Threat-led penetration testing
TLPTAlso called red team testing, intelligence-led testing
Threat-led penetration testing is an advanced security test in which an external or internal red team mimics the tactics of real threat actors against a financial firm's live production systems. It covers the critical or important functions an attacker would target and is based on current threat intelligence about the firm.
How it works
A test starts with scoping, where the firm and its supervisor agree which critical functions are in scope. A threat intelligence provider then builds scenarios specific to the firm. The red team attacks live systems while only a small control team knows the test is under way. Afterwards the firm and testers replay events with the defending blue team and agree a remediation plan.
Under DORA, supervisors designate which entities must run TLPT, typically at least every three years. The test shows whether defences, detection and response work against realistic attacks, not just scanned vulnerabilities. Results go to the authority, which issues an attestation. Third-party ICT providers supporting in-scope functions may need to take part, and pooled testing is possible.
The rules
Requires identified financial entities to carry out threat-led penetration testing on live production systems, generally at least every three years.
Financial entities identified by competent authoritiesSets criteria for identifying entities required to test, and requirements for scope, methodology, internal testers, results, remediation and mutual recognition.
Financial entities required to perform TLPT and their testersCommon questions
How is TLPT different from a standard penetration test?
A standard penetration test looks for vulnerabilities in a defined system, often with defenders aware. TLPT simulates a specific real-world attacker against live production systems supporting critical functions, with most staff unaware, and tests detection and response as well as prevention.
Which firms must carry out TLPT under DORA?
Competent authorities identify the entities. The RTS set criteria based on factors such as systemic importance, size and ICT risk profile. Credit institutions, payment institutions and other entities above set thresholds are among those that can be designated.
How does TLPT relate to TIBER-EU?
TIBER-EU is the European framework for intelligence-led red teaming that predates DORA. The DORA technical standards on TLPT are aligned with it, and the framework has been updated so that tests run under it can meet DORA requirements.
