DORA Certifications Bundle
399 € excl. VAT
Digital Operational Resilience Testing under DORA
Complete guide to the TIBER-EU framework
Threat-Led Penetration Testing (TLPT) is an advanced cybersecurity test that simulates real attacks conducted by sophisticated malicious actors (APT - Advanced Persistent Threats).
Objective: Assess the financial entity's ability to detect, respond to and recover from a targeted and sophisticated cyberattack.
| Aspect | Traditional Pentest | TLPT / TIBER-EU |
|---|---|---|
| Objective | Find technical vulnerabilities | Test resilience against targeted real-world attacks |
| Approach | Standardized test checklist | Scenarios based on real threat intelligence |
| Scope | Technical (IT/network/apps) | Holistic (IT + personnel + physical + processes) |
| Duration | 1-4 weeks | 6-12 months (preparation + test + analysis) |
| Teams | Pentesters | Red Team (attackers) + Blue Team (defenders) + White Team (arbiters) |
| Intelligence | General vulnerability knowledge | Threat Intelligence specific to financial sector |
| Detection | Declared tests, Blue Team informed | Blue Team not informed, "blind" test |
| Cost | €10k - €50k | €100k - €500k+ |
⚠ TLPT IS NOT MANDATORY FOR ALL ENTITIES
Only entities identified as "significant" by their supervisor are subject to the mandatory TLPT every 3 years.
| Criterion | Indicative Threshold | Sector |
|---|---|---|
| Size | Total assets > €30 billion | Banks |
| Interconnection | Market infrastructures (CCP, CSD, etc.) | All |
| Systemic Importance | G-SIBs, O-SIIs | Banks |
| Cross-border Activity | Operations in ≥ 5 Member States | All |
| Activity Volume |
• Banks: >500k retail clients • Insurance: >1M policyholders • PSP: >10M transactions/year |
Variable |
For others: TLPT remains highly recommended as best practice, but not legally mandatory.
Threat Intelligence-Based Ethical Red-Teaming
European Central Bank Framework
TIBER-EU is the framework developed by the ECB that defines the standardized methodology for conducting TLPT tests in the European financial sector.
Advantages of TIBER-EU:
Responsible: Financial entity + Supervisory authority
Actions:
Responsible: Financial entity
Actions:
Indicative costs:
Responsible: White Team + External Providers
Actions:
Responsible: Threat Intelligence Provider
Actions:
Example Threat Intelligence Scenario:
Scenario: APT group "FIN7" (sophisticated cybercriminal)
Objective: Customer data theft and fraudulent transfers
Initial vector: Spear-phishing targeting finance employees
Tools: Custom malware + RDP exploitation
TTPs: Lateral movement via Active Directory, privilege escalation, exfiltration via encrypted channels
Responsible: Red Team
Actions:
Responsible: Red Team (attack) vs. Blue Team (defense)
⚠ CRITICAL PHASE - "Blind" test
Red Team Actions:
Blue Team Role (SOC/CERT):
The Blue Team does NOT know a test is ongoing! They must react as to a real incident.
White Team Role (Arbiters):
Responsible: White Team + Red Team + Blue Team
Actions:
Responsible: White Team + External Providers
Actions:
| Aspect Evaluated | Good (✓) | Medium (⚠) | Weak (✗) |
|---|---|---|---|
| Detection time | < 24 hours | 24h - 7 days | > 7 days |
| Detection rate | > 80% of actions | 50-80% | < 50% |
| Response time | < 4 hours | 4h - 24h | > 24 hours |
| Containment effectiveness | Attack stopped before critical systems | Attack slowed but not stopped | Full access achieved |
| Crisis communication | Management informed quickly, DORA process activated | Delays in escalation | Failed communication |
| Recovery | Critical services restored in <RTO | Recovery >RTO | Unable to recover |
TLPT does NOT only test technology, but:
⏰ DORA Obligation: TLPT minimum every 3 years
First deadline for significant entities: Before January 17, 2028 (3 years after DORA entry into force)
| Phase | Duration | Cumulative Timeline |
|---|---|---|
| 1. Preparation | 2-4 weeks | Month 1 |
| 2. Provider selection | 6-8 weeks | Months 1-3 |
| 3. Scoping | 4-6 weeks | Months 3-4 |
| 4. Threat Intelligence | 6-8 weeks | Months 4-6 |
| 5. Red Team Preparation | 4-6 weeks | Months 6-7 |
| 6. Red Team Test | 8-12 weeks | Months 7-10 |
| 7. Closure | 2-4 weeks | Months 10-11 |
| 8. Reporting | 4-8 weeks | Months 11-12 |
| TOTAL | 9-14 months | ~1 year |
Recommendation: Start planning at least 18 months before the deadline to have a margin in case of delays or need to redo phases.
| Expense Item | Low Range | High Range | Notes |
|---|---|---|---|
| Threat Intelligence Provider | €30,000 | €80,000 | TI Report + scoping assistance |
| Red Team Provider | €80,000 | €300,000 | Varies by scope and test duration |
| Internal White Team | €20,000 | €100,000 | Staff time (PM, security, legal) |
| External consultants (optional) | €0 | €50,000 | White Team support |
| Temporary infrastructure | €10,000 | €30,000 | Test environments, additional monitoring |
| Post-test remediation | €50,000 | €500,000+ | Identified fixes (highly variable) |
| TOTAL (excluding remediation) | €140,000 | €560,000 |
Cost influencing factors:
→ The test loses all its value if defenders know they are being tested. Only the White Team (3-5 people max) should be aware.
→ Excluding systems out of fear creates blind spots. A real attacker will exclude nothing.
→ Letting the Red Team go all the way (within RoE limits) reveals the true level of resilience.
→ Identifying flaws is useless if no budget/timeline for correction is planned.
→ TLPT is an immense learning opportunity. Organizations that benefit most are those that integrate it into a continuous improvement approach.
Our experts can guide your institution through DORA compliance, from gap analysis to full implementation.
Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.
Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.