diff --git a/tests/functional/pytest.ini b/tests/functional/pytest.ini
index 1e71f5e5..43096751 100644
--- a/tests/functional/pytest.ini
+++ b/tests/functional/pytest.ini
@@ -1,5 +1,5 @@
 [pytest]
 markers =
-	security: security objectives coverage
+	security: security objectives coverage, do not run by default
 	long: long, do not run by default
-addopts = --ignore=tests/security -m "not long"
+addopts = -m "not long and not security"
diff --git a/tests/functional/tests/security/conftest.py b/tests/functional/tests/security/conftest.py
index 6a52b14d..c00e1f79 100644
--- a/tests/functional/tests/security/conftest.py
+++ b/tests/functional/tests/security/conftest.py
@@ -11,6 +11,7 @@
     c_uint16,
     c_int
 )
+from pathlib import Path
 from tests.utils.random import RandomStringGenerator, RandomGenerator, DefaultRanges, Range
 
 from pyocf.types.cache import CacheMode, MetadataLayout, PromotionPolicy
@@ -21,6 +22,17 @@
 sys.path.append(os.path.join(os.path.dirname(__file__), os.path.pardir))
 
 
+def pytest_collection_modifyitems(session, config, items):
+    # This hook receives all items collected in session (not only from directory conftest is located
+    # in). Additional path-based filtering is needed.
+
+    base_dir = Path(config.rootdir)
+    for item in items:
+        rel_path = Path(item.fspath).relative_to(base_dir)
+        if rel_path.match("*/security/*"):
+            item.add_marker(pytest.mark.security)
+
+
 def enum_min(enum):
     return list(enum)[0].value