diff --git a/x-pack/plugins/osquery/cypress.config.ts b/x-pack/plugins/osquery/cypress/cypress.config.ts
similarity index 83%
rename from x-pack/plugins/osquery/cypress.config.ts
rename to x-pack/plugins/osquery/cypress/cypress.config.ts
index 4efb4ce8c5429..26b1d9b67850d 100644
--- a/x-pack/plugins/osquery/cypress.config.ts
+++ b/x-pack/plugins/osquery/cypress/cypress.config.ts
@@ -11,11 +11,10 @@ import path from 'path';
 import { safeLoad as loadYaml } from 'js-yaml';
 import { readFileSync } from 'fs';
 
-import type { YamlRoleDefinitions } from '../../test_serverless/shared/lib';
-// eslint-disable-next-line @kbn/imports/no_boundary_crossing
-import { setupUserDataLoader } from '../../test_serverless/functional/test_suites/security/cypress/support/setup_data_loader_tasks';
+import type { YamlRoleDefinitions } from '../../../test_serverless/shared/lib';
+import { setupUserDataLoader } from '../../../test_serverless/functional/test_suites/security/cypress/support/setup_data_loader_tasks';
 const ROLES_YAML_FILE_PATH = path.join(
-  `${__dirname}/cypress/support`,
+  `${__dirname}/support`,
   'project_controller_osquery_roles.yml'
 );
 const roleDefinitions = loadYaml(readFileSync(ROLES_YAML_FILE_PATH, 'utf8')) as YamlRoleDefinitions;
diff --git a/x-pack/plugins/osquery/cypress/e2e/all/add_integration.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/add_integration.cy.ts
index 649864c980ad3..3df0dc5a3d504 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/add_integration.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/add_integration.cy.ts
@@ -198,7 +198,6 @@ describe('ALL - Add Integration', { tags: [tag.ESS, tag.BROKEN_IN_SERVERLESS] },
 
       // test list of prebuilt queries
       navigateTo('/app/osquery/saved_queries');
-      cy.waitForReact();
       cy.react('EuiTableRow').should('have.length.above', 5);
     });
   });
diff --git a/x-pack/plugins/osquery/cypress/e2e/all/packs_create_edit.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/packs_create_edit.cy.ts
index acab3fc25dbd4..a0f83f6b3a01b 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/packs_create_edit.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/packs_create_edit.cy.ts
@@ -545,8 +545,6 @@ describe('Packs - Create and Edit', () => {
 
       recurse<string>(
         () => {
-          cy.waitForReact();
-
           cy.getBySel('docsLoading').should('exist');
           cy.getBySel('docsLoading').should('not.exist');
 
diff --git a/x-pack/plugins/osquery/cypress/e2e/roles/reader.cy.ts b/x-pack/plugins/osquery/cypress/e2e/roles/reader.cy.ts
index 8020a62787b66..ff79fb54a8168 100644
--- a/x-pack/plugins/osquery/cypress/e2e/roles/reader.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/roles/reader.cy.ts
@@ -48,7 +48,6 @@ describe('Reader - only READ', { tags: [tag.ESS] }, () => {
 
   it('should not be able to add nor run saved queries', () => {
     navigateTo('/app/osquery/saved_queries');
-    cy.waitForReact(1000);
     cy.contains(savedQueryName);
     cy.contains('Add saved query').should('be.disabled');
     cy.react('PlayButtonComponent', {
@@ -71,13 +70,11 @@ describe('Reader - only READ', { tags: [tag.ESS] }, () => {
 
   it('should not be able to enter live queries with just read and no run saved queries', () => {
     navigateTo('/app/osquery/live_queries/new');
-    cy.waitForReact(1000);
     cy.contains('Permission denied');
   });
 
   it('should not be able to play in live queries history', () => {
     navigateTo('/app/osquery/live_queries');
-    cy.waitForReact(1000);
     cy.contains('New live query').should('be.disabled');
     cy.contains(liveQueryQuery);
     cy.react('EuiIconPlay', { options: { timeout: 3000 } }).should('not.exist');
@@ -86,7 +83,6 @@ describe('Reader - only READ', { tags: [tag.ESS] }, () => {
 
   it('should not be able to add nor edit packs', () => {
     navigateTo('/app/osquery/packs');
-    cy.waitForReact(1000);
     cy.contains('Add pack').should('be.disabled');
     cy.getBySel('tablePaginationPopoverButton').click();
     cy.getBySel('tablePagination-50-rows').click();
diff --git a/x-pack/plugins/osquery/cypress/e2e/roles/t1_and_t2_analyst.cy.ts b/x-pack/plugins/osquery/cypress/e2e/roles/t1_and_t2_analyst.cy.ts
index 84d3e46d22d3e..94e63d1d81185 100644
--- a/x-pack/plugins/osquery/cypress/e2e/roles/t1_and_t2_analyst.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/roles/t1_and_t2_analyst.cy.ts
@@ -58,7 +58,6 @@ describe(`T1 and T2 analysts`, { tags: [tag.ESS, tag.SERVERLESS] }, () => {
 
       it('should be able to run saved queries but not add new ones', () => {
         navigateTo('/app/osquery/saved_queries');
-        cy.waitForReact(1000);
         cy.contains(savedQueryName);
         cy.contains('Add saved query').should('be.disabled');
         cy.react('PlayButtonComponent', {
@@ -80,7 +79,6 @@ describe(`T1 and T2 analysts`, { tags: [tag.ESS, tag.SERVERLESS] }, () => {
 
       it('should be able to play in live queries history', () => {
         navigateTo('/app/osquery/live_queries');
-        cy.waitForReact(1000);
         cy.contains('New live query').should('not.be.disabled');
         cy.contains(liveQueryQuery);
         cy.wait(1000);
@@ -92,7 +90,6 @@ describe(`T1 and T2 analysts`, { tags: [tag.ESS, tag.SERVERLESS] }, () => {
 
       it('should be able to use saved query in a new query', () => {
         navigateTo('/app/osquery/live_queries');
-        cy.waitForReact(1000);
         cy.contains('New live query').should('not.be.disabled').click();
         selectAllAgents();
         getSavedQueriesDropdown().type(`${savedQueryName}{downArrow} {enter}`);
@@ -103,7 +100,6 @@ describe(`T1 and T2 analysts`, { tags: [tag.ESS, tag.SERVERLESS] }, () => {
 
       it('should not be able to add nor edit packs', () => {
         navigateTo('/app/osquery/packs');
-        cy.waitForReact(1000);
         cy.getBySel('tablePaginationPopoverButton').click();
         cy.getBySel('tablePagination-50-rows').click();
         cy.contains('Add pack').should('be.disabled');
diff --git a/x-pack/plugins/osquery/serverless_cypress.config.ts b/x-pack/plugins/osquery/cypress/serverless_cypress.config.ts
similarity index 85%
rename from x-pack/plugins/osquery/serverless_cypress.config.ts
rename to x-pack/plugins/osquery/cypress/serverless_cypress.config.ts
index 6b60dc076631f..fff0d4431df52 100644
--- a/x-pack/plugins/osquery/serverless_cypress.config.ts
+++ b/x-pack/plugins/osquery/cypress/serverless_cypress.config.ts
@@ -6,8 +6,7 @@
  */
 
 import { defineCypressConfig } from '@kbn/cypress-config';
-// eslint-disable-next-line @kbn/imports/no_boundary_crossing
-import { setupUserDataLoader } from '../../test_serverless/functional/test_suites/security/cypress/support/setup_data_loader_tasks';
+import { setupUserDataLoader } from '../../../test_serverless/functional/test_suites/security/cypress/support/setup_data_loader_tasks';
 
 // eslint-disable-next-line import/no-default-export
 export default defineCypressConfig({
diff --git a/x-pack/plugins/osquery/cypress/support/e2e.ts b/x-pack/plugins/osquery/cypress/support/e2e.ts
index 76a705cb5977c..760aeb80d3ee8 100644
--- a/x-pack/plugins/osquery/cypress/support/e2e.ts
+++ b/x-pack/plugins/osquery/cypress/support/e2e.ts
@@ -23,17 +23,17 @@
 // ***********************************************************
 
 // force ESM in this module
-import type { SecuritySolutionDescribeBlockFtrConfig } from '@kbn/security-solution-plugin/scripts/run_cypress/utils';
-
 export {};
 
-import 'cypress-react-selector';
+// @ts-expect-error ts(2306)  module has some interesting ways of importing, see https://github.com/cypress-io/cypress/blob/0871b03c5b21711cd23056454da8f23dcaca4950/npm/grep/README.md#support-file
 import registerCypressGrep from '@cypress/grep';
+registerCypressGrep();
 
+import type { SecuritySolutionDescribeBlockFtrConfig } from '@kbn/security-solution-plugin/scripts/run_cypress/utils';
 import type { ServerlessRoleName } from './roles';
-import { login } from '../../../../test_serverless/functional/test_suites/security/cypress/tasks/login';
 
-registerCypressGrep();
+import 'cypress-react-selector';
+import { login } from '../../../../test_serverless/functional/test_suites/security/cypress/tasks/login';
 
 declare global {
   // eslint-disable-next-line @typescript-eslint/no-namespace
diff --git a/x-pack/plugins/osquery/cypress/tasks/navigation.ts b/x-pack/plugins/osquery/cypress/tasks/navigation.ts
index 72fe34c7bce42..13ab8d4105b3e 100644
--- a/x-pack/plugins/osquery/cypress/tasks/navigation.ts
+++ b/x-pack/plugins/osquery/cypress/tasks/navigation.ts
@@ -21,7 +21,11 @@ export const navigateTo = (page: string, opts?: Partial<Cypress.VisitOptions>) =
 
   // There's a security warning toast that seemingly makes ui elements in the bottom right unavailable, so we close it
   closeToastIfVisible();
-  cy.waitForReact();
+  cy.waitForReact(
+    10000,
+    Cypress.env('cypress-react-selector')?.root,
+    '../../../node_modules/resq/dist/index.js'
+  );
 };
 
 export const openNavigationFlyout = () => {
diff --git a/x-pack/plugins/osquery/cypress/tsconfig.json b/x-pack/plugins/osquery/cypress/tsconfig.json
index b8e92e55bbd2e..af9ee173cc90f 100644
--- a/x-pack/plugins/osquery/cypress/tsconfig.json
+++ b/x-pack/plugins/osquery/cypress/tsconfig.json
@@ -2,12 +2,13 @@
   "extends": "../../../../tsconfig.base.json",
   "include": [
     "**/*",
-    "../cypress.config.ts",
-    "../serverless_cypress.config.ts",
+    "./cypress.config.ts",
+    "./serverless_cypress.config.ts",
     "../../../test_serverless/shared/lib"
   ],
   "exclude": [
-    "target/**/*"
+    "target/**/*",
+    "../../../test_serverless/shared/lib/security/default_http_headers.ts"
   ],
   "compilerOptions": {
     "outDir": "target/types",
@@ -27,6 +28,10 @@
       "path": "../tsconfig.json",
       "force": true
     },
+    {
+      "path": "../../../test_serverless/tsconfig.json",
+      "force": true
+    },
     "@kbn/security-solution-plugin",
     "@kbn/fleet-plugin",
     "@kbn/cases-plugin"
diff --git a/x-pack/plugins/osquery/package.json b/x-pack/plugins/osquery/package.json
index a97513b3ed898..04f64a0692a8a 100644
--- a/x-pack/plugins/osquery/package.json
+++ b/x-pack/plugins/osquery/package.json
@@ -7,10 +7,10 @@
   "scripts": {
     "cypress:burn": "yarn cypress:run --env burn=2 --concurrency=1 --headed",
     "cypress:changed-specs-only": "yarn cypress:run --changed-specs-only --env burn=2",
-    "cypress:open": "NODE_OPTIONS=--openssl-legacy-provider node ../security_solution/scripts/start_cypress_parallel open --config-file ../osquery/cypress.config.ts --ftr-config-file ../../../x-pack/test/osquery_cypress/cli_config",
-    "cypress:run": "NODE_OPTIONS=--openssl-legacy-provider node ../security_solution/scripts/start_cypress_parallel run --config-file ../osquery/cypress.config.ts --ftr-config-file ../../../x-pack/test/osquery_cypress/cli_config --concurrency 1",
-    "cypress:serverless:open": "NODE_OPTIONS=--openssl-legacy-provider node ../security_solution/scripts/start_cypress_parallel open --config-file ../osquery/serverless_cypress.config.ts --ftr-config-file ../../../x-pack/test/osquery_cypress/serverless_cli_config",
-    "cypress:serverless:run": "NODE_OPTIONS=--openssl-legacy-provider node ../security_solution/scripts/start_cypress_parallel run --config-file ../osquery/serverless_cypress.config.ts --ftr-config-file ../../../x-pack/test/osquery_cypress/serverless_cli_config --concurrency 1",
+    "cypress:open": "NODE_OPTIONS=--openssl-legacy-provider node ../security_solution/scripts/start_cypress_parallel open --config-file ../osquery/cypress/cypress.config.ts --ftr-config-file ../../../x-pack/test/osquery_cypress/cli_config",
+    "cypress:run": "NODE_OPTIONS=--openssl-legacy-provider node ../security_solution/scripts/start_cypress_parallel run --config-file ../osquery/cypress/cypress.config.ts --ftr-config-file ../../../x-pack/test/osquery_cypress/cli_config --concurrency 1",
+    "cypress:serverless:open": "NODE_OPTIONS=--openssl-legacy-provider node ../security_solution/scripts/start_cypress_parallel open --config-file ../osquery/cypress/serverless_cypress.config.ts --ftr-config-file ../../../x-pack/test/osquery_cypress/serverless_cli_config",
+    "cypress:serverless:run": "NODE_OPTIONS=--openssl-legacy-provider node ../security_solution/scripts/start_cypress_parallel run --config-file ../osquery/cypress/serverless_cypress.config.ts --ftr-config-file ../../../x-pack/test/osquery_cypress/serverless_cli_config --concurrency 1",
     "nyc": "../../../node_modules/.bin/nyc report --reporter=text-summary",
     "junit:merge": "../../../node_modules/.bin/mochawesome-merge ../../../target/kibana-osquery/cypress/results/mochawesome*.json > ../../../target/kibana-osquery/cypress/results/output.json && ../../../node_modules/.bin/marge ../../../target/kibana-osquery/cypress/results/output.json --reportDir ../../../target/kibana-osquery/cypress/results && yarn junit:transform && mkdir -p ../../../target/junit && cp ../../../target/kibana-osquery/cypress/results/*.xml ../../../target/junit/",
     "junit:transform": "node ../security_solution/scripts/junit_transformer --pathPattern '../../../target/kibana-osquery/cypress/results/*.xml' --rootDirectory ../../../ --reportName 'Osquery Cypress' --writeInPlace"
diff --git a/x-pack/plugins/osquery/tsconfig.json b/x-pack/plugins/osquery/tsconfig.json
index 6cd1086b8a850..4275eda1f682a 100644
--- a/x-pack/plugins/osquery/tsconfig.json
+++ b/x-pack/plugins/osquery/tsconfig.json
@@ -1,12 +1,10 @@
 {
   "extends": "../../../tsconfig.base.json",
   "compilerOptions": {
-    "outDir": "target/types",
+    "outDir": "target/types"
   },
   "exclude": [
-    "cypress.config.ts",
-    "serverless_cypress.config.ts",
-    "target/**/*",
+    "target/**/*"
   ],
   "include": [
     // add all the folders contains files to be compiled
@@ -15,8 +13,6 @@
     "scripts/**/*",
     "scripts/**/**.json",
     "server/**/*",
-    "cypress.config.ts",
-    "serverless_cypress.config.ts",
     "../../../typings/**/*",
     // ECS and Osquery schema files
     "public/common/schemas/*/**.json",
diff --git a/x-pack/plugins/security_solution/package.json b/x-pack/plugins/security_solution/package.json
index 5a91078dbc686..a0a96b8be877d 100644
--- a/x-pack/plugins/security_solution/package.json
+++ b/x-pack/plugins/security_solution/package.json
@@ -11,10 +11,10 @@
     "cypress:burn": "yarn cypress:run:reporter --env burn=2 --concurrency=1 --headed",
     "cypress:changed-specs-only": "yarn cypress:run:reporter --changed-specs-only --env burn=2",
     "cypress:run:reporter": "TZ=UTC node ./scripts/start_cypress_parallel run --ftr-config-file ../../test/defend_workflows_cypress/cli_config --reporter ../../../node_modules/cypress-multi-reporters --reporter-options configFile=../../test/security_solution_cypress/cypress/reporter_config.json",
-    "cypress:dw:open": "NODE_OPTIONS=--openssl-legacy-provider node ./scripts/start_cypress_parallel open --config-file ./public/management/cypress.config.ts ts --ftr-config-file ../../test/defend_workflows_cypress/cli_config",
-    "cypress:dw:run": "NODE_OPTIONS=--openssl-legacy-provider node ./scripts/start_cypress_parallel run --config-file ./public/management/cypress.config.ts --ftr-config-file ../../test/defend_workflows_cypress/cli_config --reporter ../../../node_modules/cypress-multi-reporters --reporter-options configFile=../../test/security_solution_cypress/cypress/reporter_config.json; status=$?; yarn junit:merge && exit $status",
-    "cypress:dw:endpoint:run": "NODE_OPTIONS=--openssl-legacy-provider node ./scripts/start_cypress_parallel run --config-file ./public/management/cypress_endpoint.config.ts --ftr-config-file ../../test/defend_workflows_cypress/endpoint_config --reporter ../../../node_modules/cypress-multi-reporters --reporter-options configFile=../../test/security_solution_cypress/cypress/reporter_config.json --concurrency 1; status=$?; yarn junit:merge && exit $status",
-    "cypress:dw:endpoint:open": "NODE_OPTIONS=--openssl-legacy-provider node ./scripts/start_cypress_parallel open --config-file ./public/management/cypress_endpoint.config.ts ts --ftr-config-file ../../test/defend_workflows_cypress/endpoint_config",
+    "cypress:dw:open": "NODE_OPTIONS=--openssl-legacy-provider node ./scripts/start_cypress_parallel open --config-file public/management/cypress/cypress.config.ts ts --ftr-config-file ../../test/defend_workflows_cypress/cli_config",
+    "cypress:dw:run": "NODE_OPTIONS=--openssl-legacy-provider node ./scripts/start_cypress_parallel run --config-file public/management/cypress/cypress.config.ts --ftr-config-file ../../test/defend_workflows_cypress/cli_config --reporter ../../../node_modules/cypress-multi-reporters --reporter-options configFile=../../test/security_solution_cypress/cypress/reporter_config.json; status=$?; yarn junit:merge && exit $status",
+    "cypress:dw:endpoint:run": "NODE_OPTIONS=--openssl-legacy-provider node ./scripts/start_cypress_parallel run --config-file public/management/cypress/cypress_endpoint.config.ts --ftr-config-file ../../test/defend_workflows_cypress/endpoint_config --reporter ../../../node_modules/cypress-multi-reporters --reporter-options configFile=../../test/security_solution_cypress/cypress/reporter_config.json --concurrency 1; status=$?; yarn junit:merge && exit $status",
+    "cypress:dw:endpoint:open": "NODE_OPTIONS=--openssl-legacy-provider node ./scripts/start_cypress_parallel open --config-file public/management/cypress/cypress_endpoint.config.ts ts --ftr-config-file ../../test/defend_workflows_cypress/endpoint_config",
     "junit:merge": "../../../node_modules/.bin/mochawesome-merge ../../../target/kibana-security-solution/cypress/results/mochawesome*.json > ../../../target/kibana-security-solution/cypress/results/output.json && ../../../node_modules/.bin/marge ../../../target/kibana-security-solution/cypress/results/output.json --reportDir ../../../target/kibana-security-solution/cypress/results && yarn junit:transform && mkdir -p ../../../target/junit && cp ../../../target/kibana-security-solution/cypress/results/*.xml ../../../target/junit/",
     "test:generate": "node scripts/endpoint/resolver_generator",
     "mappings:generate": "node scripts/mappings/mappings_generator",
diff --git a/x-pack/plugins/security_solution/public/management/cypress.config.ts b/x-pack/plugins/security_solution/public/management/cypress/cypress.config.ts
similarity index 92%
rename from x-pack/plugins/security_solution/public/management/cypress.config.ts
rename to x-pack/plugins/security_solution/public/management/cypress/cypress.config.ts
index 160810432a1ed..200836b229783 100644
--- a/x-pack/plugins/security_solution/public/management/cypress.config.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/cypress.config.ts
@@ -6,8 +6,7 @@
  */
 
 import { defineCypressConfig } from '@kbn/cypress-config';
-// eslint-disable-next-line @kbn/imports/no_boundary_crossing
-import { dataLoaders } from './cypress/support/data_loaders';
+import { dataLoaders } from './support/data_loaders';
 
 export default defineCypressConfig({
   defaultCommandTimeout: 60000,
diff --git a/x-pack/plugins/security_solution/public/management/cypress_endpoint.config.ts b/x-pack/plugins/security_solution/public/management/cypress/cypress_endpoint.config.ts
similarity index 83%
rename from x-pack/plugins/security_solution/public/management/cypress_endpoint.config.ts
rename to x-pack/plugins/security_solution/public/management/cypress/cypress_endpoint.config.ts
index 36f68e73e6bcd..5447af2ea2f7a 100644
--- a/x-pack/plugins/security_solution/public/management/cypress_endpoint.config.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/cypress_endpoint.config.ts
@@ -6,10 +6,8 @@
  */
 
 import { defineCypressConfig } from '@kbn/cypress-config';
-// eslint-disable-next-line @kbn/imports/no_boundary_crossing
-import { dataLoaders, dataLoadersForRealEndpoints } from './cypress/support/data_loaders';
-// eslint-disable-next-line @kbn/imports/no_boundary_crossing
-import { responseActionTasks } from './cypress/support/response_actions';
+import { dataLoaders, dataLoadersForRealEndpoints } from './support/data_loaders';
+import { responseActionTasks } from './support/response_actions';
 
 // eslint-disable-next-line import/no-default-export
 export default defineCypressConfig({
diff --git a/x-pack/plugins/security_solution/public/management/cypress/tsconfig.json b/x-pack/plugins/security_solution/public/management/cypress/tsconfig.json
index dc0b2e1ca4fd4..4d7fe47ec2d23 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/tsconfig.json
+++ b/x-pack/plugins/security_solution/public/management/cypress/tsconfig.json
@@ -2,9 +2,6 @@
   "extends": "../../../../../../tsconfig.base.json",
   "include": [
     "**/*",
-    "../cypress_endpoint.config.ts",
-    "../cypress.config.ts",
-    "./cypress.d.ts"
   ],
   "exclude": [
     "target/**/*"
diff --git a/x-pack/plugins/security_solution/tsconfig.json b/x-pack/plugins/security_solution/tsconfig.json
index c77a5143f0c1a..5ba7feaae80e6 100644
--- a/x-pack/plugins/security_solution/tsconfig.json
+++ b/x-pack/plugins/security_solution/tsconfig.json
@@ -16,9 +16,7 @@
   ],
   "exclude": [
     "target/**/*",
-    "**/cypress/**",
-    "public/management/cypress_endpoint.config.ts",
-    "public/management/cypress.config.ts"
+    "**/cypress/**"
   ],
   "kbn_references": [
     "@kbn/core",
diff --git a/x-pack/test_serverless/functional/test_suites/security/cypress/tasks/login.ts b/x-pack/test_serverless/functional/test_suites/security/cypress/tasks/login.ts
index d8963783ef23d..cf5b4d7f56aa9 100644
--- a/x-pack/test_serverless/functional/test_suites/security/cypress/tasks/login.ts
+++ b/x-pack/test_serverless/functional/test_suites/security/cypress/tasks/login.ts
@@ -49,7 +49,7 @@ const sendApiLoginRequest = (
 };
 
 interface CyLoginTask {
-  (user?: ServerlessRoleName): ReturnType<typeof sendApiLoginRequest>;
+  (user?: ServerlessRoleName | 'elastic'): ReturnType<typeof sendApiLoginRequest>;
 
   /**
    * Login using any username/password