Documentation

Guides to running your offensive security operation on StrikeOps, from first-run setup to how isolation works. This library is growing; tell us what you'd like to see.

Getting started

Stand up your firm and run your first engagement.

What Is StrikeOpsAn overview of the StrikeOps offensive security platform and how engagements, reporting, proposals, phishing and agents fit together.Read Set Up Your FirmThe first-run checklist to get operational.Read Bring Your Own AI KeyWhy StrikeOps runs AI report drafting on your own AI key (BYO LLM), and what that means for your data boundary and spend.Read

Engagements & findings

Scope work, record findings, and track retests.

Create an EngagementScope an offensive security engagement, map coverage to MITRE ATT&CK, and move it through its lifecycle.Read Continuous Engagements & RetestsContinuous offensive security testing with recurring cycles and per-cycle retest verdicts.Read

Methodology & Arsenal

The curated tool arsenal, the kill chain, and how gating works.

The Tool ArsenalThe curated offensive-security toolset every engagement launches on.Read The Offensive Kill ChainHow the arsenal maps to the offensive kill chain and MITRE ATT&CK phases of a real attack.Read How Tool Gating WorksThe four risk tiers that keep every action operator-approved.Read

Reporting

Turn findings into branded, client-ready reports.

How AI Report Drafting WorksHow the AI report engine turns findings into a client-ready report in minutes.Read Brand Your ReportsMake every deliverable unmistakably yours with white-label report templates.Read

PhishOps

Run phishing simulations and handle captures securely.

Run a Phishing CampaignRun a multi-channel phishing simulation across email, SMS and voice from one operation.Read How Credential Capture Is SecuredHow phishing credential captures are encrypted under your own key and revealed only with an audit.Read

Agents

Deploy and connect your agent fleet.

Deploy an AgentStand up a self-hosted agent on your own host and enroll it into your fleet.Read Your Tailscale Tailnet vs Public mTLSThe two ways self-hosted agents reach your environment: your own Tailscale tailnet or a hardened public mTLS edge.Read Agent Deploy PathsThe ways to stand up your self-hosted agent fleet, including zero-access in your own cloud.Read

Security & data

How isolation, encryption and support access work.

How Isolation WorksThe layers of data isolation between your data and everyone else: a separate database per firm, encryption and zero-access.Read Support Access & Break-GlassHow we help you without standing access to your data.Read Encryption Keys You OwnBring-your-own encryption keys (BYO-KMS) you hold and can revoke, separate from your AI key.Read Where Your Client Data Goes When AI DraftsWhat happens to engagement data when the AI drafts a report, and what your data boundary with the AI provider actually covers.Read Could Another Firm's Jailbreak Reach Your Data?Why a jailbreak of a shared AI model cannot expose your engagement data, and what the real risk is instead.Read How Hostile Content in Scope Is ContainedTargets under test can carry content designed to manipulate an AI agent. What stops that from becoming an action against your client.Read Running the Models in Your Own CloudFor firms whose client contracts do not permit a third-party AI processor, inference can run inside your own cloud account, in the region you choose.Read

Get started

Ready to run your offensive security operations on StrikeOps?

We're licensing StrikeOps to offensive security firms now. Talk to our team or start straight away.

Book a demo Get started

Open for business, licensing to offensive security firms now.