DORA TLPT
Threat-Led Penetration Testing (TLPT) Under DORA
Intelligence-led red team testing of your critical or important functions on live production systems, planned around the DORA RTS on TLPT and aligned with TIBER-EU methodology.
What a TLPT engagement covers
- Red teaming aligned with MITRE ATT&CK
- Red team plan built from your TI provider’s scenarios
- Testing on live production systems
- Purple teaming in the closure phase
- Documents for your Article 27 assessment
Fixed scope, fixed tester-days, fixed price, agreed before testing starts.
Scoped and quoted per engagement. Priced in tester-days, no hidden fees. How the test works · See a sample report
Threat-led penetration testing (TLPT) is the advanced testing DORA requires from selected EU financial entities: a red team exercise, built on threat intelligence, that imitates real attackers against the live production systems behind your critical or important functions. It shows whether your people, processes and technology can withstand a targeted attack, not just which vulnerabilities exist.
DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025. Its TLPT rules are detailed in separate regulatory technical standards that mirror the TIBER-EU framework. This page explains who has to run TLPT, how an engagement runs, what DORA expects from testers and what to do if you haven’t been selected but still need the testing Article 25 describes.
Key takeaways
- TLPT is an intelligence-led red team test on live production systems, covering several or all critical or important functions, generally at least every three years.
- Your TLPT authority decides which financial entities must run TLPT. Microenterprises are excluded.
- The RTS sets three phases (preparation, testing and closure), at least 12 weeks of active red team testing and mandatory purple teaming.
- TIBER-EU and DORA TLPT are aligned, and a TIBER-EU test can count as a DORA TLPT if it meets DORA’s formal TLPT requirements.
- Under Article 27, your entity may only use testers that meet its requirements, so the check is yours to run. Ask for evidence on each requirement before you sign.
- Entities not selected for TLPT still need an Article 24 and 25 testing programme, which can include penetration tests alongside scans and other tests. Red teaming at Pentestica starts from $15,000, and a full TLPT is quoted individually.
Built on threat intelligence
We execute the scenarios your threat intelligence provider derives from threats relevant to your entity, not a generic checklist.
Controlled on production
We test the systems behind your critical or important functions under rules your control team manages.
Purple teaming
Testers replay techniques with your defenders so missed detections turn into concrete fixes.
Documents for procurement
Testers’ certifications and our methodology are available on request for your Article 27 assessment.
What Is Threat-Led Penetration Testing (TLPT)?
Threat-led penetration testing is a controlled attack that copies how the threat actors relevant to your organization actually operate, run against live systems to test prevention, detection and response together. Article 26 of DORA makes it a legal requirement for selected financial entities, and the regulatory technical standards (RTS) on TLPT set out how a test must be run.
The “threat-led” part is what separates it from a conventional penetration test. Before any attack starts, a threat intelligence phase studies who is likely to target your entity and how, then turns that into attack scenarios. Under the RTS, at least three scenarios are selected. The red team then plays them out against the people, processes and technology behind your critical or important functions.
The goal isn’t a longer list of vulnerabilities. It’s an answer to a harder question: if a capable, motivated attacker went after the services your customers and markets depend on, how far would they get, and would your defenders notice in time?
The RTS is Commission Delegated Regulation (EU) 2025/1190. It was adopted on 13 February 2025, published in the Official Journal on 18 June 2025 and entered into force on 8 July 2025. It mirrors the methodology, process and structure of TIBER-EU, the European framework for threat intelligence-based ethical red teaming.
Know what you want tested?
Send us your scope and get the test type, tester-days, timeline and a fixed price in writing. Prefer to compare first? See our prices.
Who must run TLPT under DORA?
You must run TLPT if your TLPT authority identifies your financial entity as required to do so. Delegated Regulation (EU) 2025/1190 sets the criteria authorities apply, and microenterprises are excluded.
Once your entity is selected, Article 26 of DORA sets the ground rules:
Frequency
generally at least every three years. The authority can adjust that frequency for a given entity.
Scope
several or all of your critical or important functions.
Environment
live production systems, not a test copy.
ICT third-party service providers
providers in scope must take part. Where a provider’s participation could affect the quality or security of services to customers that fall outside DORA’s scope, or the confidentiality of data related to those services, pooled testing is possible.
Attestation
an attestation is issued after the test, and it serves mutual recognition between authorities.
How does a TLPT engagement run?
Preparation
Your entity sets up a control team, the small group that knows about the test and manages it (TIBER-EU previously called it the White Team). It defines which critical or important functions are in scope and procures the testing providers. This is where you check testers against Article 27.
Threat intelligence
The threat intelligence provider analyzes the threats relevant to your entity and its functions, and at least three scenarios are selected for the red team to execute.
Red team testing
Testers carry out the scenarios against live production systems. Active red team testing lasts at least 12 weeks under Article 11(1) of the RTS. Our red team reporting is aligned with MITRE ATT&CK, so your defenders can trace each step afterwards.
Closure and purple teaming
The red team and your defenders review the test together. Purple teaming is mandatory in this phase under Article 12(5) of the RTS: testers replay techniques alongside the defenders, so both sides see where detection and response worked and where they didn’t.
Remediation and attestation
Findings feed your remediation work, and the attestation issued at the end serves mutual recognition between authorities.
TLPT vs standard penetration testing vs red teaming
A standard penetration test finds and proves weaknesses in an agreed scope, a red team exercise tests whether your defenders detect and stop a goal-driven attack, and TLPT is a regulated red team exercise built on threat intelligence, with its rules set by DORA and the RTS.
| Aspect | Standard penetration test | Red teaming | DORA TLPT |
|---|---|---|---|
| Main question | Which weaknesses in this scope can be exploited? | Can an attacker reach a goal without being stopped? | Can realistic threat actors compromise your critical or important functions? |
| Driver | Your testing programme, audits and system changes | Voluntary internal assurance | Selection by your TLPT authority |
| Threat intelligence | Optional | Informs the objectives | A dedicated phase, with at least three scenarios selected |
| Scope | Agreed systems, applications or networks | Objectives agreed with a small group | Several or all critical or important functions |
| Environment | Production or test, as agreed | As agreed, usually production | Live production systems |
| Duration | Typically 1 to 3 weeks of testing plus reporting | Scoped per engagement | At least 12 weeks of active red team testing, plus preparation and closure |
| Third parties | Only if they authorize testing | Only if they authorize testing | ICT third-party service providers in scope must take part |
| Ending | Report and retest | Report and debrief | Mandatory purple teaming, then attestation |
These tests aren’t rivals. Regular penetration tests keep individual systems in shape, while TLPT checks how the whole organization holds up. The ECB announced the updated TIBER-EU framework on 11 February 2025.
What does DORA require from TLPT testers?
DORA Article 27 requires external TLPT testers to be of the highest suitability and reputability, to have the right capabilities and expertise, to be certified by an accreditation body in a Member State or to adhere to formal codes of conduct or ethical frameworks, to provide independent assurance on risk management and to carry professional indemnity insurance. The duty to use only testers that meet these requirements sits with your entity. Here’s what each one means in procurement.
Highest suitability and reputability
The tester’s track record and standing should match the sensitivity of attacking live financial systems. Ask for references from comparable engagements and check how the provider handles conflicts of interest.
Capabilities and expertise
Testers need technical and organizational capabilities, plus expertise in threat intelligence, penetration testing and red teaming. Ask who will be on the team, what they’ve done before and how the provider supervises and documents a long red team phase.
Certification or formal codes of conduct
Testers must be certified by an accreditation body in a Member State or adhere to formal codes of conduct or ethical frameworks. Ask which route the provider relies on and for the documents behind it. Individual certifications such as OSCP show skills, but they aren’t accreditation.
Independent assurance on risk management
The provider must supply independent assurance or an audit report on how it manages the risks of carrying out the test. Ask to see it before contract signature, not after.
Professional indemnity insurance
Testers must be covered by professional indemnity insurance. Ask for the policy details and check that the cover fits testing on live production systems.
Internal testers are allowed under conditions: approval from the authority, no conflict of interest and threat intelligence from an external provider. An entity that uses internal testers must contract external testers every three tests. DORA Articles 26 and 27 set out these conditions.
What if you are not required to run TLPT?
If your entity isn’t selected for TLPT, you still need to test. DORA Articles 24 and 25 require financial entities to maintain a digital operational resilience testing programme, and Article 25 lists tests it can include: vulnerability assessments and scans, network security assessments, scenario-based tests, performance tests and penetration tests, among others.
Penetration testing gives that programme its most direct evidence, because it proves which weaknesses can be exploited rather than listing what a scanner flagged. Map tests to the systems behind your critical or important functions:
Internet-facing perimeter
external penetration testing shows whether an outsider can get in through exposed services, portals and remote access.
Internal network and Active Directory
internal penetration testing shows how far one compromised account or device can spread.
Customer-facing applications
web application penetration testing covers online banking, trading and insurance portals, including business logic.
APIs and integrations
API penetration testing covers payment, open banking and partner interfaces. Our FinTech API case study shows what that looks like on a high-volume platform.
How Pentestica supports TLPT and DORA testing
Pentestica runs red teaming engagements aligned with MITRE ATT&CK, and can act as the external red team tester in a TLPT if your entity’s Article 27 assessment confirms we meet the tester requirements. We’re an EU-based company, and we also cover the Article 25 penetration testing your programme needs between TLPT cycles.
Our team includes 25 certified senior pentesters holding certifications such as OSCP, OSCE and CISSP, with 10+ years of offensive security operations and 500+ executed penetration tests. During procurement, we provide our testers’ certifications and a description of our methodology on request, so your Article 27 assessment starts from documents rather than claims. Every engagement ends with an Executive Summary for management and a Technical Report for your security team.
Clear limits matter in regulated work, so here are ours. We aren’t accredited or recognized by any TLPT authority, and we don’t hold CREST. We don’t certify DORA compliance: our reports are evidence for your own assessment and for your authority. We don’t act as the threat intelligence provider. Your test’s threat intelligence provider supplies the scenarios, and we build the red team plan from them and work with that provider and your control team throughout.
How long does TLPT take and what does it cost?
A DORA TLPT takes months, not weeks: active red team testing alone lasts at least 12 weeks under the RTS, with preparation, threat intelligence and closure around it. Red teaming engagements at Pentestica start from $15,000. A full DORA TLPT is scoped and quoted individually, because its length and effort depend on your functions and scenarios.
| What moves the quote | Why it matters |
|---|---|
| Critical or important functions in scope | Each function adds systems, people and processes the scenarios have to reach. |
| Number of scenarios | At least three are selected, and each needs its own planning, execution and evidence. |
| Length of active testing | Twelve weeks is the minimum, and complex scenarios can need longer. |
| ICT third-party participation | Coordinating with providers, or with a pooled test, adds planning and communication time. |
| Closure and purple teaming | Replay sessions with your defenders and closure reporting add tester-days after the active phase. |
We price in tester-days with no hidden fees, and re-testing after fixes is available. Our pricing page lists published ranges for standard assessments. For a TLPT or red team quote, send us your scope.
What can you check before you hire us?
Three things you can verify for yourself: what the report looks like, who does the testing, and how a real engagement went.
What does the report look like?
Every report opens with an executive summary for management, then one page per finding: severity and CVSS score, evidence of exploitation, business impact and step-by-step remediation. A retest is available after fixes, and the updated report shows which findings are closed. Browse our sample pentest report with every section explained.
Who tests your systems?
Senior pentesters from our team of 25, holding hands-on offensive security certifications such as OSCP and OSCE alongside CEH, CISA, CISM and CRISC.
Our case studies
How we tested a FinTech API, a medical SaaS platform and a retail web store: scope, findings, fixes and the retest.
Frequently asked questions
Can internal testers run TLPT?
Yes, under conditions: authority approval, no conflict of interest and threat intelligence from an external provider. Entities using internal testers must still contract external testers every three tests, under Articles 26(8) and 27(2) of DORA.
Is TIBER-EU the same as DORA TLPT?
No, but they’re closely aligned. The RTS mirrors TIBER-EU’s methodology, process and structure, and the January 2025 TIBER-EU update made purple teaming mandatory and renamed the White Team to Control Team. A TIBER-EU test can count as a DORA TLPT if it meets DORA’s formal TLPT requirements.
How often must TLPT be performed?
Generally at least every three years, under Article 26 of DORA. The TLPT authority can adjust that frequency for a particular entity, so follow what your authority has communicated to you.
Do cloud and other ICT providers take part in TLPT?
Yes. ICT third-party service providers in scope must participate. Pooled testing is an option where their participation could affect the quality or security of services to customers that fall outside DORA’s scope, or the confidentiality of data related to those services.
Does a TLPT certify DORA compliance?
No. A TLPT tests resilience, and it isn’t a compliance certificate. The attestation issued afterwards serves mutual recognition between authorities, and test reports are evidence within your wider DORA assessment.
Can Pentestica be our external TLPT tester?
It can, if your entity’s Article 27 assessment confirms we meet the tester requirements. We aren’t accredited by any TLPT authority, so we support your assessment with our testers’ certifications and methodology on request. Start with a scoping conversation.
Fixed-price quote
Plan your threat-led penetration test
Tell us what to test. You get a written scope, the number of tester-days and a fixed price before any testing starts. No hidden fees.
See a sample report first (18-page PDF, no email required)
Red teaming from $15,000. A full DORA TLPT is scoped and quoted individually. All prices
Red team market ranges are listed in our red team and pentest cost benchmarks.
What happens after you send it
- Tell us what to test Tell us whether your TLPT authority has selected you for TLPT, which critical or important functions and ICT third-party providers are in scope, and your timeline. Not selected? Send the systems your DORA testing programme needs to cover.
- Get a written scope and price We reply by email with scoping questions or a fixed quote in tester-days.
- Test, report, retest A full DORA TLPT includes at least 12 weeks of active red team testing. Critical findings are reported during testing. Retesting after fixes is available.
- OSCP, OSCE and CISSP certified testers
- 500+ penetration tests
- Aligned with OWASP WSTG, PTES and NIST SP 800-115
- Executive summary and technical report