DORA Art. 26-27 | Financial Sector

TIBER-EU & TLPT: Threat-Led Penetration Testing under DORA.

DORA requires systemically relevant financial institutions to conduct Threat-Led Penetration Tests at least every three years, on live production systems, supervised by the competent authority, and based on real threat intelligence.

Schedule TLPT Consultation View Red Teaming Services

Last updated: March 2026 - References: DORA Art. 26-27, TIBER-EU

At Least Every 3 Years
TLPT obligation for authority-identified institutions: Live Systems
Tests on production environment required: Jan. 2025
DORA applies from 17 January 2025: 3 Phases
Preparation - Testing - Closure

Fundamentals

What is Threat-Led Penetration Testing?

TLPT (Threat-Led Penetration Testing) is a highly specialised form of red team testing in which an accredited red team simulates realistic attacks on a financial institution based on real threat intelligence - directly on live production systems.

The decisive difference from a classic penetration test: TLPT is threat intelligence-based. Before the red team begins, a Threat Intelligence Provider analyses which APT groups, attack patterns, and tactics would realistically be deployed against this specific institution. This Targeted Threat Intelligence Report (TTIR) becomes the blueprint for the attack.

DORA Art. 26-27 makes TLPT mandatory for systemically relevant financial institutions and anchors the TIBER-EU framework of the European Central Bank as the European standard. National implementations exist across the EU: TIBER-DE (Germany), TIBER-NL (Netherlands), TIBER-BE (Belgium), and others.

Criterion	TLPT	Red Teaming	Pentest
Basis	Threat Intelligence (TTIR)	Objective definition	Scope document
Test Systems	Live Production	Prod. or test	Usually test env.
Supervision	Authority supervised	Internal	Internal
Duration	Multi-month process	4-8 weeks	1-4 weeks
Attestation	EU-wide recognised	Internal	Internal

TLPT / TIBER-EU at a Glance

Legal Basis: DORA Art. 26-27 (EU 2022/2554)
DORA Applies Since: 17 January 2025
Framework: TIBER-EU (ECB) / national implementations (TIBER-DE, TIBER-NL, etc.)
Interval: At least every 3 years
Test Systems: Live production systems mandatory
Competent Auth.: National supervisory authority (e.g. Deutsche Bundesbank & BaFin in DE)

DORA applies from January 2025

Systemically relevant institutions must set up their TLPT planning now. Accredited providers have limited capacity - allow for lead times.

TIBER-EU Framework

The Three Phases of a TIBER-EU Test

TIBER-EU defines a structured, three-phase process. Each phase has clear deliverables, roles, and supervisory control points. The RTS and TIBER-EU framework define specific timelines and deadlines for each phase.

White Team

Internal Coordination Team

A small group of internal experts who know and coordinate the test. Interface with the supervisory authority. Can halt the test.

Red Team

External Attacker Provider

Accredited external service provider simulating realistic attacks based on the TTIR. Fully independent from the institution.

Blue Team

Internal Defence (SOC)

Security Operations Centre and Incident Response - do NOT know about the test. Only briefed in the Closure Phase (Purple Teaming).

Preparation & Scoping

Preparation Phase up to 6 months

The control team is established and drafts the project charter (within 3 months of authority notification) and the scope specification document (within 6 months). The management body approves the scope specification document; the TLPT authority then approves it. A threat intelligence provider meeting the qualification requirements of Art. 7 RTS 2025/1190 is commissioned. Where the TLPT authority has published a Generic Threat Landscape (GTL) for the sector, the TI provider may use it as a baseline when producing the Targeted Threat Intelligence Report (TTIR).

Red Team Execution

Testing Phase at least 12 weeks

Execution of the red team test on live production systems based on the Targeted Threat Intelligence Report. The active phase lasts at least 12 weeks. The red team simulates realistic attack scenarios aligned with the threat actors and tactics, techniques and procedures (TTPs) identified in the TTIR, targeting each critical or important function in scope. Testers report at least weekly to the control team and test managers on progress.

Red Teaming Services

Purple Teaming & Final Report

Closure Phase up to 18+ weeks

The red team and blue team submit their test reports. The control team conducts a purple teaming exercise on topics jointly identified by the blue team and testers, based on vulnerabilities identified during the test. Once the TLPT authority has confirmed completeness of both reports, the financial entity submits the summary report for authority approval within 8 weeks, accompanied by the remediation plan. The authority then issues the attestation, enabling mutual recognition between competent authorities across the EU.

DORA Art. 26

Who Must Conduct TLPT under DORA?

Competent authorities identify the financial entities required to perform TLPT, based on impact-related factors, financial stability concerns and the entity's ICT risk profile (DORA Art. 26(8)). The entity types and quantitative thresholds are set out in Art. 2 of RTS 2025/1190.

TLPT Obligation - Systemically Relevant Institutions

Authority-designated - At least every 3 years mandatory

Credit Institutions G-SII or O-SII under Art. 131 of Directive 2013/36/EU, or part of a G-SII/O-SII group
Central Counterparties (CCPs) Clearing houses under EMIR
Central Securities Depositories (CSDs) Securities settlement under CSDR
Payment Institutions Total payment transactions exceeding EUR 150 bn in each of the 2 preceding calendar years (Art. 2 RTS 2025/1190)
E-Money Institutions Payment transactions exceeding EUR 150 bn or outstanding e-money exceeding EUR 40 bn in each of the 2 preceding calendar years
Insurance Undertakings Two-stage: incl. GWP exceeding EUR 1.5 bn and technical provisions exceeding EUR 10 bn, then GWP above EUR 3 bn or technical provisions above EUR 30 bn (Art. 2(2)(g) RTS 2025/1190)
Reinsurance Undertakings Same quantitative thresholds as insurance undertakings (Art. 2 RTS 2025/1190)
Trading Venues Trading venues with an electronic trading system meeting the turnover or market-share thresholds set out in Art. 2(f) RTS 2025/1190

Criteria for Systemic Relevance

Size and total assets of the institution
Interconnectedness with other financial institutions
Importance for financial market infrastructure
ICT risk exposure and third-party dependencies

Mutual Recognition Across the EU

A TLPT conducted under TIBER-EU enables mutual recognition of threat led penetration tests between competent authorities across the EU (Art. 26 para. 7 DORA). For institutions with cross-border operations, TIBER-EU provides for multi-jurisdictional testing with involvement of relevant countries' authorities.

Voluntary TLPT - Smaller Institutions

Non-systemically relevant institutions can also voluntarily conduct TLPT. This is particularly recommended if the institution is an ICT service provider for systemically relevant entities or is seeking TIBER-EU accreditation.

Is Your Institution Subject to DORA TLPT?

In a free initial consultation, we clarify whether your institution is subject to TLPT, how to select an accredited provider, and how a typical project unfolds.

Schedule Initial Consultation

DORA Art. 27

Requirements for Red Team Providers

DORA Art. 27 defines strict requirements for external Threat Intelligence and Red Team providers. Not every penetration testing provider qualifies for TLPT - the bar is set very high.

Demonstrated Experience

Threat intelligence providers must supply at least three references from previous assignments in penetration testing and red team testing. External testers must supply at least five references from previous assignments (Art. 7 RTS 2025/1190). References are provided to the control team.

Recognised Certifications

Providers must supply copies of certifications that, according to recognised market standards, are appropriate for the performance of their activities (Art. 7(a) RTS 2025/1190). The RTS does not enumerate specific certifications; what qualifies is determined by recognised market standards applicable to the activity.

Full Independence

Providers must not simultaneously perform blue team tasks or other services presenting a conflict of interest for the tested entity. Testers may not be employed by, or provide services to, a TI provider performing blue team tasks for the same entity (Art. 7 RTS 2025/1190).

Adequate Liability Insurance

Providers must be duly covered by proper professional indemnity insurance, including against risks of misconduct and negligence (Art. 7(b) RTS 2025/1190). The RTS does not prescribe a minimum insured sum. Evidence of compliance is submitted to the test managers before the providers are contracted (Art. 9(11) RTS).

Structured Threat Intelligence Team

The TI provider team must include at least a manager with 5 or more years of experience in threat intelligence and at least one additional member with 2 or more years of experience, with knowledge of intelligence gathering tactics, techniques and procedures, and geopolitical, technical and sectorial knowledge (Art. 7 RTS 2025/1190).

Confidentiality & Data Protection

Strict confidentiality requirements: all test results, vulnerabilities, and system information are subject to the strictest confidentiality. Secure communication channels and data encryption are mandatory.

Practical Tip: National competent authorities maintain lists of accredited TIBER providers. When selecting a provider, institutions should evaluate not only formal accreditation but also financial sector experience, cultural fit, and project management capacity. AWARE7 supports you in provider selection and the entire TLPT coordination process.

Real Threat Landscape

Why TLPT is Essential for Financial Institutions

Financial institutions are the most heavily targeted sector worldwide. The following incidents show which attack patterns TLPT tests simulate and why regulatory-mandated tests on production systems are absolutely necessary.

2016 · Bangladesh Bank - SWIFT

Bangladesh Bank SWIFT Hack

Attackers compromised the SWIFT terminal system of the central bank of Bangladesh and transferred USD 81 million to accounts in the Philippines. The attack used legitimate SWIFT credentials and went undetected for weeks. A TLPT would have uncovered the weak access controls and missing monitoring.

2016 · Tesco Bank - Online Banking

Tesco Bank Online Fraud

GBP 2.5 million were debited from approximately 9,000 customer accounts over a single weekend. Attackers exploited vulnerabilities in the payment authorisation and fraud detection system. The UK FCA imposed a fine of GBP 16.4 million - inadequate ICT risk management as the main criticism.

2018 · Banco de Chile - SWIFT

Banco de Chile SWIFT Attack

While IT security was occupied with a distraction attack (malware on workstations), the Lazarus group initiated fraudulent SWIFT transactions for USD 10 million. The two-stage attack strategy shows why TLPT simulates realistic multi-stage scenarios.

2023 · MOVEit - Supply Chain

MOVEit Supply Chain Attack

The Cl0p group exploited a zero-day vulnerability in MOVEit Transfer and compromised hundreds of financial service providers worldwide. Many institutions did not know for weeks that customer data had been exfiltrated. TLPT tests explicitly examine third-party attack vectors.

Ongoing · Supervisory Authorities - IT Reviews

Regulatory IT Reviews: Deficiency Findings

Financial supervisory authorities regularly identify significant deficiencies in access controls, patch management, and incident response during special IT audits. Affected institutions receive deficiency reports with binding implementation deadlines. TLPT serves as proactive proof of resilience.

Continuous · APT Groups

State-Sponsored APT Groups

Lazarus (North Korea), APT28/Fancy Bear (Russia), and other state-sponsored groups continuously target European financial institutions. These threats form the basis of the Targeted Threat Intelligence Report in the TIBER process - realistic, specific, current.

Consulting Services

How AWARE7 Helps with TLPT & TIBER-EU

We guide financial institutions from the initial scoping assessment through provider selection to regulatory attestation - with demonstrated red team expertise and experience from regulated financial environments.

Red Teaming & TLPT Preparation

Comprehensive red teaming based on real threat intelligence. Preparation for TIBER-EU-compliant TLPT tests with regulatory accompaniment.

Request Red Teaming

Penetration Testing for the Financial Sector

Specialised penetration tests for banks, insurance companies, and payment institutions - as a precursor to TLPT or as a standalone DORA compliance measure.

Request Pentest

DORA Compliance Consulting

Full DORA consulting beyond TLPT: ICT risk management, third-party management, incident reporting, and resilience testing.

Start DORA Consulting

„TLPT under TIBER-EU is the most demanding form of security testing that exists. Financial institutions that are serious about building resilience cannot avoid regulatory-supervised red team tests on production systems. We prepare institutions for exactly this level.“

Chris Wojzechowski

Penetration Testing & Red Teaming Expert · AWARE7 GmbH

FAQ

Frequently Asked Questions on TLPT & TIBER-EU

The most important questions about TLPT, TIBER-EU, and DORA Art. 26-27 - answered with technical depth and practical guidance.

What is TLPT and how does it differ from a regular penetration test?

TLPT (Threat-Led Penetration Testing) is a high-quality, regulatory-mandated red team test for systemically relevant financial institutions. Unlike a classic penetration test: (1) TLPT is based on real, institution-specific Threat Intelligence Reports: the attack scenarios are derived from threat actors and their TTPs that would realistically target the institution. (2) TLPT is conducted on live production systems, not test environments. (3) TLPT is supervised by the competent authority. The national supervisory authority accompanies the test and validates the results. (4) TLPT is significantly more comprehensive than a typical penetration test: the active red team phase alone lasts at least 12 weeks, and the full process from notification to attestation takes considerably longer.

Who must conduct TLPT under DORA?

Competent authorities identify financial entities required to perform TLPT based on impact-related factors, financial stability concerns, and ICT risk profile (DORA Art. 26(8)). Generally subject to mandatory TLPT are: credit institutions identified as G-SII or O-SII under Art. 131 CRD, central counterparties (CCPs), central securities depositories (CSDs), payment institutions and e-money institutions meeting specific volume thresholds, insurance and reinsurance undertakings meeting specific GWP and technical-provisions thresholds, and trading venues. Critical ICT third-party service providers may be included in a financial entity's TLPT scope but are not themselves independently required to perform TLPT. Smaller institutions may voluntarily conduct TLPT or be asked to do so by the authority.

How often must TLPT be conducted?

DORA Art. 26 para. 1 requires at least every three years for a TLPT. Based on the risk profile of the financial entity and taking into account operational circumstances, the competent authority may, where necessary, request the financial entity to reduce or increase this frequency. After a successful TLPT completion, the institution receives an attestation that enables mutual recognition between competent authorities across the EU (Art. 26 para. 7 DORA).

What is TIBER-EU and how does it relate to TIBER-DE and DORA TLPT?

TIBER-EU is the overarching European framework of the ECB for Threat Intelligence-Based Ethical Red Teaming. National implementations include: TIBER-DE (Germany, operated by Deutsche Bundesbank as a voluntary service), TIBER-BE (Belgium), and others. DORA Art. 26(11) requires that TLPT-related regulatory technical standards be developed in accordance with the TIBER-EU framework. Financial entities completing a test under a national TIBER-EU implementation will be DORA TLPT-compliant, assuming they fulfil the formal TLPT-related requirements set by the competent authorities. For entities with cross-border operations, TIBER-EU provides for mutual recognition of attestations between competent authorities, which for multi-jurisdictional groups typically involves TCTs from all relevant countries.

What does a TLPT under TIBER-EU cost?

TLPT tests are considerably more complex than standard penetration tests. The red team test by AWARE7 starts from EUR 50,000 (net). In addition, there is the threat intelligence provider's targeted threat intelligence report (TTIR), typically EUR 30,000-80,000, and internal effort for the control team, purple teaming and remediation. Costs vary depending on institution size, IT landscape complexity and test scope.

Can a TLPT damage production systems?

TLPT is explicitly conducted on production systems: this is a regulatory requirement. However, strict protocols exist to prevent production outages: under exceptional circumstances triggering risks of impact on data, damage to assets, or disruption to critical or important functions, the control team lead may suspend the TLPT (Art. 11 RTS 2025/1190). The following activities are prohibited: unauthorised destruction of equipment, uncontrolled modification of information and ICT assets, and intentionally compromising the continuity of critical or important functions. The test is coordinated; the red team knows the escalation paths. After the test, a remediation plan is created.

Must the supervisory authority be present during a TLPT?

No, the supervisory authority does not need to be physically present. Its role is: (1) approval of the scope specification document at the end of the Preparation Phase (Art. 9 RTS), (2) approval of the targeted threat intelligence report at the end of the Threat Intelligence Phase (Art. 10 RTS), (3) assessment of completeness of the red team and blue team test reports, then approval of the summary report, (4) issuance of the attestation. The control team provides regular progress updates throughout the test.

Can an internal red team conduct a TLPT?

Credit institutions classified as significant in accordance with Article 6(4) of Regulation (EU) No 1024/2013 shall only use external testers (DORA Art. 26(8)). For other financial entities, under DORA Art. 27 para. 2, internal testers may be used when: (a) approved by the competent authority, (b) the authority has verified that the financial entity has sufficient dedicated resources and that conflicts of interest are avoided, and (c) the threat intelligence provider is external to the financial entity. The requirement that at least every third TLPT must involve an external tester is set out in DORA Art. 26(8). In practice, supervisory authorities recommend external providers as independence and objectivity can be better ensured.

What happens after TLPT - what remediation obligations exist?

DORA Art. 26 para. 6 requires a remediation plan after every TLPT. Under Art. 13 RTS 2025/1190, the plan must cover for each finding: a description of the identified shortcomings, proposed remediation measures with prioritisation and expected completion, a root cause analysis, and the staff or functions responsible for implementation. The plan is submitted to the TLPT authority within 8 weeks of the authority's notification that the reports are complete.

How does TLPT differ from Red Teaming?

Red teaming is the overarching term for adversarial attack simulations. TLPT is a specific form of red teaming with regulatory characteristics: mandatory threat intelligence basis (TTIR), supervisory authority accompaniment and validation, mandatory testing on production systems, formal closure procedure with regulatory attestation and EU-wide mutual recognition. Classic red teaming does not satisfy DORA TLPT requirements, which mandate threat-intelligence-based testing with supervisory authority oversight under DORA Art. 26 and RTS 2025/1190.

Aus dem Blog

Weiterführende Artikel

Alle Artikel

Compliance & Standards 30. September 2026

Cyberversicherung für Unternehmen: Welche Voraussetzungen Versicherer 2026 prüfen

Welche Sicherheitsnachweise Cyberversicherer 2026 im Underwriting verlangen, was KI daran ändert und wie der Katalog zu den Controls der ISO 27001 passt.

Jan Hörnemann

8 Min.

Compliance & Standards 17. September 2026

KI-Compliance nachweisen: Der OWASP GenAI Crosswalk ordnet 51 KI-Risiken 25 Regelwerken zu

KI-Compliance: Der OWASP GenAI Crosswalk ordnet 51 KI-Risiken den Controls aus 25 Regelwerken zu. ISO 42001, DORA und die EU-KI-VO decken je 41 davon ab.

Jan Hörnemann

6 Min.

Offensive Security 04. März 2026

Pentest-Anbieter auswählen: Worauf KMU achten müssen (2026)

Scope definieren, Angebote vergleichen, Qualifikationen prüfen: So wählen KMU den passenden Pentest-Anbieter - ohne Fallstricke.

Schedule a TLPT Initial Consultation for Financial Institutions

In a free 30-minute conversation, we clarify your TLPT obligation under DORA, explain the TIBER-EU process, and outline how a project would unfold at your institution - with timeline and a concrete next step.

Book TLPT Initial Consultation Learn More About DORA

Free · 30 minutes · No obligation