TIBER-EU in plain English
The abbreviation stands for “Threat Intelligence-based Ethical Red Teaming” – ethical red teaming based on information about current threats. The European Central Bank developed the framework together with the national central banks and published it in May 2018.
A comparison: an announced fire drill mainly shows whether everyone knows the way to the assembly point. An unannounced drill based on the fire risks of that specific building is more revealing. TIBER-EU applies this idea to IT security. A red team attacks the company the way real attackers would in the current threat landscape – and the defenders know nothing about it.
To keep this manageable despite attacks on production systems, TIBER-EU defines not only the method but also a strictly regulated process with clear roles.
How a TIBER-EU test works
Several parties are involved. Within the company, only a small control team is in the know (formerly called the white team). The blue team – the defenders – has no idea. They are joined by a threat intelligence provider, the red team, and the TIBER Cyber Team of the competent authority, which oversees the test.
The test is divided into three phases:
- Preparation: The authority notifies the company. In coordination with the authority, the control team determines which critical functions will be tested, assesses the risks, and engages the service providers. This phase lasts no more than six months.
- Testing: First, the threat intelligence provider analyzes which threat actor groups are relevant to the company and how they operate. This results in concrete attack scenarios. The red team then carries out these scenarios against the production systems – the real systems in live operation. The active attack phase lasts at least twelve weeks.
- Closure: The red team and the blue team write reports. The attack is replayed jointly, and in a mandatory purple teaming exercise, both sides work together openly. The end result is a remediation plan and a confirmation that the test was conducted in line with the requirements.
If the red team gets stuck at some point, the control team can help in a targeted way – for example, by providing access. This means the downstream lines of defense can be tested as well. Experts call this a “leg-up.”
A practical example
A bank is selected for a test. The control team consists of the board member responsible for IT, the information security officer, and a trusted person from IT operations. The threat intelligence report shows which groups are particularly relevant: criminals who get in through targeted phishing and aim to manipulate payment processes.
Using a specially crafted email, the red team gains access to a workstation and, over several weeks, works its way through to the payment systems. The blue team notices individual steps but doesn’t realize that they belong to one coherent attack. During purple teaming, both teams replay the steps. The bank then improves its detection rules and the coordination between IT operations and the security team.
Why does this matter for businesses?
DORA, the Digital Operational Resilience Act, has applied since January 17, 2025. Under it, financial entities selected by the supervisory authorities must, as a rule, conduct a threat-led penetration test, or TLPT for short, at least every three years. In early 2025, TIBER-EU was aligned with the regulatory technical standards on TLPT, and it has served as a practical guide for such tests ever since.
In Germany, TIBER-EU is implemented as TIBER-DE. The responsible TIBER Cyber Team is based at the Deutsche Bundesbank (Germany’s central bank) and oversees both voluntary TIBER-DE tests and TLPTs ordered under DORA by authorities such as BaFin (Germany’s Federal Financial Supervisory Authority). Even for companies without a testing obligation, the methodology can serve as a benchmark for particularly realistic security tests.
What businesses should do now
- Determine whether you’re affected: Check whether your company falls under DORA and whether a TLPT obligation could apply.
- Lay the groundwork: A threat-led test delivers the most value when regular penetration tests, working patch management, and attack detection are already in place.
- Know your critical functions: Document which business functions are critical and which systems they rely on.
- Appoint a control team: Designate a small, trustworthy group early on to steer the test and keep it confidential.
- Practice detection: Red teaming and purple teaming exercises prepare your blue team realistically.
- Choose providers carefully: TIBER-EU sets high requirements for the experience and qualifications of threat intelligence providers and red teams.
How Rootsektor can help
As a Germany-based security company, we use Red Teaming & APT Simulation to test your detection and response capabilities realistically – on request modeled on TIBER-EU and as targeted preparation for a TLPT. As a variant of or complement to red teaming, we offer purple teaming: we work openly with your blue team and fine-tune detection together. You can read about the specific requirements for banks, insurers, and payment service providers on our Financial Services page.