Europe’s benchmark for intelligence-led financial resilience testing.
Expert TIBER-EU red team testing for meeting regulator requests and testing resilience.
Our TIBER-EU threat-led penetration testing helps you meet your national competent authority’s requirements and tests your resilience against threats facing critical infrastructure sectors.
SECFORCE has delivered dozens of TIBER-EU engagements since the framework was introduced in 2018. Our TIBER-EU client list includes Big Four banks, major insurers, European stock exchanges and universal banking groups worldwide.
Our experience spans TIBER-NL, TIBER-DE and TIBER-BE, including several of the first multi-jurisdictional TIBER engagements ever conducted.
We maintain strong relationships with NCAs across EU member states and work with trusted Threat Intelligence (TI) partners, but remain fully open to working with any TI provider selected by you or your national competent authority. Our Red Team is involved throughout the TI phase, which comes before the testing phase, to ensure a smooth handover into testing and a realistic, risk-managed simulation.
SECFORCE holds ISO 27001 and SOC 2 certifications, which govern how we handle data and manage risk during the engagement, so testing does not disrupt your operations. Every engagement runs to a detailed test plan, with milestones, flags, contingencies, and communication protocols agreed before testing starts.
Our Red Team combines experienced offensive security researchers and consultants recruited from top competitive hacking platforms, backed by an internal training programme and a dedicated research and development team.
Alongside full executive and technical reporting, we can also provide remediation guidance, retesting, and ongoing collaboration before, during and after the engagement.
TIBER-EU (Threat Intelligence-Based Ethical Red Teaming) is the European Central Bank’s framework for intelligence-led, regulator-supervised red team testing of financial entities across the EU. This includes systemically important banks, financial market infrastructures and other critical financial entities.
First published by the ECB in 2018, the framework has been adopted by national competent authorities through national implementations (such as TIBER-NL, TIBER-DE, TIBER-BE, TIBER-DK, TIBER-FI and TIBER-IE), each operating under its own NCA oversight. TIBER-EU now also forms the basis of DORA TLPT requirements.
| TIBER-EU TLPT Requirement | SECFORCE |
|---|---|
A Red Team of at least three people: A Red Team Test Manager (5+ years of penetration testing and red team testing experience) Two or more testers (each with at least 2+ years of penetration testing and red team testing experience) |
|
| References, recognised certifications, professional indemnity insurance and replacement capacity |
|
| Deep technical capability across the entity’s environment, and a working understanding of its business, processes and the threats it faces |
|
| Broad qualifications across exploit and malware development, OSINT, Active |
|
| Directory exploitation, physical security, defence evasion and social engineering |
|
| National competent authority recognition or approval, where the jurisdiction requires it |
|
| CREST accreditation, where the jurisdiction requires it |
|
| Independent assurance on risk management and confidentiality | SOC 2 audited
|
The engagement is officially initiated, the teams are established, the scope is confirmed, and the TI and RT providers are procured.
The TI provider produces a Targeted Threat Intelligence report on the entity, and the Red Team, such as SECFORCE, uses it to run live scenarios against production systems.
The Blue Team is told the exercise took place, reports are produced, key scenarios are replayed in a purple team session, a remediation plan is agreed with the national competent authority, and key findings are shared with relevant authorities.
If your organisation operates outside the EU, or outside financial services, you may need to meet other regulated testing frameworks. DORA’s own TLPT requirement is built on TIBER-EU, and we also work under CBEST and TBEST in the UK, iCAST in Hong Kong, and CORIE in Australia.
We have led some of the earliest engagements anywhere built to meet more than one framework and more than one regulator at the same time.
Thank you!
Please try again later.
