Requirements3 min read
TLPT vs penetration testing: what changes under DORA?
Why a conventional penetration test does not automatically meet the requirements of a DORA threat-led exercise.
Read the perspective
THREAT-LED PENETRATION TESTING
DORA TLPT.
Test your
resilience.
Threat-led penetration testing for financial organisations with DORA obligations. We bring together targeted threat intelligence, controlled red teaming and remediation planning in one complete engagement.
Threat intelligenceControlled testingActionable evidence
FINANCIAL SECTOR RESILIENCEIntelligence. Execution. Evidence.
01 / THE ENGAGEMENTOne focus. From scope to remediation.
Test what matters.
Understand
what it means.
Your critical functions depend on people, processes and technology. A meaningful test examines them together.
Atlant Security offers one integrated DORA TLPT engagement: targeted threat intelligence, controlled red-team testing, closure and remediation planning.
We connect realistic adversary scenarios to the services your organisation needs to keep running, with governance and operational safeguards established from the start.
Inside the engagement
An integrated process.
Accountability at every stage.
01
Define the scope
Map critical functions, dependencies and boundaries. Establish governance and authority coordination.
02
Understand the threat
Use targeted intelligence to identify relevant adversaries and develop credible scenarios.
03
Test under control
Execute red-team activity with agreed safeguards, control-team oversight and clear escalation.
04
Learn from the evidence
Reconstruct the attack with defenders. Review detection, response and purple-team findings.
05
Turn findings into action
Prioritise remediation, assign ownership and prepare the evidence for the closure process.
03 / UNDERSTAND THE REQUIREMENTSThe regulatory framework
DORA applies broadly.
TLPT is targeted.
Not every organisation subject to DORA is required to conduct TLPT.
Competent authorities identify the financial entities that must perform advanced testing. Confirm your designation and the applicable authority process before defining the engagement.
Understand who needs TLPT26 & 27
The legal foundation
DORA articles covering advanced testing and the requirements for testers.
3 years
The baseline frequency
At least once every three years for identified entities, subject to authority adjustment.
12 weeks
The active testing minimum
The minimum active red-team phase under RTS Article 11(5), with other phases adding time.
PRIMARY SOURCES DORA Articles 26–27 TLPT RTS (EU) 2025/1190
THE VALUE OF THE ENGAGEMENT
Evidence for decisions.
Direction for action.
The outcome should be useful to your security teams, decision-makers and the authority overseeing the engagement.
Explore the deliverables01
A traceable attack narrative
Connect scenarios, actions and evidence to observed control outcomes.
02
A shared view of resilience
Bring attack and defence observations together through replay and purple-team learning.
03
A prioritised remediation plan
Set clear actions, accountable owners and a basis for follow-through.
04 / INSIGHTS & PERSPECTIVES
Clarity before you begin.
Planning3 min read
How to scope a DORA TLPT around critical functions
Start with the function, trace the dependencies and make the boundary of the test explicit.
Read the perspective
Planning3 min read
How long does a DORA TLPT take?
Understand the 12-week active-testing minimum and the preparation and closure work that sit around it.
Read the perspectiveA PRACTICAL STARTING POINT
How ready is your organisation?
Bring scope, governance and procurement into one working checklist.
LET’S START A CONVERSATION
Define the scope.
Take the next step.
Your critical functions. Your authority’s requirements. A clear starting point for your TLPT engagement.
Discuss your TLPT