Advanced red-teaming tests for regulated financial institutions
The European DORA (Digital Operational Resilience Act) introduces a new standard for ICT risk management. It requires significant financial entities to regularly perform Threat-Led Penetration Testing (TLPT) — intelligence-based and threat-driven tests that simulate the capabilities of advanced, organized cyber attackers (APT groups).
The objective is not merely to identify vulnerabilities, but to verify the ability of the entire organization to detect, respond to, and recover from an attack aligned with a realistic and coordinated threat scenario.
What is Threat-Led Penetration Testing and why are routine tests not sufficient?
Unlike a standard penetration test, TLPT:
Simulates an attack in its full complexity, including initial compromise, lateral movement, privilege escalation, persistence and data exfiltration.
Is driven by current threat intelligence and sector-specific attack scenarios.
Includes a coordination phase with a clearly defined scope, rules of engagement, identification of critical systems and defined testing objectives.
From a technical perspective, requires deep knowledge of attack vectors and the ability to replicate real-world adversary techniques, including exploitation of zero-day vulnerabilities, social engineering, obfuscation techniques or supply-chain attacks.
What are the requirements for testing teams?
DORA also emphasizes the quality and qualification of entities performing advanced testing. Testers must meet strict criteria, including:
Being reputable professionals with proven technical and organizational expertise and specific domain knowledge.
Holding appropriate certifications and undergoing independent audits or demonstrating proper risk management practices in testing.
Maintaining adequate professional liability insurance to cover potential damages.
If an institution intends to use its own internal red team, it must obtain regulatory approval and ensure organizational independence of the internal team (to avoid conflicts of interest). Operational threat intelligence for the specific scenario must be provided by a qualified third-party provider.
.png )