Banks and credit institutions
Significant providers can be designated for TLPT under DORA. Preparation takes time, so it pays to start early.
/ TLPT / DORA
Threat-Led Penetration Testing (TLPT)
Threat-led penetration testing (TLPT) is the most advanced form of intelligence-driven testing, and DORA requires it at least every three years from significant financial entities. We help you prepare, and we can deliver the red team side of the test.
[ 01 ] / WHAT IT IS
What is TLPT, and what does DORA require?
In short
Threat-led penetration testing (TLPT) is a controlled cyberattack simulation that follows the tactics of the threat actors that genuinely target your organization, and tests the critical or important functions running on live production systems. DORA requires it at least every three years from financial entities the supervisor designates.
TLPT is the regulated form of red teaming. Unlike a classic penetration test, the point is not to find as many flaws as possible, but to establish whether a realistic adversary could reach your critical or important functions, and whether your defenses would notice. The scenario is built on threat intelligence: the actors and methods that actually threaten your organization and sector.
DORA (the EU Digital Operational Resilience Act, applicable since 17 January 2025) makes TLPT part of the testing program for financial entities that the competent authority designates as significant, at least every three years. Criteria for designation include the entity's impact, systemic character and ICT maturity. The detailed rules sit in a Commission regulatory technical standard (RTS), and the process follows the TIBER-EU framework.
DORA also sets requirements for the testers: suitable expertise, technical and organizational capability, certification or adherence to a formal code of conduct, independent assurance on risk management and professional indemnity insurance. At least every third test must be carried out by external testers. Because the test runs on live systems, risk management and control are critical. This is not legal advice: confirm your specific obligations with your supervisor and legal counsel.
Regulation and frameworks
- DORA (EU) 2022/2554
- TLPT RTS
- TIBER-EU
- TIBER-HU
- MITRE ATT&CK
- ISO/IEC 27001
[ 02 ] / WHO IT'S FOR
Who is threat-led penetration testing for?
Primarily financial entities that the supervisor may designate for TLPT, but it is also one of the strongest tests available for any mature organization.
Insurers and investment firms
Testing critical or important functions against realistic attack scenarios may be expected by the regulator.
Payment and e-money institutions
For high-volume providers, availability and integrity are paramount, and TLPT provides evidence of resilience.
Critical ICT service providers
The external providers of financial entities may be involved, for example in pooled testing. Preparation matters for them too.
Risk and compliance leaders
As part of DORA readiness, we help you understand what has to be tested, when, and at what level, and how to prepare the organization.
Mature organizations testing themselves voluntarily
If you are not obliged but want to check your defenses at the highest level, the same methodology can be applied voluntarily.
[ 03 ] / WHAT'S INCLUDED
What our TLPT support includes
TLPT is a multi-party, regulated process. We support you from preparation to close-out, and can deliver the testing (red team) side.
01
TLPT readiness assessment
We check whether you are ready: whether critical or important functions are identified, whether detection and response capability exists, and whether the surrounding processes are in order.
02
Scoping and critical functions
We help identify the critical or important functions and the ICT systems behind them (including third-party providers) and align the scope with the supervisor.
03
Control team and risk management
We set up the small control team that knows about the test, along with communication and stop rules, so that live systems stay safe throughout.
04
Threat intelligence and scenarios
Targeted attack scenarios are built from the threat intelligence analysis. The framework expects threat intelligence and testing to be separated, so we agree the right parties (a separate provider or a partner) up front.
05
Red team testing in production
We execute the scenarios with real attacker methods against the designated systems under strict control.
06
Close-out and replay
A joint replay (purple teaming) in which defenders and testers walk through the attack steps and improve detection.
07
Remediation plan
Findings are turned into a risk-ranked remediation plan with owners and deadlines that you can present to the supervisor.
08
Documentation and attestation support
We help prepare the summary the supervisor expects and the documents evidencing that the test was performed. Formal attestation follows the supervisory process.
[ 04 ] / HOW IT WORKS
How a TLPT runs
The process follows the three TIBER-EU phases: preparation, testing and closure.
Preparation and launch
We agree the scope, critical functions, control team and timing, and select the threat intelligence and testing providers.
Threat intelligence
A threat profile tailored to your organization is produced, together with targeted attack scenarios. This is the foundation of the test.
Red team test
Testers carry out the scenarios on live systems in a controlled simulation lasting several weeks, with strict stop conditions.
Evaluation and reporting
At the end, a detailed report and timeline are produced and compared with your defenders' logs.
Replay and remediation plan
Defenders and testers assess detection and response together, and a remediation plan is drawn up.
Attestation and repeat
We assemble the documentation the supervisor needs, and help plan the next test, due at least every three years.
[ 05 ] / WHAT IT SOLVES
What TLPT solves, and why it pays off
Beyond meeting a regulatory obligation, TLPT gives you a realistic picture of how well your defenses work. Instead of a checklist, it uses the methods of the adversaries that genuinely threaten you to check that critical functions are protected and that your defenses notice an attack.
A well-prepared TLPT also avoids unpleasant surprises: controlled, regulated execution carries less risk for live systems, and produces well-documented, credible results for the supervisor.
- meeting the DORA TLPT requirement
- checking real protection of critical and important functions
- measuring detection and response capability
- results that are well documented and ready to show the supervisor
- minimizing risk to live systems during execution
What you receive
- TLPT readiness report and action list
- scoping and risk management plan
- attack scenarios and timeline
- final report and detection analysis
- remediation plan with owners and deadlines
- supervisory documentation pack
[ 06 ] / WHY QYNTAR
Why work with Qyntar on TLPT?
Because in TLPT, technical skill and regulatory knowledge are only enough together.
Attacker experience
On the testing side we bring real, hands-on offensive experience, so scenarios genuinely challenge your defenses.
Regulatory understanding
We understand how DORA and TIBER-EU are structured, so the test and its documentation line up with supervisory expectations.
Safety for live systems
A control team, strict rules and stop conditions protect live operations.
Preparation before the test
A TLPT readiness assessment shows in good time what to fix, so the expensive test does not run into gaps you already know about.
[ 07 ] / FAQ
Frequently asked questions: Threat-Led Penetration Testing (TLPT)
What is TLPT?
TLPT (threat-led penetration testing) is a controlled cyberattack simulation that follows the methods of real threat actors and tests the critical or important functions on live systems. DORA requires it from significant financial entities.
Who must carry out TLPT under DORA?
Financial entities designated by the competent authority as significant, at least every three years. Designation criteria include impact, systemic character and ICT maturity. To find out whether you are in scope, speak to your supervisor and legal counsel.
How does TLPT differ from red teaming or a penetration test?
TLPT is a regulated, intelligence-driven form of red teaming with a fixed process, fixed roles, a defined scope (critical or important functions) and formal documentation. A penetration test is broader and less prescriptive.
Can we use internal testers for TLPT?
The rules allow internal testers under certain conditions, but at least every third test must be performed by external testers. The exact conditions are set out in the regulatory technical standard.
What is TIBER-EU?
The European Central Bank's framework for threat-intelligence-based red teaming. The DORA TLPT rules build on it. In Hungary, the national supervisor (the MNB) provides guidance on how the framework applies.
How long does TLPT take?
From preparation to close-out it typically takes several months: after preparation and threat intelligence gathering, the active testing lasts several weeks, followed by closure and the remediation plan.
How does TLPT fit with the rest of DORA?
TLPT is the top tier of DORA's digital operational resilience testing program. It sits alongside the baseline tests (vulnerability assessments and penetration tests). See DORA.
[ 08 ] / RELATED SERVICES
You may also be interested in
[ + ] / CONTACT
Contact
E-mail
Tell us about your security challenge.
From a specific technical issue to a complex security project, we can help you find the way forward.
Show email address
info
qyntar
com