TLPT (Threat-Led Penetration Testing)

Threat-Led Penetration Testing (TLPT) represents the most rigorous form of resilience testing under DORA. Unlike traditional penetration testing that focuses on finding technical vulnerabilities, TLPT takes a holistic approach by simulating realistic attack scenarios based on current threat intelligence relevant to the specific financial entity.

DORA requires significant financial entities to conduct TLPT at least every three years. The tests must be performed by qualified external testers, cover critical or important functions, and be conducted on live production systems to ensure realistic results. The TLPT framework under DORA is closely aligned with the TIBER-EU framework.

The TLPT process involves three phases: a threat intelligence phase where realistic attack scenarios are developed based on the entity's threat landscape, a red team testing phase where qualified testers attempt to compromise critical functions using identified tactics, and a closure phase where results are analyzed, remediation plans are developed, and findings are reported to the competent authority.