DORA threat-led penetration testing (TLPT)
Your competent authority has named the test, the framework and the clock. We run the programme: scoping with the authority, the red team against production, and the closure your attestation depends on.
CREST-accredited · TIBER-EU · CBEST · FINMA · CORIE
Four numbers your board will ask for.
DORA has applied since 17 January 2025. The framework it names is TIBER-EU, updated in 2025 to match.
Identified, or covered but not identified.
The authority decides which entities run TLPT. Both groups end up here, and they need different tests.
The full TIBER-EU programme.
External threat intelligence, a red team against your critical functions, and an attestation at the end.
- Banks and significant credit institutions
- Insurers and reinsurers
- Payment and e-money institutions
- CCPs, CSDs and trading venues
Article 24 testing, scoped to what you owe.
Annual testing of critical ICT systems, with a threat-led scenario where it earns its place.
- Scoped penetration testing on critical functions
- Scenario-based red team
- Findings mapped to Article 24
Intelligence first. Then the attack.
A standard pen test works from a scope. Threat-led penetration testing works from real threat intelligence: who would actually come for a firm like yours, what they’re after, and how they operate. A red team then emulates those specific adversaries against your live production systems, across technology, people and process, while your defenders are none the wiser.
It tests the whole chain, not a checklist: can they get in, move, and reach the crown jewels, and would your team catch them in time? It’s the closest thing to a real attack you can run on purpose.
- Works from an agreed scope
- Tests for known classes of weakness
- Often against staging, time-boxed
- Measures what’s vulnerable
- Works from real threat intelligence
- Emulates the specific adversaries who target you
- Against live production, end to end
- Measures whether you’d detect and respond
TIBER-EU, CBEST, and the rest.
Threat-led testing isn’t new. Regulators have run it for years under named frameworks. They differ in the detail, but share one shape: real intelligence, a controlled red team against production, measured by how well you detect and respond.
TIBER-EU
The framework for intelligence-led red teaming across the EU, and the basis DORA points to for threat-led testing. National versions (TIBER-DE, TIBER-NL, TIBER-IE and others) tailor it to each country.
CBEST
The UK’s framework for intelligence-led testing of financial firms: one of the originals, and the model much of this approach is built on.
And beyond
Frameworks like CORIE (Australia) and iCAST (Hong Kong) follow the same idea: real intelligence, a controlled red team, measured against your ability to detect and respond.
About six months. One control team knows.
Everyone else in the firm, including the SOC, experiences it as a real attack.
Leg-ups only where the framework allows them. The red team report, the blue team report and the remediation plan feed the summary your authority attests.
- Weeks 1–6Preparation
Scope, flags and rules of engagement agreed with your authority. Control team stood up.
- Weeks 7–12Threat intelligence
An independent provider profiles the adversaries who target firms like yours and writes the scenarios.
- Weeks 13–24Red team
Operators run the scenarios end to end against production. Weekly control team briefings.
- Weeks 25–28Closure
Replay with your defenders, the remediation plan, and the summary your authority attests.
Article 27 is the procurement checklist.
Five things every tester has to show before the test starts. We send them as one pack, with the proposal.
- Art. 27(1)(a)Suitability and reputation
Named operators, vetted and referenceable, who stay on the engagement.
- Art. 27(1)(b)Threat intelligence, penetration testing and red team expertise
Penetration testing and objective-based red teaming since 2010.
- Art. 27(1)(c)Certification by an accreditation body
CREST-accredited, with tester certifications listed per role.
- Art. 27(1)(d)Independent assurance on test-risk management
How confidential data and tooling are handled, documented for your authority.
- Art. 27(1)(e)Professional indemnity insurance
Cover that includes misconduct and negligence.
- Art. 26(8)External threat intelligence
The intelligence provider is independent of the red team. We work with one.
Findings from the test land in Incenter with their place in the attack chain, and the same critical functions stay under continuous testing between the three-year cycles.
See Incenter →