DORA TLPT: threat-led penetration testing in banking

Within the DORA regulation there is a requirement that truly tests the resilience of financial institutions: the DORA TLPT, threat-led penetration testing. It is not just another vulnerability scan; it is simulating a real, sophisticated and targeted attack to check whether the organisation holds up. In the banking projects I support, preparing it well is an exercise in humility and learning.

What TLPT is and what sets it apart

TLPT stands for threat-led penetration testing. The idea is to imitate the tactics, techniques and procedures of real attackers against the institution’s production systems. Unlike a traditional, more limited pentest, TLPT is broad, realistic and based on threat intelligence specific to the sector.

The DORA regulation requires it of the most significant financial institutions, on an established frequency and under the supervision of the authorities. It is not a technical whim: it is a verification that the operational resilience that is declared really exists.

TLPT versus the traditional pentest

Scope and realism

The classic pentest looks for vulnerabilities in a specific system. TLPT simulates a complete attack campaign against the organisation, usually without most of the defending team knowing, to measure the real capacity for detection and response.

Threat intelligence

TLPT starts from intelligence about which attackers threaten the sector and how they operate. That makes it much more representative of a real attack than a generic test, and it connects with cybersecurity risk management based on concrete threats.

How to prepare for a TLPT

Preparation is not about armouring yourself to pass, but about having a mature security posture all year round. I recommend rehearsing detection and response beforehand, reviewing business continuity and assuming that the TLPT will find things: that is precisely its value. Arriving with the idea of learning, and not just passing, completely changes the result.

The team and the people behind the TLPT

A well-executed TLPT depends less on the tool and more on the people. You need a red team with real experience in financial-sector threats, a control team that oversees the scope without leaking information to the defending team, and a blue team that reacts without knowing it is being evaluated. Coordinating those three roles, in my experience, is the most delicate part: any information leak invalidates the realism of the test and turns an expensive exercise into a worthless drill.

Here I always run into an uncomfortable reality of the sector: the shortage of profiles capable of designing and sustaining these exercises. Banking competes for very limited talent, a structural problem that I analyse in my article on the shortage of cyber experts in banking in the face of DORA. Without a plan to attract and retain those people, no testing framework, however well designed, ever reaches its full potential.

From the TLPT result to the improvement plan

The real value of a TLPT is not in the final report, but in what you do with it. Each finding must translate into a concrete action, with an owner and a deadline, and be prioritised according to the risk it represents. I have seen organisations invest a lot in the test and leave the report in a drawer; the result is that they repeat the same failures the following year. I treat the TLPT as the starting point of a continuous improvement cycle, not as a compliance formality to close.

Many of the recommendations that emerge from these tests push towards a security model without perimeters of implicit trust. That is why I usually align the remediation plan with a broader strategy of Zero Trust in banking and regulated environments, which addresses at the root many of the weaknesses that a TLPT brings to light. Connecting the one-off exercise with the long-term security architecture is what turns spending into investment.

It is also worth being realistic about timescales and budget. A serious TLPT is not improvised: the threat intelligence phase, scope planning and controlled execution can extend over several months, and the cost is not small. That is why I recommend planning it well in advance within the regulatory calendar and reserving margin for the subsequent remediation, which is usually the item most underestimated. Rushing into an exercise of this magnitude is the surest way to waste the investment.

Finally, document every decision of the exercise: the agreed scope, the chosen threat scenarios and the rules of engagement. That documentation not only makes it easier to repeat the TLPT in future under comparable conditions, but also constitutes the evidence the supervisor expects to find when reviewing the maturity of your operational resilience.

Conclusion: testing yourself to improve

The DORA TLPT is demanding, but it is one of the exercises that brings the most maturity to a financial institution. Simulating the attack you fear is the best way to discover your weak points before a real attacker does. Those who face it with an improvement mindset, and not as a mere formality, come out stronger from each test.

Frequently asked questions about DORA’s TLPT