Security engineers often work with vulnerability scanners, penetration tests, security information and event management platforms, endpoint protection and incident response playbooks.

These tools provide important information, but a financial institution also needs to understand how its controls perform when a sophisticated attacker attempts to reach systems supporting a critical business function.

Threat-Led Penetration Testing (TLPT) provides a structured way to evaluate this broader question.

What Does DORA Require?

The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, establishes TLPT requirements for selected financial entities. Article 26 addresses testing, Article 27 covers tester requirements, and Commission Delegated Regulation (EU) 2025/1190 specifies detailed technical standards.

Not every entity within DORA's scope is automatically subject to TLPT.…