Threat-Led Penetration Testing (TLPT) for DORA & TIBER-EU

Intelligence-led red team testing for banks, insurers, payment firms and other financial entities across Europe. We deliver the red team for DORA TLPT, TIBER-EU and national TIBER programmes, and UK CBEST and STAR-FS engagements, testing your critical or important functions on live production systems the way a real threat actor would.

Request an Assessment

The Evolving Threat Landscape

What Is Threat-Led Penetration Testing?

Threat-led penetration testing (TLPT) is a controlled red team attack on the live production systems that support an organisation’s critical or important functions. Scenarios are built from targeted threat intelligence about the actors most likely to attack you. Unlike a standard penetration test, TLPT measures detection and response as well as vulnerabilities, and it runs without the defending team knowing. Under the Digital Operational Resilience Act (DORA), which has applied since 17 January 2025, financial entities designated by their competent authority must carry out TLPT at least every three years, following Commission Delegated Regulation (EU) 2025/1190 and the TIBER-EU framework.

Our Accreditations

Trusted by
Global Enterprises

Offensive Security Certified Professional (OSCP+)

Web Application Penetration Tester eXtreme

Practical Network Penetration Tester (PNPT)

Benefits of TLPT With PenTest Hub

A well-run TLPT gives your board, your regulator and your security team an honest picture of how your organisation stands up to a capable, targeted attacker, and a clear plan to close the gaps.

Guided by Leading Cybersecurity Standards:

We work to DORA Article 26 and Delegated Regulation (EU) 2025/1190, the TIBER-EU framework and national implementations such as TIBER-IE, and the UK CBEST and STAR-FS frameworks, with tradecraft mapped to MITRE ATT&CK.

Experienced, Certified Red Team Testers

Our operators hold CREST, OSCP+ and CARTE certifications and bring the red team experience regulators expect of external TLPT testers.

Regulator-Ready Deliverables

Red team test reports, replay workshop input and evidence structured for the TLPT authority’s review and attestation.

Realistic, Intelligence-Led Scenarios

We turn targeted threat intelligence into attack scenarios that reflect the actors and techniques most relevant to your sector.

Controlled Risk on Live Systems

Agreed rules of engagement, leg-ups and an always-on line to your control team keep production safe throughout the test.

Stronger Detection & Response

The purple team replay shows your blue team exactly where attacks were missed and how to detect them next time.

TLPT Readiness Before Your First Test

Not designated yet? Our TLPT-style red team and assumed-breach exercises build blue team maturity ahead of a mandated test.

How a TLPT Engagement Runs

Every DORA TLPT follows three phases set out in the regulatory technical standards. We fit into your control team’s plan and work alongside your threat intelligence provider.

Preparation

Scoping the critical or important functions, forming the control team, agreeing rules of engagement and procuring the threat intelligence and red team providers.

Testing

Targeted threat intelligence produces attack scenarios, then our red team carries them out against live production systems, covertly and under control.

Closure

Red team and blue team reports, a purple team replay, a remediation plan and the summary needed for the TLPT authority’s attestation.

Frameworks We Support

Whether your test is mandated by DORA, run under a national TIBER programme or commissioned voluntarily, we adapt our red team methodology to the framework, the authority and your threat landscape. Related services: red teaming, social engineering testing and adversary simulation. Preparing for your first TLPT? Download our free DORA TLPT guide.

Mandatory threat-led penetration testing for designated EU financial entities under DORA Article 26, run according to Delegated Regulation (EU) 2025/1190 and overseen by the national TLPT authority.

Threat Intelligence-Based Ethical Red Teaming under the European Central Bank framework and national programmes such as TIBER-IE run by the Central Bank of Ireland, now aligned with DORA TLPT.

Intelligence-led testing for UK financial services under the Bank of England, PRA and FCA, including CBEST and the CREST STAR-FS framework.

Not in scope for mandated TLPT? We run the same intelligence-led methodology voluntarily to test resilience, prepare for future designation or give your board and clients assurance.

Security Expertise You Can Count On

Get in Touch

Have questions? Send us a message, and we’ll reply promptly.