Introduction
A vulnerability scan tells you what is exploitable. An annual penetration test shows how far an attacker could get. Neither one proves your team can detect, contain, and recover from a realistic attack on a critical business function.
That gap is why the EU's Digital Operational Resilience Act (DORA) includes Threat-Led Penetration Testing (TLPT): an intelligence-driven, adversary-focused exercise that tests people, processes, and technology together. DORA has applied since January 17, 2025.
This guide is for EU-regulated financial entities, US organizations with EU financial operations, and security providers supporting in-scope firms. It covers the requirements, the lifecycle, preparation, and how to choose a partner.
Key Takeaways
- TLPT is a threat-intelligence-led resilience exercise, not a scan or a standard pentest.
- It applies only to financial entities that authorities identify, and it runs at least every three years.
- Active red-team testing lasts at least 12 weeks on live production systems.
- Good results feed remediation, incident response, and governance, not just a report.
What TLPT Means in the DORA Context
DORA's Article 3(17) defines TLPT as a framework mimicking the tactics, techniques, and procedures of real threat actors. It delivers a controlled, bespoke, intelligence-led red team test of the entity's critical live production systems.
Three features separate it from checklist testing:
- Current intelligence shapes end-to-end attack scenarios built around credible threat actors.
- Business objectives drive the test, such as reaching sensitive data, altering data integrity, or disrupting an essential service.
- Critical or important functions (Article 3(22)) set the scope: those whose disruption would materially impair financial performance, service continuity, or regulatory compliance.
Real incidents show why this matters. In one DeepSeas investigation of a possible Trigona ransomware intrusion, attackers gained access through RDP brute force on a web server.
They then moved through persistence, privilege escalation, defense evasion, and lateral movement. The attack was halted before ransomware deployed. A TLPT scenario tests whether your own team would catch the same chain in time.
DORA treats TLPT as the advanced tier. Articles 24-25 set a baseline testing program, including yearly appropriate tests of supporting ICT systems. Articles 26-27 add TLPT on top. The yearly rule does not mean an annual TLPT.
DORA Requirements for Threat-Led Penetration Testing
The binding sources are DORA itself (Regulation 2022/2554) and Commission Delegated Regulation 2025/1190, the final TLPT technical standard. Treat the adopted act as authoritative, not the earlier ESA draft.
Who Is In Scope
TLPT is required for entities that authorities identify, not every DORA entity. Microenterprises are excluded. Authorities weigh impact, systemic character, ICT risk, size, interconnectedness, substitutability, and shared group ICT.
Express selection criteria include:
- Credit institutions that are G-SIIs or O-SIIs, or members of those groups
- Payment institutions processing over EUR 150 billion in each of the two preceding years
- Electronic money institutions above EUR 150 billion in transactions or EUR 40 billion outstanding
- Central securities depositories, central counterparties, and certain trading venues
- Insurers meeting specified premium, provisions, and asset thresholds
A US group's EU financial entity carries the obligation. A US ICT provider takes part only where its services fall inside the approved scope. It does not become the responsible entity.
Frequency, Scope, and Testers
- Cycle: at least every three years, and authorities may raise or lower that frequency.
- Scope: several or all critical or important functions, on live production, validated by the authority.
- Providers: the entity must secure ICT provider participation and remain responsible for outcomes.
- Internal testers: need authority approval, dedicated resources, conflict controls, and an external threat-intelligence provider.
- External tester rule: use external testers at least every third test; significant credit institutions may use only external testers.
- Article 27 criteria: high reputability, threat-intelligence and red-team expertise, either accreditation or adherence to formal ethical codes, independent assurance, and professional indemnity insurance.
Governance and Evidence
Requirements include management accountability, a Control Team, documented risk controls, and agreed reporting. After testing, the entity submits a findings summary and remediation plan. The authority then issues an attestation, which supports mutual recognition across member states. Attestation does not remove responsibility for test impacts.
National arrangements vary. The ECB acts as authority for significant institutions, while Germany, France, and the Netherlands run national TIBER-based teams. Check your own authority's guidance.
How a DORA-Aligned TLPT Works
DORA's delegated regulation defines three stages for a TLPT.
| Stage | What happens |
|---|---|
| Preparation | Establish the Control Team, define governance, assess providers, prepare scope; authority approves scope |
| Testing | Threat-intelligence provider builds scenarios; authority approves them; Red Team plans and executes for at least 12 weeks |
| Closure | Red Team report within 4 weeks; Blue Team report and replay within 10 weeks after that; summary and remediation plan follow |
Preparation and Threat Intelligence
Preparation maps critical functions to supporting applications, infrastructure, and ICT third-party dependencies. It also settles legal authorization and rules of engagement.
The external threat-intelligence provider then identifies relevant actors, sector attack patterns, exposed assets, and likely entry points. Scenarios must tie technical actions to business impact. The authority approves the intelligence report before testing starts.
Active Testing
The Red Team works through reconnaissance, initial access, privilege escalation, lateral movement, and persistence while pursuing predefined objectives. Authorization and safety come first.
Roles are distinct:
- Control Team coordinates the test and holds the kill switch
- Red Team executes the scenarios
- Threat-intelligence provider supplies targeted intelligence
- Blue Team defends and is initially unaware
An ECB update in February 2025 renamed the White Team the Control Team and made purple teaming mandatory.
Limited information preserves realism. Predefined escalation paths, monitoring, action logging, and suspension procedures protect production.
Closure
Closure reconstructs attack paths, replays them with the defenders, and reviews detection and response. Teams then complete root-cause analysis, executive reporting, and prioritized remediation. The summary and remediation plan are due eight weeks from the specified authority notification, not simply from test end.
How TLPT Differs from Other Security Testing
These activities complement each other. None replaces another.
| Activity | Focus |
|---|---|
| Vulnerability assessment | Finds known weaknesses and misconfigurations across wide coverage |
| Penetration test | Exploits weaknesses to show attack paths and impact; does not measure detection and response |
| Red team | Stealthy, objective-driven emulation that tests people, process, and technology |
| DORA TLPT | Red team plus statutory selection, live-function scope, authority validation, and attestation |
A red team engagement is not a bigger pentest. It asks whether detection and response can stop a capable adversary pursuing a specific goal over time.
Threat Hunting
Threat hunting is defensive and ongoing. SANS defines it as focused, iterative searching for adversaries already inside your network. TLPT is an authorized simulation that tests whether you can prevent, detect, respond to, and recover from an attack.
TIBER-EU
TIBER-EU, first published in May 2018, is the methodological base. Its updated framework aligns with the DORA technical standard. But using TIBER does not replace authority validation, reporting, or attestation. A TIBER test qualifies as DORA TLPT only if the authority's formal conditions are met.
How to Prepare for TLPT and Choose a Testing Partner
Readiness Checklist
- Inventory of critical or important functions
- Asset and dependency maps, including ICT third parties
- Third-party contracts that allow testing participation
- Identity and access controls
- Security monitoring coverage
- Incident-response playbooks and business-continuity plans
- Escalation contacts and executive sponsorship
Safe Rules of Engagement
Live testing needs written boundaries:
- Authorization, including from affected ICT providers
- Prohibited actions and test windows
- Data handling rules
- Emergency contacts and rollback plans
- Kill-switch criteria
Client permission alone does not cover third-party providers. PTES states this explicitly, so obtain their consent too.
Provider Selection
The technical standard sets minimum evidence:
- Threat-intelligence provider: 3 references, a manager with 5 years of experience, and a team with 3 relevant assignments
- External Red Team: 5 references, a manager with 5 years of experience plus two testers with 2 years each, and 5 relevant assignments
Staffing must be separated so threat-intelligence staff do not report to the Red Team. ECB's 2025 procurement guidance gives no recommended certification list, so do not treat CREST or OSCP as universal mandates. Also ask about indemnity insurance, independent assurance, and secure delivery methods.
Evaluating Deliverables
Strong TLPT reports typically include:
- Attack narratives and evidence of attempted objectives
- Detection and response observations from the Blue Team
- Business-impact analysis and root causes
- Prioritized remediation and executive summaries
- Retest terms
A report that lists findings without showing what the Blue Team saw misses the point.
Where DeepSeas Fits
Look for a partner that connects offensive security, threat intelligence, 24/7 detection and response, and practitioner-led governance, risk, and compliance support. DeepSeas offers a six-layer cyber defense stack covering those areas, and its GRC specialists include ISO Lead Auditor-certified personnel. Confirm any provider's fit against the Article 27 and technical-standard criteria above.
Frequently Asked Questions
Is threat-led penetration testing legal?
Yes, when it is explicitly authorized, contractually governed, scoped, and run by competent testers with safeguards. Get legal advice for your jurisdiction and obtain permission from third-party providers whose environments are touched.
How is threat hunting different from threat-led penetration testing?
Threat hunting is a defensive search for attacker activity already in your environment. TLPT is an authorized simulation that tests your ability to detect, respond, and recover.
Is threat-led penetration testing being replaced by AI?
No. AI can assist with intelligence, analysis, and scenario development. It does not replace human authorization, judgment, accountability, or skilled adversarial testing. DORA’s technical standards still require accountable, experienced teams.
What are the 7 phases of PTES?
Pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. PTES can inform pentest planning but does not substitute for DORA's TLPT requirements.
