Threat-led penetration testing under the EU’s Digital Operational Resilience Act.
Regulator-aligned attack simulations that provide a realistic view of your firm’s cyber resilience when required by DORA.
Our DORA threat-led penetration testing helps you meet your national competent authority’s requirements and tests your resilience against real threats facing the EU’s financial services industry.
Our DORA TLPT engagements are harmonised with the TIBER-EU framework. We have delivered dozens of TIBER engagements across multiple EU jurisdictions. Our certified consultants and established National Competent Authority (NCA) relationships mean you can be confident in both compliance and delivery quality.
Our TIBER portfolio includes Big Four banks, major insurers, European stock exchanges and EBA Clearing. We have also delivered multi-jurisdictional engagements spanning TIBER-NL, TIBER-DE and TIBER-BE simultaneously.
DORA’s Article 27 requires TLPT testing vendors to provide independent assurance over the sound management of TLPT risks, including the protection of your confidential information. SECFORCE has been independently audited as part of our SOC 2 certification to fulfil this requirement.
Our exercises emulate the tactics and techniques used by the threat actors targeting the EU financial sector today. Supported by dedicated R&D and proprietary tooling, every one of our engagements is carefully planned and monitored through detailed test plans and contingency procedures.
Our Red Team combines experienced offensive security researchers and consultants recruited from top competitive hacking platforms, backed by an internal training programme and a dedicated research and development team.
Alongside detailed executive and technical reporting, we can provide remediation guidance, retesting support, and ongoing collaboration before, during, and after the exercise to ensure findings lead to real security improvements.
The Digital Operational Resilience Act (DORA) is an EU regulation that came into force in January 2025, establishing a comprehensive framework for ICT risk management and operational resilience across the EU financial sector.
DORA applies broadly across the EU financial sector, including banks, insurance undertakings, investment firms, payment institutions, crypto-asset service providers and critical ICT third-party providers.
One of DORA’s key requirements is that certain financial entities undergo Threat-Led Penetration Testing (TLPT), a realistic, intelligence-led red team exercise overseen by regulators.
TLPT requirements apply to entities identified by their NCA as significant based on systemic importance, scale, and risk profile.
DORA TLPT is harmonised with the TIBER-EU framework. A TIBER-EU engagement conducted to the required standard will satisfy the DORA TLPT obligation. The framework is overseen by the relevant national competent authority (NCA) in each EU member state.
Designated entities must conduct TLPT at least every three years, though the authority can adjust that frequency based on the entity’s risk profile.
| DORA TLPT Requirement | SECFORCE |
|---|---|
| Highly reputable, with demonstrable expertise in threat intelligence and red team testing (including 5 references from prior assignments) |  |
| Red team manager with 5+ years of penetration testing and red team testing experience | |
| 2+ additional testers with 2+ years of penetration testing and red team testing experience | |
| Expertise in financial services, reconnaissance, risk management, exploit development, physical penetration, social engineering, vulnerability analysis, and clear reporting | |
| Independent of organisations performing defensive (blue team) services for entities involved in the TLPT | |
| Separation between red team and threat intelligence personnel involved in the same TLPT | |
| Professional indemnity insurance covering misconduct and negligence | |
| Certifications appropriate to recognised market standards | |
| Certified or bound by professional ethical codes | |
| Independent assurance on risk management and confidentiality | SOC 2 audited |
The TLPT authority initiates the test, the entity defines the scope, appoints its Control Team, and selects its TI provider and testers, with the authority validating each step. The management body approves the scope.
The TI provider develops realistic attack scenarios based on the entity’s threat landscape, which the testers, such as SECFORCE, run against live production systems supporting the entity’s critical systems. Active red team testing must last at least 12 weeks, with the entity’s Blue Team unaware of it throughout.
The Blue Team is informed of the exercise, reports are produced, key scenarios are replayed during purple teaming, and a remediation plan is developed before the TLPT authority issues its attestation.
If your operations extend beyond the EU or financial services, you’re likely to encounter other regulatory testing frameworks.
We’ve delivered dozens of engagements under major TLPT frameworks. These include CBEST and TBEST in the UK, iCAST in Hong Kong, and CORIE in Australia.
We’ve also led some of the world’s earliest multi-jurisdictional engagements, meeting the requirements of multiple frameworks and regulators simultaneously.
Thank you!
Please try again later.
