For security engineers working with European financial organizations, not every penetration test qualifies as Threat-Led Penetration Testing under DORA.
The difference matters because TLPT is a specific regulatory exercise designed to test resilience against realistic, intelligence-led attacks.
Standard Pentest vs. DORA TLPT
A standard penetration test might target a web application, API, internal network or cloud environment. The objective is to identify and validate security weaknesses within a defined technical scope.
DORA TLPT takes a broader, function-oriented approach.
Threat intelligence informs the attack scenarios. Red team testers then attempt to achieve agreed objectives against selected critical or important functions using authorized live production systems.
For an insurer, this could mean examining how weaknesses across identity services, policy administration applications, claims systems and supporting infrastructure could create an attack path to a critical business function.
The exact scope depends on the organization's functions and the applicable regulatory process.
Why Article 26 Matters
Article 26 of DORA establishes the main TLPT obligation for financial entities identified by their competent authorities. Article 27 sets out tester requirements.
Commission Delegated Regulation (EU) 2025/1190 specifies additional selection criteria and procedures for carrying out the exercise.
This means that technical capability alone is not enough. A provider performing ordinary penetration testing does not automatically qualify to carry out a regulatory TLPT.
Three Technical Considerations
- Attack paths across connected systems
Security teams should understand how an attacker might move between interconnected systems rather than examining each asset in isolation. Identity services, cloud infrastructure and business applications can all influence the path to a critical function.
- Production-system safeguards
TLPT uses live production systems. Testing boundaries, escalation procedures and operational risk controls must therefore be established before active testing begins.
- Third-party dependencies
An insurer may rely on external ICT providers for hosting, applications or data services. If these dependencies fall within the selected scope, contractual permissions and coordination arrangements become important.
What About Existing Pentest Reports?
Existing penetration testing reports can provide useful technical information, but they do not automatically satisfy TLPT requirements.
TLPT follows a specific methodology and includes regulatory expectations for threat intelligence, tester suitability, supervisory involvement, closure and reporting.
Selected entities generally conduct the exercise at least once every three years, subject to regulatory adjustments.
The Regulatory Takeaway
Security teams should distinguish between routine technical testing and a formal DORA TLPT exercise. The first question is whether the financial entity has been identified for mandatory testing; the next is whether the proposed exercise meets the applicable regulatory requirements.
Understanding this distinction is essential when planning cybersecurity testing for regulated financial environments.
Top comments (0)