DORA Art. 26 and 27 / Delegated Regulation (EU) 2025/1190

A Threat-Led Penetration Test Your Supervisor Signs Off. Findings, Attack Paths, and Proof the Process Was Followed.

TLPT for financial entities designated under DORA: a named control team, a scope your competent authority validates, a targeted threat intelligence report, at least twelve weeks of active red teaming against live production, and the evidence pack that goes to your authority.

Fixed price for your scope, agreed before anything starts.

Scope My TLPT See the Evidence Pack
Control team from day oneTwelve week active phaseBuilt to be attested
The five phases of a DORA threat-led penetration test: preparation, threat intelligence, a twelve week red team phase, closure, and attestation
Alexander Sverdlov, founder of Atlant Security
Alexander SverdlovFounder, Atlant Security

Sits on the control team himself and writes the summary report your authority reads.

What Your Auditor Is Actually Asking For

The request that lands in your inbox looks like one question. It is two, and they are graded separately. Most TLPT engagements answer the first one well and the second one not at all.

The technical outcome

Identified vulnerabilities, the full attack paths that chained them together, and remediation recommendations an engineer can act on. This is the part most providers deliver.

Proof the process itself met DORA

A dedicated control team, a scope your competent authority validated, a threat intelligence report, at least twelve weeks of active red teaming, and a summary report submitted to your authority. This is the part that fails audits.

The documents in a DORA TLPT evidence pack: scope specification, threat intelligence report, test plan, red team report, blue team report, summary report and remediation plan

Who Has to Run a TLPT, and How Often

TLPT is not a universal DORA obligation. Competent authorities identify which financial entities have to perform one. If you have been identified, the cadence is at least once every three years, on live production systems, covering several or all of your critical or important functions.

Table of DORA TLPT obligations: who must test, how often, what is in scope, and who validates it

The Five Phases of a DORA TLPT

Preparation, threat intelligence, active red teaming, closure, attestation. Each phase produces a document, and the documents are the audit trail.

1

Preparation

The control team is named and kept small. Scope is drafted against your critical or important functions, written up as a scope specification, and submitted to your competent authority for validation. Testers are procured against the Article 27 criteria. Risk controls, escalation paths and a stop condition are agreed in writing before anything is touched.

2

Threat intelligence

A targeted threat intelligence report establishes which threat actors realistically go after an entity like yours, what they want, and how they operate. That report is not background reading. It is the source the red team scenarios are built from, and an auditor will check that the scenarios trace back to it.

3

Active red team testing

At least twelve weeks of active testing against live production systems, running the agreed scenarios end to end. Your blue team is deliberately not told, because the point is to measure real detection and response, not rehearsed detection and response.

4

Closure

The red team documents every attack path. The blue team documents what it saw and when. Both sides then sit in a replay or purple teaming workshop and walk the timeline together, which is where most of the durable improvement actually comes from.

5

Attestation

The test summary report and the agreed remediation plan go to your competent authority, together with the documentation showing the test followed the required process. The authority issues an attestation, which is what gives the test recognition across other EU member states.

Why the Active Phase Runs Twelve Weeks

Twelve weeks is the minimum length of the active red team testing phase. It is not padding, and it is not negotiable down because the quarter got busy. A real intrusion is slow: reconnaissance, an initial foothold, patient movement, and a long quiet period before anything visible happens. Compress that into two weeks and you are no longer testing whether your defences hold against the threat actor in the intelligence report. You are testing whether they hold against a fast, loud, budget-constrained imitation of one.

The twelve weeks also produce the thing your blue team actually needs: dwell time data. Not whether an alert fired, but how many days it took anyone to connect three alerts into one incident. That number is uncomfortable the first time. It is also the single most useful output of the entire exercise.

The Four Parties, and Who Is Kept in the Dark

A TLPT has a deliberate information asymmetry built into it. Getting the roles wrong is the most common way a technically sound test becomes procedurally unusable.

The four parties in a DORA TLPT: control team, threat intelligence provider, red team provider and competent authority

The blue team is not a party to the test

Your defenders are the subject of the measurement, not participants in it. They find out afterwards, in the replay workshop. That is uncomfortable to arrange and it is the entire reason the detection numbers mean anything. If your security operations lead needs to be told in advance for the test to be allowed to run, you have a governance problem to solve before you have a testing problem to solve.

TLPT Compared With a Standard Penetration Test

If you already buy penetration testing, the temptation is to treat TLPT as the same purchase with a bigger number on it. The two differ on scope authority, duration, environment, disclosure and deliverable. All five matter to an auditor.

Comparison between a standard penetration test and a DORA threat-led penetration test

Four Ways TLPT Evidence Fails an Audit

None of these are technical failures. Every one of them is a process failure that no amount of good red teaming compensates for.

Treating the pentest report as the deliverable

A red team report with good findings and no scope validation, no threat intelligence report and no summary submission is technically interesting and procedurally worthless. The auditor is assessing both halves.

Letting the blue team in on it

Once defenders know a test is running, the detection and response measurements stop meaning anything. Keeping the circle to the control team is a design requirement, not a preference.

Compressing the red team phase

An active red team phase shorter than twelve weeks does not meet the requirement, however thorough the testing was. Timeline evidence is one of the easiest things for an auditor to check.

Scoping around the awkward systems

Scope has to cover critical or important functions and it is validated by your competent authority, not by you. A scope that quietly excludes the systems that matter tends to come back.

What DORA Article 27 Requires of Whoever You Appoint

Article 27 sets the bar for testers, and it is a real gate rather than a formality. Before you sign with any TLPT provider, including us, ask them to evidence each of these in writing. A provider that cannot is a provider whose test may not count.

  • Suitability and reputation of the highest standard
  • Demonstrable technical and organisational capability
  • Specific expertise in threat intelligence, penetration testing and red team testing
  • Certification by an accreditation body in an EU member state, or adherence to formal codes of conduct or ethical frameworks
  • Independent assurance, or an audit report, covering sound management of the risk the testing itself creates
  • Professional indemnity insurance, including against misconduct and negligence

On internal testers

DORA permits internal testers only under conditions: approval by your competent authority, verification that dedicated resources exist, and management of conflicts of interest. Even then, the threat intelligence provider has to be external, and external testers are required on a recurring basis rather than never.

If you have a capable internal red team, the useful question is not whether to use them instead of an external provider. It is which test in the cycle they run, and whether your authority has approved that arrangement in advance.

TLPT, TIBER-EU and Your National Framework

If the phase names and the role names feel familiar, that is because the DORA testing regime was developed taking the European Central Bank TIBER-EU framework into account. Entities that have run a TIBER engagement will recognise the control team, the targeted threat intelligence report, the red team test plan and the replay workshop almost one for one.

The difference is where the obligation comes from. TIBER participation was voluntary and framework-driven. TLPT is a regulatory requirement in DORA with a delegated regulation behind it, an authority that validates your scope, and an attestation at the end that other EU supervisors recognise. If your national supervisor runs a TIBER implementation, expect the two to be operated together rather than separately.

The attestation is the point

Under DORA Article 26 the competent authority issues an attestation confirming the test was performed in accordance with the requirements. That attestation is what gives the test standing with supervisors in other member states, which matters a great deal if you are passported or operating across several jurisdictions. A test that produces findings but no attestation has to be repeated.

Find Out Whether Your Last Test Would Survive the Audit

One scoping call. Bring whatever you have: a designation letter, a previous red team report, or just the auditor's request. You will leave the call knowing whether you are in scope, what is missing from your evidence, and what the next test has to look like. Then a fixed price for the work.

Scope My TLPT

Book the TLPT Scoping Call

Threat-Led Penetration Testing FAQ

What is threat-led penetration testing (TLPT) under DORA?
TLPT is the advanced testing regime in Articles 26 and 27 of DORA, Regulation (EU) 2022/2554. It is a controlled, intelligence-led red team exercise carried out against live production systems covering several or all of a financial entity's critical or important functions. Entities identified by their competent authority must carry one out at least every three years. Commission Delegated Regulation (EU) 2025/1190 sets the procedural detail: the control team, the scope validation, the threat intelligence phase, the length of the active red team phase, and the reporting that follows.
What is the difference between a TLPT and a normal penetration test?
A normal penetration test has a scope you choose, usually runs for days or a couple of weeks, often targets staging, and your team generally knows it is happening. A DORA TLPT has a scope your competent authority validates, runs at least twelve weeks of active red teaming against live production, keeps the blue team deliberately uninformed, and produces procedural evidence alongside the findings. A penetration test report will not satisfy a DORA supervisor asking for TLPT evidence.
How long does the red team phase of a TLPT have to be?
The active red team testing phase must run for at least twelve weeks. That is the active testing window and it does not include preparation, the threat intelligence phase, or the closure and reporting work that follows. In practice a full TLPT from initiation to attestation runs considerably longer than the twelve weeks of testing alone.
Who has to run a TLPT?
Not every financial entity. Under DORA Article 26(8) competent authorities identify which entities are required to perform TLPT, based on factors including impact, financial stability concerns and ICT risk profile. If you have been identified, the obligation is at least once every three years. If you have not, you still have an annual resilience testing obligation, which is a different and lighter regime.
What is a control team in a TLPT?
The control team is the small, named internal group that runs the test in confidence. It owns the scope, the risk controls, the escalation path and the stop condition, and it is normally the only group inside the entity that knows the test is live. Its existence and its records are part of what an auditor checks, so the control team needs to be constituted and documented from the start, not reconstructed afterwards.
What does the threat intelligence report have to contain?
It has to be targeted rather than generic: which threat actors realistically target an entity of your type, size, market and technology profile, what those actors are after, and the tradecraft they use. The red team scenarios are then built from it. An auditor will look for a traceable line from the intelligence report to the scenarios that were actually executed.
What gets submitted to the competent authority?
On completion, once the reports and the remediation plan are agreed, DORA Article 26 requires the entity to provide its competent authority with a summary of the relevant findings, the remediation plans, and documentation demonstrating that the TLPT was conducted in accordance with the requirements. The authority then issues an attestation confirming the test was performed in line with those requirements, which is what allows mutual recognition of the test by supervisors in other member states.
Can we use our own internal red team?
DORA Article 27 allows internal testers only under conditions, including approval by the relevant competent authority, verification that dedicated resources exist, and assurance that conflicts of interest are managed. Even where internal testers are used, the threat intelligence provider must be external, and external testers must be used on a recurring basis rather than indefinitely. Confirm the exact rotation requirement with your authority before you plan around internal capability.
How does TLPT relate to TIBER-EU?
TIBER-EU is the European Central Bank framework for threat intelligence based ethical red teaming that predates DORA, and the DORA testing regime was developed taking it into account. If your national supervisor already runs a TIBER implementation, the vocabulary, the phase structure and the roles will look familiar. The regulatory obligation, however, comes from DORA and the delegated regulation, not from TIBER itself.
What does a TLPT cost?
Scope decides it. A test covering two critical functions at a single entity is a different piece of work from one spanning several functions and a shared ICT third-party provider. We give you a fixed price for your scope before anything starts, and you approve it first. Under DORA the financial entity bears the cost of the test and of the remediation that follows.
Can ICT third-party providers be included in the scope?
Yes, and often they have to be, because critical or important functions frequently run on them. DORA anticipates this and requires appropriate safeguards, along with contractual arrangements that oblige the provider to participate. Where a provider's participation in individual tests would adversely affect the quality of service to customers outside the scope, DORA provides for pooled testing arrangements.
We failed an audit on TLPT evidence. Can you fix it retrospectively?
Partly. Findings, attack paths and remediation plans can be reworked and presented properly. Process evidence mostly cannot be manufactured after the fact: if there was no validated scope, no targeted threat intelligence report, or the active testing ran for six weeks rather than twelve, no amount of documentation closes that. In those cases the honest answer is to plan the next test correctly, and we will tell you that on the first call rather than sell you a rewrite.

Related Services

DORA compliance and the ICT risk function - Penetration testing - Fintech virtual CISO - Incident response - Cybersecurity risk assessment