DORA TLPT (TIBER-EU): how to choose a certified red team provider

The Digital Operational Resilience Act (DORA) marks a significant shift in cybersecurity obligations for financial entities across the EU. With the first wave of Threat-Led Penetration Testing (TLPT) set to begin in January 2026, financial institutions must prepare to meet these stringent requirements. However, the current red team capacity within the EU may struggle to meet the anticipated demand, making the selection of a certified provider a critical task.

Understanding TLPT vs. Classic Penetration Testing

While both TLPT and classic penetration testing aim to identify vulnerabilities, their methodologies and scopes differ significantly. Financial entities must understand these differences to ensure compliance with DORA's requirements.

Scope and Objectives

Classic penetration testing typically involves a broad assessment of an organization's IT infrastructure to identify vulnerabilities. In contrast, TLPT, as mandated by DORA, focuses on simulating real-world cyber-attacks that are tailored to the specific threat landscape of the financial entity. This requires a more targeted approach, where the scope is defined based on the entity's critical functions and assets.

Role of Threat Intelligence

A key component of TLPT is the integration of threat intelligence. This involves gathering and analyzing information about potential threats specific to the financial entity. The intelligence is used to design realistic attack scenarios that mimic the tactics, techniques, and procedures of actual threat actors. This intelligence-driven approach ensures that the testing is relevant and reflective of the current threat environment.

Attack Lifecycle Simulation

TLPT goes beyond mere vulnerability scanning by simulating the entire lifecycle of a cyber-attack. This includes initial reconnaissance, exploitation, lateral movement within the network, and finally, the exfiltration of data or disruption of services. By simulating the full attack lifecycle, financial entities can better understand their resilience against sophisticated cyber threats.

The TIBER-EU Framework

The TIBER-EU framework, developed by the European Central Bank, provides a structured approach to conducting TLPT. It outlines three distinct phases and specifies the roles and responsibilities of the white team within the financial entity.

Three Phases of TIBER-EU

1. 1Preparation Phase: This phase involves defining the scope of the test, selecting the red team provider, and gathering threat intelligence. The financial entity's white team plays a crucial role in this phase, ensuring that the test aligns with the entity's operational and security objectives.

1. 1Testing Phase: During this phase, the red team executes the attack scenarios developed in the preparation phase. The white team monitors the test to ensure that it remains within the agreed scope and does not disrupt business operations.

1. 1Closure Phase: After the testing, the red team and white team collaborate to analyze the results. This phase includes a comprehensive debriefing session where findings are discussed, and remediation strategies are developed.

White Team Obligations

The white team, composed of internal staff from the financial entity, is responsible for overseeing the TLPT process. Their duties include ensuring that the test is conducted safely, managing communications between stakeholders, and validating the findings. The white team must also ensure that the test complies with all regulatory requirements and internal policies.

Red Team Provider Selection Criteria

Choosing the right red team provider is crucial for the success of a TLPT engagement. Financial entities should evaluate potential providers based on the following seven criteria:

1. 1Certification and Accreditation: Ensure that the provider is certified under relevant frameworks, such as CREST or OSCP, and has experience with TIBER-EU engagements.

1. 1Experience and Expertise: Assess the provider's track record in conducting TLPT for financial entities. Look for providers with a deep understanding of the financial sector's unique threat landscape.

1. 1Threat Intelligence Capabilities: Evaluate the provider's ability to gather and analyze threat intelligence. This is critical for designing realistic attack scenarios.

1. 1Methodology and Approach: Review the provider's methodology for conducting TLPT. Ensure that it aligns with the TIBER-EU framework and incorporates a comprehensive attack lifecycle simulation.

1. 1Communication and Reporting: The provider should offer clear and concise reporting, with actionable insights and recommendations. Effective communication throughout the engagement is essential.

1. 1Compliance and Legal Considerations: Verify that the provider adheres to all relevant legal and regulatory requirements, including data protection and privacy laws.

1. 1Cost and Value: While cost is a factor, prioritize value over price. Consider the provider's ability to deliver a high-quality, impactful TLPT engagement that enhances your organization's resilience.

Next Step with NexCyber

Preparing for DORA's TLPT requirements can be daunting, but NexCyber is here to help. Our pre-TLPT readiness assessment is designed to evaluate your current cybersecurity posture and identify areas for improvement. By partnering with NexCyber, you can ensure that your organization is fully prepared for the upcoming TLPT obligations under DORA.

Visit [NexCyber](https://www.nexcyber.eu/assess?utm_source=editorial&utm_campaign=dora-tlpt-tiber-eu-choose-red-team) to learn more about our services and how we can support your journey towards compliance and operational resilience.