Security engineers often work with vulnerability scanners, penetration tests, security information and event management platforms, endpoint protection and incident response playbooks.
These tools provide important information, but a financial institution also needs to understand how its controls perform when a sophisticated attacker attempts to reach systems supporting a critical business function.
Threat-Led Penetration Testing (TLPT) provides a structured way to evaluate this broader question.
What Does DORA Require?
The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, establishes TLPT requirements for selected financial entities. Article 26 addresses testing, Article 27 covers tester requirements, and Commission Delegated Regulation (EU) 2025/1190 specifies detailed technical standards.
Not every entity within DORA's scope is automatically subject to TLPT. Financial institutions should confirm their status with the competent authority.
How TLPT Differs From Conventional Penetration Testing
A conventional penetration test may examine a web application, network segment or particular infrastructure component to identify exploitable weaknesses.
TLPT uses threat intelligence to construct realistic attack scenarios. The red team tests approved attack paths while the organization evaluates its preventive, detective and response capabilities.
Depending on the scope, the exercise may assess initial access, movement between systems, privilege escalation and attempts to reach assets associated with critical functions.
All activities must remain within the authorized scope and follow agreed operational safeguards.
Mapping Critical Functions to Technical Assets
Before testing begins, engineering and security teams should identify the systems supporting the critical or important functions in scope.
These may include:
- Applications and transaction processing services
- Identity and access management
- Networks and supporting infrastructure
- Data stores and administrative interfaces
- Monitoring and incident response systems
- Relevant external ICT dependencies
Understanding these relationships helps the organization establish a realistic scope and identify restrictions involving production services or third-party environments.
Governance Is Part of the Test
The exercise needs defined responsibilities for approval, oversight, escalation and remediation. The control team should be able to respond when activities create unexpected operational effects or approach a safety boundary.
Rules of engagement should establish permitted and prohibited activities, testing boundaries and conditions for pausing or stopping the exercise.
This is particularly important when production systems support customer transactions or essential financial services.
Closure and Remediation
After testing, the organization should review the attack paths and weaknesses identified by the red team. Relevant defensive teams can examine which activities were detected, how alerts were investigated and whether escalation procedures worked as intended.
Findings should be prioritized, assigned to owners and tracked until corrective actions are completed and verified. The organization must also address applicable reporting and attestation requirements.
Where TIBER-EU Fits
TIBER-EU, developed by the European Central Bank, provides a structured methodology for threat intelligence-based ethical red teaming.
It is not a separate regulation. Using the framework does not automatically prove DORA compliance; the exercise must satisfy the applicable regulatory requirements.
This DORA TLPT technical overview provides additional context for teams studying the testing process.
For security engineers, the key objective is to connect realistic attack simulation with measurable improvements in detection, response and operational resilience.
Top comments (0)