The Digital Operational Resilience Act (DORA) has introduced stricter requirements for how financial institutions test their ability to withstand cyber attacks. For selected organisations, this includes mandatory threat-led penetration testing (TLPT), which examines how a credible attacker could compromise the systems supporting critical financial services.
An organisation might regularly test its networks, applications and infrastructure, but that doesn’t necessarily show what could happen if an attacker exploited weaknesses across several systems. A compromised employee account, for example, could provide access to an internal network and, from there, a route towards a critical payment system.
DORA TLPT is designed to examine these types of attacks. Using targeted threat intelligence, it tests realistic scenarios against live production systems to understand how far an attacker could get, what the organisation would detect and how effectively it would respond.
The requirements go beyond the testing itself, covering how exercises are scoped, who can conduct them and how findings must be addressed.
Who needs to undertake DORA TLPT?
DORA came into effect on 17 January 2025, introducing common requirements for ICT risk management, incident reporting, resilience testing and third-party risk management across much of the EU financial sector.
While financial institutions covered by DORA must meet the relevant resilience testing requirements, not all are required to carry out TLPT.
Under Articles 26 and 27, regulators determine which institutions must undertake TLPT, taking into account factors such as their importance to the financial system, their ICT risk profile and the potential impact of a serious disruption.
Those selected must undergo TLPT at least once every three years, unless the regulator requires a different frequency. The detailed rules are set out in Commission Delegated Regulation (EU) 2025/1190.
As EU legislation, DORA does not automatically apply to financial institutions operating solely in the UK. However, UK headquartered groups with regulated entities in the EU may still need to meet its requirements through those entities.
What makes DORA TLPT different?
Conventional penetration testing typically focuses on an agreed application, network or infrastructure environment to identify exploitable vulnerabilities.
DORA TLPT takes a broader approach, looking at the organisation’s critical or important functions and how a credible attacker might attempt to compromise them.
An attacker might begin with a compromised employee account, exploit weaknesses in identity management and move through connected systems towards a payment platform. Those systems may have been tested individually without anyone examining whether weaknesses across them could be exploited together.
TLPT also examines how effectively an organisation detects and responds to an attack as it unfolds. Testing takes place against live production systems, using targeted threat intelligence to assess several or all critical or important functions, with safeguards in place to manage operational risks.
DORA sets specific requirements for who can conduct the testing. Threat intelligence providers must be external. Significant credit institutions under the EU’s Single Supervisory Mechanism must use external testers, while other eligible financial entities may use internal testers where permitted, provided external testers are engaged at least once every three tests.
The process is overseen by the relevant TLPT authority, with findings subject to formal reporting and remediation requirements.
Where does physical security fit in?
Although DORA focuses on digital operational resilience, attackers may use physical access or social engineering to compromise an organisation’s systems.
Weak visitor controls, for example, could allow someone to reach an unattended workstation or connect an unauthorised device to an internal network. An attacker might also use social engineering to obtain employee credentials and gain access to systems that would otherwise be difficult to reach.
DORA TLPT does not require physical intrusion testing, but it can be included where threat intelligence identifies a credible attack route and the activity is permitted within the agreed scope and rules of engagement.
For financial institutions with offices, data centres or other facilities supporting critical operations, this means physical and personnel security may need to be considered alongside technical vulnerabilities when developing attack scenarios.
How does the DORA TLPT process work?
DORA’s TLPT requirements build on TIBER-EU, the European framework for threat intelligence-based ethical red teaming developed by the European Central Bank and national central banks. Testing follows three main phases: preparation, testing and closure.
1. Preparation and scoping
The financial institution establishes a control team to manage the exercise, coordinate with the relevant TLPT authority (the regulator or designated body overseeing the test) and manage the risks associated with testing live systems.
The organisation must identify which critical or important functions will be tested and map the systems, services and third parties they depend on. This includes agreeing the scope, selecting suitable providers and putting safeguards in place to minimise the risk of disruption.
The regulatory technical standards also set deadlines for preparing and submitting the required documentation.
2. Threat intelligence and red team testing
A threat intelligence provider researches the threats most relevant to the organisation, including credible threat actors, their objectives and the techniques they use.
The findings are documented in a Targeted Threat Intelligence Report (TTIR), which is used to develop the attack scenarios. At least three threat-led scenarios must be selected, based on the intelligence gathered and the organisation’s risk profile.
This is important because a payment infrastructure provider may face very different threats from an investment management firm. Generic scenarios might identify vulnerabilities without properly testing the attacks most relevant to the organisation.
The red team then attempts to achieve agreed objectives, known as flags, using techniques such as credential compromise, social engineering, lateral movement and, where appropriate, physical access.
Testing takes place against live production systems, generally without the knowledge of the organisation’s defensive security team, or blue team. This allows the exercise to assess how well existing monitoring and incident response arrangements work in practice.
Under the technical standards, the active red team testing phase must last at least 12 weeks.
3. Reporting and remediation
Once testing is complete, the red team produces a report detailing the attacks attempted, objectives achieved and weaknesses identified. The organisation’s defensive security team, known as the blue team, also produces a report covering what it detected, how it responded and any areas for improvement.
Both teams then take part in replay and purple teaming exercises to compare the attacker’s actions with what the defenders observed.
For example, an attacker may have moved between systems without triggering an alert, or an alert may have been raised but not investigated. Understanding what happened helps identify whether the problem lies with technical controls, monitoring, internal processes or communication between teams.
The organisation must then complete the required reporting and prepare a remediation plan covering the findings, their root causes, the actions needed, who is responsible and when those actions will be completed.
Once the relevant requirements have been met, the TLPT authority issues an attestation confirming that the test was conducted in accordance with DORA’s requirements. This supports mutual recognition of the test across EU jurisdictions.
What about third party ICT providers?
Many financial institutions rely on cloud platforms, managed services and other external providers to deliver critical functions.
Where these services fall within the TLPT scope, the organisation must address how they will be tested. This can be difficult where a provider operates shared infrastructure or the financial entity does not have permission to test the underlying systems.
DORA provides arrangements for third-party participation and pooled testing in certain circumstances. Outsourcing a service does not remove the financial entity’s responsibility for meeting its TLPT obligations.
These arrangements need to be considered early, particularly where contractual permissions or coordination with several providers may be required.
Preparing for DORA TLPT
Existing penetration testing and red teaming programmes may provide a useful starting point, but they do not automatically satisfy DORA’s requirements.
For financial institutions preparing for TLPT, getting the scope right is particularly important. That means understanding which critical functions need to be tested, the systems and third parties they depend on and the attack routes that could realistically be used to compromise them.
At Toro, our red teaming work examines how attackers exploit weaknesses across cyber, physical and personnel security. We look beyond individual vulnerabilities to understand how an attacker could combine them to reach a critical system or service.
If your organisation is preparing for DORA TLPT, we can help you review your existing testing approach, consider potential attack scenarios and identify gaps that need addressing before an exercise begins.
Get in touch with our team to discuss your red teaming and TLPT preparation requirements
Frequently Asked Questions about DORA and Threat-Led Penetration Testing
What is DORA?
The Digital Operational Resilience Act (DORA) is an EU regulation designed to strengthen the digital operational resilience of financial institutions. It introduces requirements covering ICT risk management, incident reporting, resilience testing and third-party risk management. DORA has applied since 17 January 2025.
Who does DORA apply to?
DORA applies to a wide range of EU-regulated financial organisations, including banks, insurers, investment firms and certain ICT third-party service providers. UK-only financial institutions are not automatically covered, although UK businesses with regulated entities operating in the EU may have obligations through those entities.
What is DORA threat-led penetration testing (TLPT)?
DORA TLPT is an advanced form of security testing that simulates realistic cyber attacks against the live systems supporting an organisation’s critical or important functions. It uses targeted threat intelligence to assess whether attackers could compromise these systems and how effectively the organisation would detect and respond.
Is threat-led penetration testing mandatory under DORA?
Not for every organisation covered by DORA. Relevant authorities select financial institutions for TLPT based on factors including their systemic importance, ICT risk profile and the potential consequences of disruption. Selected institutions must undertake testing in accordance with DORA’s requirements.
How often is DORA TLPT required?
Financial institutions selected for DORA TLPT must undertake testing at least once every three years. The relevant authority may adjust the frequency depending on the organisation’s risk profile and operational circumstances.
How long does DORA TLPT take?
Under DORA’s regulatory technical standards, the active red team testing phase must last at least 12 weeks. The overall exercise takes longer because it also includes preparation, scoping, threat intelligence gathering, reporting and remediation planning.
What is the difference between penetration testing and DORA TLPT?
Traditional penetration testing generally focuses on identifying vulnerabilities in specific systems, networks or applications. DORA TLPT uses threat intelligence to simulate realistic attacks against critical business functions. It examines how weaknesses across different systems could be exploited together and tests the organisation’s ability to detect and respond.
Does DORA TLPT include physical security and social engineering?
DORA TLPT can include physical security testing and social engineering where threat intelligence identifies these as credible attack methods. Physical intrusion testing is not mandatory, but it may form part of an exercise where relevant and permitted within the agreed scope and rules of engagement.
Who can carry out DORA threat-led penetration testing?
DORA sets requirements for the providers conducting TLPT. Threat intelligence providers must be external. Significant credit institutions supervised under the EU’s Single Supervisory Mechanism must use external testers. Other eligible financial institutions may use internal testers where permitted, but must engage external testers at least once every three tests.