TLPT in plain English
TLPT stands for threat-led penetration testing – a penetration test driven by real-world threats. In a standard penetration test, experts look for vulnerabilities in a defined set of systems. A TLPT goes further: it plays out a complete attack – the way a real group of attackers would carry it out against this specific company.
Imagine an unannounced fire drill – not at a training ground, but in your actual office building during working hours. The scenario is based on the most likely causes of fire in this particular building. Only a small group is in on it and can stop the drill at any time. Everyone else reacts just as they would in a real emergency.
TLPT is mandated by the Digital Operational Resilience Act (DORA), which has applied to financial entities in the EU since January 17, 2025. Methodologically, it builds on the European TIBER-EU framework (Threat Intelligence-based Ethical Red Teaming). At its core, a TLPT is a strictly regulated form of red teaming – a realistic, covert attack carried out by commissioned experts.
How TLPT works
The process is governed by DORA (Articles 26 and 27) and supplementary regulatory technical standards that closely follow TIBER-EU:
- Selection by the supervisor: The competent authority determines which financial entities must carry out a TLPT. The decisive factors are their significance for the financial sector, possible consequences for financial stability, and their ICT risk profile (ICT stands for information and communication technology). In Germany, this is usually BaFin (Germany’s Federal Financial Supervisory Authority); for significant banks under the direct supervision of the European Central Bank (ECB), it is the ECB. The Deutsche Bundesbank, Germany’s central bank, supports the tests operationally.
- Preparation: A small control team within the company – people who are in on the test – defines which critical or important functions will be tested, such as payment transactions. The authority must confirm this scope.
- Threat analysis: Threat intelligence specialists – experts in gathering and analyzing information about attackers – determine which threat actor groups are relevant to the company and how they operate. These findings are turned into concrete attack scenarios.
- Attack: The red team carries out these scenarios on the real production systems, meaning during live operations. The active attack phase lasts at least 12 weeks. The defenders – the blue team – know nothing about it.
- Closure: Attackers and defenders replay the attack together and explore selected topics in depth in a mandatory purple teaming exercise, in which both sides work together. The company draws up a remediation plan, and the authority attests that the test was carried out in compliance with the rules.
As a rule, a TLPT is due at least every three years; the supervisory authority can adjust this frequency. Internal testers are permitted under strict conditions, but at least every third test must be carried out by external testers. Significant banks under direct ECB supervision must always engage external testers.
A practical example
A large credit institution is informed by its supervisory authority that it must carry out a TLPT. The focus is on payment transactions and online banking.
The threat analysis shows that, for comparable institutions, the most relevant groups are those that attack with targeted emails and via IT service providers. The red team gains access to a computer in the HR department through a rigged job application. Using a service account with excessive privileges, it works its way close to the payment systems. The blue team notices unusual logins but initially classifies them as harmless.
In the closure phase, both teams replay the attack step by step. The institution sees exactly where detection and response need to improve and records the necessary measures in a plan.
Why does this matter for businesses?
For the selected financial entities, TLPT is mandatory – the supervisory authority expects it and receives the results. Under DORA, responsibility for ICT risk management lies with the management body, meaning senior management.
The benefits go beyond compliance. A TLPT doesn’t just reveal individual vulnerabilities – it shows whether technology, processes, and people together can withstand a targeted attack. Because the authority attests that the test was carried out properly, supervisory authorities in other EU member states can also recognize it.
IT service providers to banks and insurers should be familiar with the topic as well: if they support critical functions, they can become part of the test scope.
What businesses should do now
- Find out whether your organization is a candidate for TLPT, and if anything is unclear, talk to your supervisory authority early on.
- Document your critical or important functions and the systems that support them.
- Build a solid foundation: regular penetration tests, effective patch management, and attack detection that is actually monitored.
- Appoint a small control team early on and define escalation paths and criteria for stopping the test.
- Choose testers and threat intelligence providers carefully – DORA sets high requirements for their suitability, expertise, and experience.
- Practice in advance: a red teaming exercise modeled on TIBER-EU shows where you stand before it becomes official.
How Rootsektor can help
As a Germany-based security company, Rootsektor helps financial entities and their IT service providers prepare specifically for threat-led tests – with preparatory penetration tests and with Red Teaming & APT Simulation modeled on TIBER-EU, supplemented by purple teaming on request. Even for institutions without a TLPT obligation, such exercises provide a realistic assessment of where they stand. Our Financial Services page summarizes the rules that apply to your industry; for an initial consultation, simply use our Contact page.