Threat-Led Penetration Testing, Defined
Threat-led penetration testing, or TLPT, is an advanced security test that uses real threat intelligence to imitate how genuine attackers would target a specific organisation. A specialist red team runs a covert, controlled attack against the live production systems that support an entity’s critical or important functions, testing both the technology and whether the organisation’s defenders detect and respond in time.
DORA defines it formally as “a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems” (Regulation (EU) 2022/2554, Article 3(17)).
What separates TLPT from ordinary testing is the realism. The scenarios are not generic. They are built from intelligence about the actual groups that attack your sector, so the exercise mirrors a real campaign rather than a checklist.
It is now a legal duty. Under the EU Digital Operational Resilience Act (DORA), many financial entities must run TLPT on a fixed cycle. For them the question is no longer whether to test this way, but how to do it well and prove it to a regulator.
How a TLPT Works, Phase by Phase
A DORA TLPT follows the European Central Bank’s TIBER-EU framework, which breaks the exercise into three phases. The framework is deliberately strict, because the test runs against live systems and must not cause real harm.
Preparation comes first. The entity agrees the scope and decides which critical or important functions are in play. It stands up a small control group that is allowed to know about the test and procures two external specialists, a threat intelligence provider and a red team.
Testing is the core. The threat intelligence provider builds a bespoke profile of the adversaries most likely to target the entity and turns it into attack scenarios. The red team then runs those scenarios as a covert campaign against the live environment. Under the TLPT technical standards this active phase lasts at least 12 weeks.
Closure turns the attack into lessons. The red team documents what it did and found, then the red and blue teams replay the campaign together in a session known as purple teaming, so the defenders learn exactly where they were seen and where they were missed. The entity then remediates and reports to its authority.
Five roles make the test work.
- White team: The small group inside the entity that knows the test is happening and keeps it safe.
- Blue team: The in-house defenders being tested. They are kept unaware so their response is genuine.
- Red team: The external testers who emulate the attacker.
- Threat intelligence provider: The external specialist that profiles the real adversaries and shapes the scenarios.
- TLPT authority: The regulator team that oversees the test and issues the attestation at the end.
TLPT and Other Security Tests
TLPT sits at the top of a ladder of security testing. Knowing where it fits helps you see why it is treated as the advanced tier and why a routine scan or pen test does not satisfy it.
- Vulnerability scanning: Automated checks that flag known weaknesses across many systems at once. Broad, fast and routine.
- Penetration testing: A human-led test of defined systems for exploitable flaws. DORA expects this kind of testing at least annually under Articles 24 and 25.
- Red teaming: A goal-driven simulation that tests people, process and technology together and measures how well an attack is detected and handled.
- Threat-led penetration testing: Red teaming driven by bespoke intelligence on real adversaries, run covertly against live production systems that support critical functions, under strict tester rules and regulator oversight. The advanced tier.
- Breach and attack simulation: Automated, repeatable emulation of attacks. Useful for continuous checking between tests, but not a replacement for a full TLPT.
The difference is the combination. Plenty of tests probe technology. TLPT is the one that puts bespoke intelligence, stealth, live systems and a regulator’s eye together, which is why it reveals things the others miss.
Why TLPT Matters for Your Business
Finance is where the money is, so it is where the attackers go. The IMF reported in April 2024 that nearly one-fifth of all cyber incidents over the past two decades have hit the financial sector, causing almost $12 billion in direct losses to financial firms since 2004.
The tail is getting heavier. The same report found that extreme losses have more than quadrupled since 2017, to at least $2.5 billion, and warned that a serious incident at one firm could shake confidence across the system.
This is why DORA frames a cyberattack on a bank as an operational-resilience failure, not just an IT problem. If an incident stops payments or settlement, customers and markets feel it directly. DORA puts that risk on the board’s desk.
TLPT answers a simple business question. Would your real defences stop a real attacker, and would you notice in time. It is cheaper to learn that from a controlled test than from an incident, and the findings give your board and your regulator concrete evidence rather than assurances.
Real-World Cases
TLPT exists because these attacks are real. Each case below shows the kind of adversary behaviour a threat-led test is built to surface, together with the control that would have changed the outcome.
The Bangladesh Bank SWIFT Heist, 2016
In February 2016 attackers that the US government attributes to North Korea’s Lazarus Group reached the payment environment of Bangladesh Bank and sent 35 fraudulent instructions over the SWIFT network, trying to move roughly $951 million from the bank’s account at the Federal Reserve Bank of New York.
They got $81 million out to accounts in the Philippines, and most of it was never recovered. A larger loss was avoided only because a misspelled instruction and a routine review at the New York Fed flagged the other transfers.
The attackers had been inside for about a year and used malware to delete the bank’s own record of the fraudulent payments. A threat-led test puts exactly this to the proof, whether someone can sit undetected in the payment function and whether unusual transfers are caught independently.
The Equifax Breach, 2017
Equifax was breached in 2017 through a web vulnerability it had failed to patch, the Apache Struts flaw CVE-2017-5638, for which a fix had been available since March that year. The attackers entered through a public dispute portal.
From there they moved across a flat internal network and quietly took data for 76 days before anyone noticed. The US Government Accountability Office found they reached the personal data of at least 145.5 million US consumers.
The entry point was one unpatched server, but the damage came from months of undetected movement. That detection gap is precisely what a threat-led test measures, how far an attacker gets once inside and how long before the defenders see them.
The ICBC Ransomware Attack, 2023
In November 2023 the LockBit ransomware group, which claimed responsibility and which security researchers identified as the attacker, hit ICBC Financial Services, the US broker-dealer arm of one of the world’s largest banks. The attack disrupted the unit’s ability to settle US Treasury trades.
It left its US unit owing around $9 billion to BNY Mellon for unsettled US Treasury trades, and staff resorted to carrying settlement details across Manhattan on a USB stick. Officials said the wider market impact was limited, but the critical function itself stopped.
Ransomware did not need to breach the whole bank to cause this, only to reach a function the market depends on. DORA is built around that lesson, and a threat-led test checks whether an attacker could reach a critical function and whether the business keeps running if one falls over.
TLPT and Compliance
TLPT is a legal duty for the financial entities a competent authority identifies for testing, not for every entity in scope of DORA. The EU Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025. Article 26 requires identified entities to run TLPT at least every three years on live production systems that support critical or important functions, and Article 27 sets the requirements for the testers who carry it out
TLPT does not replace ordinary testing. It sits on top of the baseline vulnerability assessments and penetration tests every entity owes under Articles 24 and 25, which our DORA compliance guide covers in full.
The detail lives in the technical standards. Commission Delegated Regulation (EU) 2025/1190, drafted by the European Supervisory Authorities with the ECB and in force since 8 July 2025, sets the scope, the testing method, the rules on testers and the phase deadlines, including the minimum 12-week active red team phase and the replay that follows.
The method itself is the ECB’s TIBER-EU framework, first published in 2018 and updated in 2025. DORA borrows its structure, so a compliant TLPT runs through TIBER-EU’s phases and roles.
In Sweden this runs through TIBER-SE, the national version of TIBER-EU coordinated by Sveriges Riksbank, while DORA itself is supervised by Finansinspektionen. The Riksbank frames the split neatly, the law says what to test and the framework says how.
Note the overlap with other regimes. Sweden’s NIS2 law, Cybersäkerhetslagen (SFS 2025:1506, in force 15 January 2026), also demands tested resilience, though it does not mandate TLPT. If both apply to you, treat TLPT as the deepest layer of one testing programme.
How to Know if TLPT Applies to You
Most organisations do not have to run a TLPT. The duty falls on financial entities that a competent authority formally designates, so the first question is whether you are a financial entity under DORA at all.
DORA’s definition is wide. It covers, among others, these kinds of firm.
- Banks and credit institutions
- Payment and electronic money institutions
- Investment firms and trading venues
- Insurers and reinsurers
- Central counterparties and central securities depositories
- Crypto-asset service providers
Being a financial entity is not enough on its own. Your authority decides who must test, using criteria in the technical standards that weigh size, risk profile and systemic importance. Microenterprises are excluded and some smaller entities fall outside the advanced tier, but you cannot exempt yourself. Designation is the authority’s call.
The criteria are concrete. For insurers, for example, the standards point to firms above set thresholds, such as gross written premium over 3 billion euro or technical provisions over 30 billion euro. Other sub-sectors have their own measures.
Outsourcing does not move the duty. If an ICT third party runs a function that is in scope, it can be pulled into your test, and your contracts need to allow that. Either way the financial entity stays responsible for the TLPT, even when others run the systems or take part.
Finally, scope is not fixed for good. An entity outside the advanced tier this cycle can be designated the next, as its size or risk changes. If you run or underpin a critical function in EU finance and you are of any real size, the safe assumption is that TLPT will reach you, so prepare as if it will.
How to Prepare for a TLPT
Preparation is where a TLPT is won or lost, and most of it can start before any authority gets in touch. Once you are notified the clock runs quickly, with the technical standards giving three months to submit the initial plan and six months for a detailed scope.
Work through these in order.
- Map your critical or important functions and the ICT systems behind them, so you already know what would be in scope.
- Fix the fundamentals first. Patch known flaws, segment your network, tighten privileged access and make sure logging and detection actually work. A test against weak basics only confirms they are weak.
- Run the baseline testing. Keep vulnerability assessments and annual penetration tests current so the TLPT is not the first time your defences are tried.
- Stand up a small white team and agree the governance, including who controls the test, how risk on live systems is managed and how to escalate if something goes wrong.
- Procure compliant providers early. You need an external threat intelligence provider and a red team that meet the Article 27 bar on certification, references, insurance and experienced staff, with the intelligence work kept separate from the red team.
- Budget for the long haul. Plan for at least a 12-week active phase, then closure and remediation, which together commonly run to several months.
- Treat the findings as the point. Build a prioritised remediation plan, re-test the key gaps and use the purple-teaming replay to train your blue team.
Done well, a TLPT is a rehearsal for the real thing, and the organisations that get value from it treat it that way from the start. If you need a red team, threat intelligence or the baseline penetration testing services that come first, start early and give the work the months it needs.
