DORA Threat-Led Penetration Testing (TLPT): Who, How Often, How

#What DORA requires

Element	Requirement
Who	Financial entities identified by competent authorities under Article 26(8)
How often	At least every three years; authorities can adjust frequency based on risk profile
Scope	Critical or important functions, on live production systems, including relevant ICT third-party providers
Method	Threat-led: bespoke threat intelligence drives red-team scenarios; methodology aligned with TIBER-EU
Detailed rules	RTS on TLPT, Commission Delegated Regulation (EU) 2025/1190 [2]
Testers	Article 27 sets requirements for testers; internal testers allowed under conditions

#How a TLPT runs

Preparation: scope critical functions, form a control team that keeps the test secret from defenders.
Threat intelligence: a targeted threat report produces realistic scenarios for your entity.
Red team testing: testers execute scenarios against production over an extended period.
Closure: purple-team replay, remediation plan, and attestation.

#TLPT vs a conventional penetration test

	Conventional pentest	DORA TLPT
Driver	Scope list	Threat intelligence about actors targeting you
Target	Systems in scope	Critical or important functions end to end
Environment	Often staging or production	Live production
Defender awareness	Usually informed	Blue team not informed (control team only)
Duration	Days to weeks	Weeks to months
Output	Vulnerability report	Scenario results, purple-team replay, remediation plan, attestation

#Preparing between cycles

A three-year cycle invites a three-year blind spot. Entities that perform well run continuous validation of the same critical functions between TLPTs, so the formal test confirms resilience rather than discovering the obvious. The exposure-window model quantifies why.

#Sources

Talk to an operator.

Thirty minutes, no slides. We'll show you what bad AI finds in one of your systems.

Book a briefing