Free Guide: Threat-Led Penetration Testing under DORA

A free 12-page whitepaper for financial entities preparing for TLPT under DORA, TIBER-EU and Regulation (EU) 2025/1190. Learn who must test, the phases and deadlines, what the rules require of testers, and how to prepare. No sign-up needed.

Download the Free Guide (PDF)

The Evolving Threat Landscape

Why TLPT Preparation Starts Early

Once your TLPT authority notifies you, the clock starts: 3 months to submit initiation information, 6 months to deliver a scope specification approved by your management body, then at least 12 weeks of active red team testing on live production systems and a tightly timed closure phase. Procurement of qualified threat intelligence providers and testers often decides whether that timeline holds. This guide brings the requirements of DORA Articles 26 and 27, Delegated Regulation (EU) 2025/1190 and the updated TIBER-EU framework together in one practical document.

Our Accreditations

Trusted by
Global Enterprises

Offensive Security Certified Professional (OSCP+)

Web Application Penetration Tester eXtreme

Practical Network Penetration Tester (PNPT)

What’s Inside the Guide

Ten short chapters written for control team leads, CISOs and risk and compliance teams, with tables you can use straight away in your TLPT planning.

Guided by Leading Cybersecurity Standards:

Every regulatory detail is referenced to DORA, Delegated Regulation (EU) 2025/1190 and the ECB’s TIBER-EU update of February 2025, with sources listed at the end of the guide.

Who Must Perform TLPT

The identification criteria in Article 2 of the RTS and the entity types presumed to be in scope.

Phases and Deadlines

A timeline table of every phase, deliverable and legal deadline from notification to attestation.

Roles in a DORA TLPT

What the control team, test managers, threat intelligence provider, red team and blue team each do.

Choosing Providers and Testers

Experience, reference, insurance and independence requirements from DORA Article 27 and RTS Article 7.

Testing Live Production Safely

The six risk areas the control team must assess, plus leg-ups, escalation and suspension.

Checklist and Common Pitfalls

A step-by-step preparation checklist and the mistakes that most often derail a TLPT.

Who This Guide Is For

Whether your organisation has been designated for TLPT or wants to be ready if it is, the guide gives each stakeholder what they need.

Control Team Leads

A clear view of deadlines, deliverables and procurement steps to plan the programme from day one.

CISOs and Security Leaders

How TLPT differs from penetration testing and how to turn the results into better detection and response.

Risk, Compliance and Audit

The regulatory requirements, roles and evidence needed for the attestation, in one place.

TLPT at a Glance

Quick answers to the questions we hear most often. The guide covers each topic in more depth, with references to the regulation. Related services: TLPT for DORA & TIBER-EU and red teaming.

Threat-led penetration testing is a controlled, intelligence-led red team test of the live production systems behind a financial entity’s critical or important functions, defined in DORA Article 3.

At least every three years for financial entities identified by their competent authority, which can raise or lower the frequency based on risk.

The active red team testing phase must last at least 12 weeks under Article 11(5) of Regulation (EU) 2025/1190.

The Eurosystem updated TIBER-EU in February 2025 to align with the DORA RTS, and a test can be recognised where it meets the RTS requirements.

Security Expertise You Can Count On

Get in Touch

Have questions? Send us a message, and we’ll reply promptly.