Threat-led penetration testing (TLPT)
Threat-led penetration testing under DORA tests live production against real threat intelligence, with firm, testers and authorities in defined roles. This pillar explains what makes it different.
Line 08: Threat-led penetration testing
Threat-led penetration testing under DORA: what it is, who it applies to, how a test is scoped, and what happens to its findings.
The line guide
Working guides on this line
TLPT and the testing authority
The testing authority oversees TLPT under the applicable framework. This guide explains its role, how firms engage with it, and what oversight means for the exercise.
TLPT evidence for supervisors
Supervisors judge TLPT by its evidence. This guide explains what evidence is produced, how it should be organised, and what makes it credible in practice.
TLPT findings and remediation plans
TLPT findings describe attack paths, not grades. This guide explains how to read findings, prioritise them, and build remediation plans that can be tracked to completion.
TLPT for critical functions
Critical functions are the reason TLPT exists. This guide explains how functions are identified, why they shape the test, and what a function-level view reveals.
TLPT frequency and cycles
TLPT is a cycle, not a one-off exercise. This guide explains how cycles are set, what happens between exercises, and how a firm learns from one cycle to the next.
TLPT lessons for the whole firm
A TLPT finding about one function often points to a wider weakness. This guide explains how lessons are generalised, shared, and turned into firm-wide improvement.
TLPT planning and preparation
Preparation determines whether TLPT is safe, realistic and useful. This guide covers governance, safety, communications and the practical steps before testing starts.
TLPT reporting to authorities
Reporting closes the TLPT loop with authorities. This guide explains what is reported, when, how findings are handled, and how follow-up works in practice.
TLPT scoping and target systems
Scoping decides whether TLPT touches the critical functions it exists to protect. This guide explains how target systems are chosen, and how exclusions should be handled.
TLPT testers and independence
Independent testers give TLPT its credibility. This guide explains the skills, separation and working arrangements that testers need, and how firms should work with them.
TLPT threat intelligence
Threat intelligence turns TLPT from a generic test into a realistic one. This guide explains how intelligence is gathered, judged and turned into test scenarios.
TLPT vs penetration testing
TLPT and penetration testing are related but not the same. This guide compares their purpose, scope, method and reporting, and explains when each is appropriate.
Who must undertake TLPT
Not every financial entity is designated for TLPT under DORA. This guide explains designation, what it means for a firm, and how group and supplier arrangements fit in.