|---|---|
Draft | The Threat Emulation was created but has not been confirmed yet. It has not run yet and has not consumed credits. |
Stand-by | The Threat Emulation is active and waiting for its next scheduled run. It also stays in this status if a schedule restriction does not allow testing at that time: it runs in the next allowed time window. |
Active testing | A run is in progress. |
Paused | The Threat Emulation is paused and does not run until you resume it. It can be paused manually, or automatically if your plan does not have enough credits for the next run. |
Failed testing | The run failed. This can happen if the Pre-flight Check fails at the start of the run or, less often, because of an error on Strike's side. In these cases, the Strike team retries the run. |
Available actions by status
Action | When it is available |
|---|---|
Pause | In any status, unless the Threat Emulation is already paused. |
Resume | Only if the Threat Emulation is paused. |
Cancel execution | Only while a run is in progress. |
Edit | Not available while a run is in progress. |
Delete | Only in Draft status. A Threat Emulation that has already had runs cannot be deleted. |
For more details on pausing and canceling, see How to pause a Threat Emulation or cancel a run.
Delete a Threat Emulation in Draft
In the Threat Emulations list, hover over the row of the Threat Emulation in Draft.
Click the delete icon.
Confirm with Delete draft.
Since a draft has never run, no results are lost. This action deletes the draft and its scope configuration, and it cannot be undone.
Run statuses
Status | What it means |
|---|---|
Verifying configuration | Strike is verifying the configuration with the Pre-flight Check. There are no run details yet. |
Configuration blocked | A configuration issue is preventing the run from starting. Check the configuration alert to resolve it. |
In progress | The run is in progress. This includes validating the findings before reporting them. |
Completed | The run has finished. |
Failed | The run could not be completed. |
Cancelled | The run was canceled with Cancel execution. |
Configuration alerts
At the start of each run, the Pre-flight Check verifies that Strike can access the assets in scope. If it finds an issue, the Threat Emulation appears in the Needs your attention block, above the list. Click View detail to see what happened. Issues are grouped by asset, with the ones blocking testing shown first.
Alert | What it means | What to do |
|---|---|---|
Configuration issues found | The run cannot start because of configuration issues, for example an asset that does not respond or a blocked Strike IP. | Follow the recommendations for each issue, resolve it, and click Retry. |
Configuration check failed | Something failed while verifying the configuration. You do not need to change anything. | Wait a few minutes and click Retry. |
Limited | The run still takes place, but something may limit coverage, for example a WAF or a rate limit. | Follow the recommendations to get complete results. Testing continues even if you do not make changes. |
For more details, see How the Pre-flight Check works and How to allowlist Strike's IPs.
Frequently asked questions
Why is my Threat Emulation in Paused if I did not pause it?
Because your plan does not have enough credits for the next run. Contact your CSM to add credits, and then resume it with Resume.
Why is my Threat Emulation in Stand-by if it should be running?
There may be an active schedule restriction. The run starts in the next allowed time window. You can review your restrictions in the Configuration tab.
My Threat Emulation is in Failed testing. Do I need to do anything?
No. The Strike team retries the run. If the issue is related to configuration, you will see an alert in Needs your attention with the steps to resolve it.
Can I delete a Threat Emulation that has already run?
No. You can only delete Threat Emulations in Draft status. If you do not want it to keep running, you can pause it.