what is the best practive for security regression testing after upgrades ?

Summary:

what is the best practice for security regression testing after upgrades . shall we test all roles separately or all combinations with them?

Content (please ensure you mask any confidential information):

Version (include the version you are using, if applicable):

Code Snippet (add any code snippets that support your topic, if applicable):