THREAT-LED PENETRATION TESTING
Plan DORA TLPT around critical functions, targeted threat intelligence, controlled red-team testing and reporting under the applicable authority process.
YOUR ENVIRONMENT. YOUR REQUIREMENTS.
A few choices. A useful starting point.
Tell us what you use and what you need.
REQUEST RECEIVED
Atlant Security has received your requirements. We’ll review the scope and contact you at .
If you attached an NDA, it is included for review. Submission does not accept its terms or authorise testing.
Review the sample report ↗The guided builder needs JavaScript for its security check. Send your scope and requested outcomes to sales@tlptdora.com, with your NDA/RFP if available.
Your critical functions depend on people, processes and technology. A meaningful test examines them together.
Atlant Security offers one integrated DORA TLPT engagement: targeted threat intelligence, controlled red-team testing, closure and remediation planning.
We connect realistic adversary scenarios to the services your organisation needs to keep running, with governance and operational safeguards established from the start.
Inside the engagement
An integrated process.
Accountability at every stage.
Map critical functions, dependencies and boundaries. Establish governance and authority coordination.
Use targeted intelligence to identify relevant adversaries and develop credible scenarios.
Execute red-team activity with agreed safeguards, control-team oversight and clear escalation.
Reconstruct the attack with defenders. Review detection, response and purple-team findings.
Prioritise remediation, assign ownership and prepare the evidence for the closure process.
Not every organisation subject to DORA is required to conduct TLPT.
Competent authorities identify the financial entities that must perform advanced testing. Confirm your designation and the applicable authority process before defining the engagement.
Understand who needs TLPTDORA articles covering advanced testing and the requirements for testers.
At least once every three years for identified entities, subject to authority adjustment.
The minimum active red-team phase under RTS Article 11(5), with other phases adding time.
The final DORA TLPT RTS, Regulation (EU) 2025/1190, sets the detailed rules for scope, provider selection, testing, reporting and remediation. Our illustrated guide explains the deadlines, eight annexes and decisions your control team needs to plan.
Read the complete DORA TLPT RTS guidePRIMARY SOURCES DORA Articles 26–27 TLPT RTS (EU) 2025/1190
THE VALUE OF THE ENGAGEMENT
The outcome should be useful to your security teams, decision-makers and the authority overseeing the engagement.
Explore the deliverablesConnect scenarios, actions and evidence to observed control outcomes.
Bring attack and defence observations together through replay and purple-team learning.
Set clear actions, accountable owners and a basis for follow-through.
DORA TLPT is an authority-governed threat-led testing process for selected financial entities. Begin with the entity’s selection position, proposed critical or important functions and responsible control team. The engagement needs coherent threat intelligence, controlled testing and closure evidence; a conventional pentest or isolated resilience exercise is not automatically equivalent.
Explore the DORA TLPT engagement · Understand the final TLPT RTS
04 / INSIGHTS & PERSPECTIVES
A target list is a poor starting point for a DORA threat-led penetration test. Start with the critical or important function, then establish which live production systems, people and suppliers support it.
Read the perspective
Use the TLPT RTS to evaluate delivery responsibilities, not just the bidder's credentials page. This guide translates a buying decision into questions for the financial entity, intelligence provider and testers.
Read the perspective
For a DORA TLPT, the valuable intelligence question is not which threat groups appear in the most reports. It is which credible adversary behaviour could threaten your specific function, and how that can inform a controlled test.
Read the perspectiveA PRACTICAL STARTING POINT
Bring scope, governance and procurement into one working checklist.
LET’S START A CONVERSATION
Your critical functions. Your authority’s requirements. A clear starting point for your TLPT engagement.
Discuss your TLPT