A single cyber breach can cost financial institutions an average of $5.97 million and permanently damage stakeholder trust, traditional security measures are no longer sufficient. Financial entities across Europe now face a critical question. How can we truly verify that our cyber defenses will hold against sophisticated, real-world attacks? The answer lies in advanced security testing methodologies, particularly Threat-Led Penetration Testing (TLPT).
With the Digital Operational Resilience Act (DORA) taking effect in January 2025, financial organizations must now demonstrate operational resilience through rigorous, intelligence-driven security assessments. This comprehensive guide explores both traditional penetration testing and the advanced TLPT framework, providing financial institutions with the knowledge needed to meet regulatory requirements and protect critical systems against evolving cyber threats.
What Is Penetration Testing and Why Does It Matter for Financial Institutions?
Penetration testing is a controlled, simulated cyberattack on an organization’s systems, networks, and applications designed to identify security vulnerabilities before malicious actors can exploit them. Unlike basic vulnerability scans that simply identify weaknesses, penetration testing actively attempts to exploit those weaknesses to demonstrate real-world risk and business impact.
For financial institutions, penetration testing serves as a critical component of cyber risk management. It provides evidence-based insights into security posture, validates the effectiveness of existing controls, and demonstrates regulatory compliance. Regular penetration testing shows where vulnerabilities exist and how attackers could exploit them to exfiltrate data, escalate privileges, or compromise systems.
The Evolution from Traditional Testing to Threat-Led Approaches
Traditional Pentesting builds preventative hygiene by finding bugs before they are exploited. Threat-Led Penetration Testing builds detective and responsive resilience by practicing against a realistic enemy.
To ensure comprehensive security assurance, organizations rely on both traditional penetration testing and TLPT. Traditional engagements ensure robust system hardening by identifying exploitable vulnerabilities, while TLPT validates the effectiveness of those defenses by challenging people, processes, and technology with targeted, intelligence-driven scenarios.
This reality has driven the evolution toward threat-led methodologies that prioritize intelligence-driven testing based on actual threat actor behaviors. Rather than testing everything equally, threat-led approaches focus security resources. It focuses on the most critical assets and the most probable attack scenarios facing the organization.
What Are the Core Types of Penetration Testing?
Financial institutions typically employ five primary types of penetration testing. Each designed to assess different aspects of the security infrastructure: external network testing, internal network testing, web application testing, wireless network testing, and social engineering assessments. The appropriate combination depends on the organization’s risk profile, regulatory requirements, and threat landscape.
- External Network Penetration Testing
External testing simulates attacks from outside the organization’s perimeter. Thus, targeting internet-facing assets like web servers, email systems, VPN gateways, and remote access solutions. Testers attempt to identify and exploit vulnerabilities that could provide initial access to internal networks, mimicking how most real-world attacks begin.
- Internal Network Penetration Testing
Internal testing assumes an attacker has already gained initial access. This is done either through compromised credentials, physical access, or successful external exploitation. Testers operate from within the network perimeter to assess how far an attacker could move laterally, what critical systems they could access, and what sensitive data they could exfiltrate.
- Web Application Penetration Testing
With financial services increasingly delivered through web and mobile applications, application security testing has become critical. This testing identifies vulnerabilities in business logic, authentication mechanisms, session management, data validation, and API security that could lead to unauthorized access or data breaches.
-
- Wireless and Social Engineering Testing
</li>
Wireless testing assesses the security of Wi-Fi networks and Bluetooth implementations. While social engineering tests evaluate the human element through simulated phishing campaigns, pretexting, or physical security breaches. Both represent real-world attack vectors frequently exploited by threat actors.
What Methodologies Guide Professional Penetration Testing?
Professional penetration testing relies on established frameworks and methodologies that ensure comprehensive, repeatable, and consistent security assessments. The most widely recognized frameworks include PTES, OWASP, NIST SP 800-115, OSSTMM, and MITRE ATT&CK, each offering distinct approaches suited to different testing objectives.
- Penetration Testing Execution Standard (PTES)
The PTES framework provides a standardized approach covering seven distinct phases. These are: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. PTES emphasizes clear communication between testers and clients, ensuring all parties understand scope, rules of engagement, and expected outcomes. This methodology is particularly valuable for organizations requiring consistent, repeatable testing processes that support compliance requirements like PCI DSS or ISO 27001.
- <strong>OWASP Testing Guide
The Open Web Application Security Project (OWASP) framework focuses specifically on web application security. It provides comprehensive guidance for testing modern web technologies including single-page applications, RESTful APIs, and GraphQL implementations. The OWASP Top 10 serves as the industry standard for web application vulnerabilities, making this framework essential for financial institutions with significant digital service delivery platforms.
- NIST Special Publication 800-115
The National Institute of Standards and Technology developed NIST SP 800-115. It provides a comprehensive methodology for planning, executing, and documenting penetration tests on information systems and networks. This framework is especially relevant for organizations in regulated industries or government sectors. It offers detailed guidance on testing information systems while maintaining operational security and compliance.
- Open Source Security Testing Methodology Manual (OSSTMM)
OSSTMM takes a scientific approach to security testing, focusing on measurable results across five security channels: human, physical, wireless, telecommunications, and data networks. Unlike vulnerability-centered methods, OSSTMM evaluates how effectively security controls protect assets under real-world conditions, providing quantifiable metrics for security posture assessment.
- MITRE ATT&CK Framework
The MITRE ATT&CK framework serves as a comprehensive knowledge base of adversary tactics and techniques based on real-world observations. Rather than prescribing testing steps, ATT&CK provides a matrix of attack behaviors that testers can reference throughout assessment phases, ensuring comprehensive coverage of realistic attack scenarios. This framework has become increasingly important for threat-led testing approaches.
What Is Threat-Led Penetration Testing (TLPT) Under DORA?
Threat-Led Penetration Testing (TLPT) is an advanced form of security testing that simulates sophisticated, real-world cyber attacks using intelligence about actual threat actors likely to target the organization.
While traditional penetration testing provides critical, deep-dive vulnerability discovery within specific systems and the possible exploitation of these vulnerabilities, TLPT complements this foundation by testing the organization’s broader resilience. TLPT expands the scope to include technology, processes, and people, validating defenses against targeted, intelligence-driven attack scenarios
Under the Digital Operational Resilience Act (DORA), TLPT follows the TIBER-EU framework developed by the European Central Bank. DORA mandates that certain financial entities identified based on their systemic importance and ICT risk profile, conduct TLPT exercises at least every three years. These tests must cover critical and important functions, including services provided by third-party ICT providers.
How TLPT Differs from Traditional Penetration Testing?
The fundamental difference lies in scope, approach, and objectives. Traditional penetration testing typically examines specific systems or applications within defined timeframes, using generic attack methods to identify as many vulnerabilities as possible. TLPT, conversely, treats the entire organization as the scope, employs threat intelligence to replicate specific adversary behaviors, and operates in secrecy over extended periods to test detection and response capabilities.
TLPT engagements often involve multiple attack vectors simultaneously, including technical exploits, social engineering, physical intrusion attempts, and supply chain compromises, mirroring how sophisticated threat groups actually operate. The testing team remains hidden from security operations, creating realistic conditions to evaluate whether security monitoring, incident detection, and response procedures function effectively under pressure.
What Are the Key Phases of a TLPT Engagement?
A TLPT engagement follows a structured process comprising preparation, threat intelligence gathering, red team testing (the attack simulation), and a purple team closure phase where attackers and defenders collaborate to review findings. Each phase serves distinct purposes in building organizational resilience against targeted cyber threats.
- Preparation and Scoping Phase
The preparation phase establishes the foundation for successful TLPT execution. During this stage, the financial entity identifies critical and important functions to be tested, selects qualified threat intelligence and red team providers, and establishes a control team (formerly called white team) to oversee the exercise. The scope must be approved by competent supervisory authorities and must include any third-party ICT service providers supporting critical functions.
Key activities include defining success criteria, establishing communication protocols, creating escalation procedures for critical findings, and ensuring all stakeholders understand their roles. The financial entity must also verify that providers meet DORA’s qualification requirements, including demonstrated experience in threat intelligence analysis and red teaming operations.
- Threat Intelligence Phase
Before any simulated attacks begin, external threat intelligence providers conduct comprehensive research to identify threat actors most likely to target the financial entity, along with their specific tactics, techniques, and procedures. This intelligence-gathering phase examines factors like the organization’s geographic presence, service offerings, customer base, and strategic importance to determine which threat groups pose the highest risk.
The threat intelligence report becomes the blueprint for red team operations, ensuring tests replicate genuine threats rather than generic attack scenarios. Intelligence providers must remain external
</p>
to ensure objectivity and prevent conflicts of interest, though DORA permits the same provider to deliver both threat intelligence and red teaming services under certain circums
tances.
- &amp;amp;amp;amp;amp;lt;strong>Red Team Testing Phase
During the red team phase, specialized security professionals attempt to achieve predefined objectives using the tactics and techniques identified during threat intelligence gathering. Unlike traditional pentests announced to security teams, TLPT operates covertly the organization’s blue team (security operations) remains unaware testing is underway. This secrecy is essential for evaluating detection and response capabilities under realistic conditions.
Red team operations typically span several weeks or months, allowing testers to move methodically through the attack lifecycle: initial access, privilege escalation, lateral movement, persistence establishment, and objective completion. Throughout testing, the control team monitors activities to ensure operations remain within scope and do not cause unacceptable business disruption.
- Purple Team Closure Phase
DORA introduces a mandatory purple teaming requirement during the closure phase, representing a significant evolution from earlier TIBER-EU guidance. Purple teaming brings together the red team (attackers) and blue team (defenders) to collaboratively review the engagement, examining each successful compromise, why existing controls failed to detect or prevent the activity, and what improvements would increase resilience.
This collaborative replay workshop ensures maximum learning from the TLPT exercise. Rather than simply receiving a report of findings, security teams gain deep understanding of attack methodologies, blind spots in monitoring coverage, and gaps in incident response procedures. The purple team phase transforms TLPT from an assessment into a capability-building exercise.
Which Financial Institutions Must Conduct TLPT Under DORA?
Not all DORA-regulated entities are required to perform TLPT – national competent authorities and the European Central Bank identify specific institutions based on systemic importance, ICT risk profile, and potential financial stability impact. Identified entities typically include global systemically important institutions (G-SIIs), other systemically important institutions (O-SIIs), significant payment institutions, central securities depositories, and other entities whose failure could have systemic consequences.
The regulatory technical standards published in July 2024 establish clear criteria for identification. Financial entities are assessed based on impact-related factors (particularly the extent to which their services and activities affect the financial sector) and possible financial stability concerns, including their systemic character. Additional entities may be “opted in” if they meet specific impact criteria, while others initially identified may be “opted out” following detailed assessment demonstrating TLPT is not justified for their risk profile.
Organizations not required to conduct TLPT still face significant security testing obligations under DORA, including regular vulnerability assessments, penetration testing, scenario-based testing, and open-source analysis. These resilience tests must be proportionate to operational needs and must occur at least annually for ICT systems supporting critical or important functions.
What Are the Requirements for TLPT Providers Under DORA?
DORA establishes stringent qualification requirements for organizations providing threat intelligence and red team services, ensuring TLPT exercises deliver meaningful security insights. Both external and internal testers may conduct red team operations, though threat intelligence must always be sourced externally. As an additional safeguard, every third TLPT cycle must utilize external red team providers.
Red team providers must demonstrate substantial experience in offensive security operations, with team members possessing relevant certifications from recognized professional bodies. The technical requirements specify experience in penetration testing and red teaming gained over multiple years, along with proven capability to replicate advanced persistent threat (APT) behaviors. Providers must also demonstrate understanding of financial sector systems and regulatory environments.
Threat intelligence providers must show expertise in cyber threat analysis, familiarity with threat actor groups and their methodologies, and ability to produce actionable intelligence tailored to specific organizations. They must maintain independence from the entities they assess and follow ethical standards protecting sensitive information gathered during intelligence operations.
In exceptional circumstances, financial entities may engage providers not meeting all requirements, provided they document the exceptional circumstances, adopt appropriate risk mitigation measures, and obtain TLPT authority approval. This flexibility recognizes that highly specialized expertise may sometimes be concentrated in providers not meeting every formal criterion.
How Should Financial Institutions Prepare for TLPT?
Successful TLPT requires months of preparation, beginning with comprehensive asset inventory, system documentation, and identification of critical and important functions. Organizations should initiate preparation well before their testing cycle to ensure readiness and maximize value from the exercise.
- Building Internal Capabilities
Financial institutions should invest in developing internal security capabilities that will be tested during TLPT. This includes ensuring security operations centers have adequate monitoring coverage, incident response teams have practiced procedures and playbooks, and communication protocols exist for escalating serious incidents. Organizations with mature security programs will derive more value from TLPT by testing advanced capabilities rather than discovering basic control gaps.
- Engaging Third-Party Providers
Organizations utilizing third-party ICT service providers for critical functions must ensure contractual arrangements permit TLPT participation. DORA requires financial entities to “take the necessary measures to ensure the participation” of service providers included in testing scope. This may require contract amendments negotiated well in advance, particularly for large cloud providers or shared service platforms supporting multiple financial institutions.
- Coordinating with Authorities
TLPT exercises require close coordination with national competent authorities and, where applicable, the European Central Bank. Financial entities must obtain approval for their testing scope, provide regular updates during execution, and share final reports with supervisors. Organizations should establish relationships with their TLPT authority early, understanding expectations and approval timelines to avoid delays.
What Happens After TLPT: Remediation and Continuous Improvement
The value of TLPT lies not in the test itself but in the remediation activities and capability improvements that follow. Organizations must develop comprehensive remediation plans addressing identified vulnerabilities, control gaps, and process weaknesses within defined timeframes agreed with supervisory authorities.
Remediation planning should prioritize findings based on actual business risk demonstrated during testing rather than treating all findings equally. The purple team phase provides crucial context for prioritization, revealing which vulnerabilities enabled the most significant compromise and which controls, if strengthened, would most effectively disrupt attack chains.
Beyond technical remediation, organizations should update policies, procedures, and training programs based on TLPT lessons. If social engineering proved effective, security aw
areness training requires enhancement. If monitoring failed to detect lateral movement, detection rules and alert thresholds need refinement. TLPT provides a unique opportunity to validate and improve the entire cybersecurity program holistically.
How Do TLPT Requirements Support DORA’s Broader Objectives?
TLPT serves as a critical mechanism for verifying that financial institutions have built genuine operational resilience, not merely compliance on paper. By subjecting entities to realistic attack scenarios, supervisors and institutions themselves gain confidence that security investments translate into effective defense capabilities.
DORA’s emphasis on TLPT reflects recognition that traditional audit and compliance approaches often fail to evaluate whether security measures function effectively under stress. An organization may implement all required controls yet still prove vulnerable to determined adversaries if those controls aren’t properly configured, monitored, or integrated into operational procedures.
TLPT also supports DORA’s focus on third-party risk management. By including critical ICT service providers in testing scope, financial institutions validate that their entire ecosystem—not just systems under direct control—can withstand sophisticated attacks. This ecosystem perspective is essential in modern financial services where cloud platforms, payment processors, and specialized software providers form integral components of service delivery infrastructure.
What Are the Costs and Resource Implications of TLPT?
TLPT represents a significant investment, with exercises typically costing between €150,000 and €500,000 depending on organizational size, scope complexity, and provider rates. Beyond direct testing costs, organizations must account for internal resource allocation, potential system downtime, and remediation expenses following the engagement.
The three-year testing cycle specified by DORA provides organizations time to budget appropriately and prepare thoroughly between cycles. However, institutions should view TLPT not as a compliance checkbox but as an investment in resilience that delivers lasting value through improved security capabilities and reduced breach risk.
Organizations can optimize TLPT value by ensuring readiness before testing begins, selecting experienced providers who deliver actionable insights rather than merely finding vulnerabilities, and committing to comprehensive remediation following testing. The cost of effective TLPT pales in comparison to the average €5.97 million cost of a financial sector data breach, not including regulatory fines and reputational damage.
Frequently Asked Questions About Penetration Testing and TLPT
How does TLPT differ from standard red team exercises?
TLPT represents a formalized, regulated approach to red teaming specifically designed for financial institutions. While both simulate adversary behaviors, TLPT requires mandatory threat intelligence phases, supervisory oversight, purple team closure sessions, and compliance with specific regulatory technical standards under DORA. Standard red team engagements offer more flexibility but lack the regulatory recognition and standardized framework that TLPT provides.
Can internal teams conduct TLPT, or must organizations hire external providers?
DORA permits the use of internal red teams for TLPT exercises, provided they meet the same qualification requirements as external providers and maintain independence from the systems being tested. However, threat intelligence must always be sourced externally, and every third TLPT cycle must employ external red team providers as an additional safeguard. Most organizations opt for external providers given the specialized expertise required.
What happens if critical vulnerabilities are discovered during TLPT?
The control team monitoring TLPT exercises has authority to pause or terminate testing if critical vulnerabilities posing immediate business risk are discovered. Upon discovery, the organization must implement emergency remediation measures in consultation with supervisory authorities. All TLPT findings, including critical vulnerabilities, must be addressed through documented remediation plans with defined timelines.
How does TLPT integrate with existing security testing programs?
TLPT complements rather than replaces traditional security testing. Organizations should maintain regular vulnerability assessments, application penetration testing, and infrastructure security testing between TLPT cycles. These ongoing activities help ensure continuous improvement and verify that remediation efforts from previous TLPT exercises remain effective. TLPT provides the comprehensive, intelligence-driven assessment while routine testing maintains baseline security hygiene.
What role do third-party ICT providers play in TLPT?
Third-party providers supporting critical or important functions must participate in TLPT exercises when their services fall within testing scope. Financial entities bear responsibility for ensuring provider participation through contractual arrangements and coordination. DORA offers “pooled testing” options where multiple financial entities can test a shared service provider jointly, reducing duplication while ensuring comprehensive assessment of critical dependencies.
Taking Action: Building TLPT-Ready Organizations
Financial institutions across Europe must now view advanced security testing not as a burden but as an opportunity to genuinely strengthen resilience against increasingly sophisticated cyber threats. Organizations beginning their TLPT journey should focus on three foundational elements: building strong internal security capabilities that can be meaningfully tested, establishing relationships with qualified testing providers and supervisory authorities, and committing to comprehensive remediation and continuous improvement following assessments.
The transition to TLPT represents a maturation of financial sector cybersecurity, moving from checkbox compliance toward demonstrated operational resilience. Organizations embracing this evolution will not only meet regulatory requirements but build security programs capable of defending against the advanced persistent threats that increasingly target financial services.
As European financial institutions navigate DORA implementation and prepare for their first TLPT cycles, partnering with experienced security experts familiar with regulatory requirements and threat intelligence-driven testing becomes essential. Organizations seeking guidance on TLPT readiness, provider selection, or DORA compliance should consider consulting with specialists who understand both the technical and regulatory dimensions of this critical security discipline.
Partner with TLPT Experts: Kyte Global
At Kyte Global, we specialize in helping financial institutions across Europe and Malta navigate complex cybersecurity regulatory requirements including DORA compliance and TLPT readiness. Our team of certified security professionals brings deep expertise in penetration testing methodologies, threat intelligence analysis, and financial services security.
Whether you’re preparing for your first TLPT cycle, seeking to strengthen security controls before testing, or requiring ongoing penetration testing to maintain baseline security between TLPT exercises, our consultants provide the strategic guidance and technical expertise your organization needs.
Contact us today to discuss your penetration testing and TLPT requirements. Let us help you build genuine operational resilience that protects your organization, satisfies regulatory requirements, and defends against the evolving threat landscape facing financial services today.