DORA Penetration Testing: Resilience Testing and TLPT Explained

Quick answer: DORA penetration testing refers to the security testing required by the EU Digital Operational Resilience Act (DORA), which has applied since 17 January 2025. All in-scope financial entities must run a risk-based digital operational resilience testing program that can include vulnerability assessments, scenario-based tests and penetration testing, with critical systems tested at least once a year. Entities designated by their regulators must also complete threat-led penetration testing (TLPT) at least every three years, based on the TIBER-EU framework.

DORA is one of the most significant changes to financial sector cybersecurity in Europe. It replaces a patchwork of national rules with a single regulation covering ICT risk management, incident reporting, resilience testing, third-party risk and information sharing. It applies to banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers and many others, and it reaches the ICT providers that serve them.

This guide explains what DORA says about testing, how the basic testing program and TLPT differ, who must comply, how to plan and run DORA penetration testing, and how to choose a testing partner. To discuss testing for your organization, explore Privaxi's financial services cybersecurity services.

What Is DORA?

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, sets uniform requirements for how financial entities in the European Union manage ICT risk. Its goal is to make sure firms can withstand, respond to and recover from ICT disruptions and cyberattacks. DORA is organized around five pillars: ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management and information sharing. Detailed technical standards from the European Supervisory Authorities fill in the specifics.

What Is DORA Penetration Testing?

DORA penetration testing covers two layers of testing. The first is the general digital operational resilience testing program that every in-scope entity must maintain, which includes penetration testing among other methods. The second is threat-led penetration testing, an advanced, intelligence-driven test of live production systems required only for entities designated by their competent authority. Both layers aim to prove that critical functions can withstand realistic attacks.

For a general introduction to penetration testing, see our guide to penetration testing services.

Who Must Comply?

• Credit institutions and banks.

• Payment institutions and electronic money institutions.

• Investment firms and trading venues.

• Insurance and reinsurance undertakings and intermediaries.

• Crypto-asset service providers.

• Central securities depositories and central counterparties.

• Asset managers, pension providers and other financial entities listed in the regulation.

• ICT third-party service providers, with critical providers subject to direct oversight.

Proportionality applies, so smaller and less complex entities may follow a simplified ICT risk management framework. Non-EU companies that provide ICT services to EU financial entities are also affected through contracts and oversight. Confirm your obligations with legal counsel.

The Digital Operational Resilience Testing Program

Every in-scope entity must establish a risk-based testing program as part of its ICT risk management framework. DORA lists a range of tests the program can include:

Testing must be performed by independent parties, internal or external, and all ICT systems and applications supporting critical or important functions must be tested at least yearly. Findings must be prioritized, remediated and documented. Annual DORA penetration testing is usually the backbone of this program.

Threat-Led Penetration Testing (TLPT)

Entities designated by their competent authority, typically larger or systemically important firms, must carry out TLPT at least every three years. TLPT is based on the TIBER-EU framework and follows detailed regulatory technical standards. Key features include:

• Testing of live production systems supporting critical or important functions.

• Scope defined by the entity and validated by the competent authority.

• Threat intelligence that identifies realistic attackers and scenarios for the entity.

• A red team that simulates those attackers under strict risk management controls.

• A small control team inside the entity that knows about the test, while defenders are not told.

• Purple teaming and remediation planning after the test.

• Attestation from the authority once the test is complete.

Critical ICT third-party providers that support in-scope functions may need to participate. Testers must meet suitability requirements, and external testers must be used at least every third test for credit institutions using internal testers. For background on adversary simulation, see our guide to red teaming and penetration testing.

Basic Testing vs TLPT at a Glance

What to Include in Scope

• Internet-facing systems: websites, portals and remote access. See external penetration testing.

• Internal networks: systems supporting critical or important functions. See internal penetration testing.

• Customer applications and APIs: online banking, trading, payments and open banking interfaces. See web application penetration testing and API penetration testing.

• Cloud services: cloud platforms hosting critical workloads. See cloud penetration testing.

• ICT third parties: outsourced services supporting critical functions. See third-party penetration testing.

• Recovery capabilities: backup, failover and recovery systems.

Start by mapping critical or important functions and the ICT assets that support them, including the business processes, data flows and third parties involved. That map defines the scope for both the testing program and TLPT. Our guide to penetration testing scope explains how to prioritize.

How to Run DORA Penetration Testing

1. Map critical functions: identify critical or important functions and supporting ICT systems.

2. Design the testing program: choose test types and frequencies based on risk.

3. Select testers: confirm independence, qualifications and, for TLPT, regulatory suitability.

4. Agree rules and safeguards: define scope, timing, risk controls and escalation paths.

5. Test: run penetration tests and other assessments according to the plan.

6. Remediate: prioritize, fix and verify findings.

7. Report: document results for management, the board and supervisors.

For testing phases in more detail, see our overview of penetration testing methodology.

Management and Board Responsibilities

DORA places responsibility for ICT risk on the management body. Leaders must approve the ICT risk management framework, understand testing results and make sure remediation is resourced. They are also expected to keep their own knowledge of ICT risk up to date through regular training. Clear, business-focused reporting from DORA penetration testing helps boards meet these obligations. Our guide to the penetration testing report explains how to present results to different audiences.

Common Findings in Financial Environments

• Authorization flaws in customer-facing applications and APIs.

• Weak segmentation between corporate and critical systems.

• Overly broad privileged access and weak multi-factor authentication.

• Unpatched internet-facing systems.

• Gaps in detection and response to realistic attack paths.

• Third-party connections with more access than needed.

• Recovery systems reachable from compromised networks.

For a structured approach to closing gaps, read our guide to penetration testing remediation.

DORA and Other Frameworks

Many EU financial firms also answer to PCI DSS, ISO 27001, SOC 2 and national rules. A well-designed testing program can support several frameworks at once. Non-EU firms with EU operations may also face similar requirements at home, such as NYDFS Part 500 in New York. For comparisons, see our articles on penetration testing compliance requirements, financial services penetration testing and NYDFS penetration testing.

Choosing a DORA Testing Partner

• Experience with financial services systems and regulators.

• Understanding of DORA's testing program and TLPT requirements.

• Independent, qualified testers with appropriate certifications.

• Strong risk management for testing production systems.

• Clear reporting for management bodies and supervisors.

• Remediation support and retesting.

Our guide to choosing a penetration testing company lists more questions to ask.

Cost of DORA Penetration Testing

The cost of DORA penetration testing depends on the number of critical functions and supporting systems, the mix of test types, whether TLPT is required, the involvement of third parties and the level of reporting needed. Annual penetration testing for a smaller entity is a fraction of the cost of a full TLPT, which involves threat intelligence, red teaming and regulatory coordination. For pricing factors, see penetration testing cost.

Common Mistakes to Avoid

• Assuming DORA testing only means TLPT.

• Testing systems without first mapping critical or important functions.

• Leaving ICT third parties out of scope.

• Failing to document remediation and retesting.

• Running tests without independence or qualified testers.

• Reporting results without business context for the management body.

Building a Sustainable Testing Program

DORA expects testing to be continuous and risk-based, not a one-off project. Combine annual DORA penetration testing with ongoing vulnerability management, scenario exercises, third-party oversight and incident response testing. Track metrics over time, update the program as your business and threats change, and keep evidence organized for supervisors. For continuous coverage, see our guides to annual penetration testing and continuous penetration testing.

Preparing for Threat-Led Penetration Testing

If your entity may be designated for TLPT, preparation should start well before the regulator's notice. Strong annual DORA penetration testing results, mature vulnerability management and tested incident response make a threat-led exercise far more productive, because the red team can focus on realistic attack paths rather than basic weaknesses. Practical steps include:

1. Map critical or important functions and the people, processes and systems behind them.

2. Run full-scope penetration tests on those systems and fix serious findings.

3. Confirm logging, detection and escalation work across the relevant environments.

4. Identify the small control team that will manage the exercise in confidence.

5. Review contracts with ICT third parties to confirm they can participate if needed.

6. Plan budget and engineering capacity for remediation after the test.

Organizations that treat their annual DORA penetration testing as a rehearsal for TLPT usually face fewer surprises when the threat-led exercise begins.

What DORA Means for ICT Providers

Cloud providers, SaaS vendors and managed service providers that support EU financial entities are increasingly asked to prove their resilience. Contracts now commonly include testing rights, incident reporting duties and requirements to share test results. Providers designated as critical face direct oversight by the European Supervisory Authorities. Running regular penetration tests, keeping clear summaries ready for customers and supporting customer-led testing where appropriate can become a competitive advantage. For related guidance, see our article on SaaS penetration testing.

Frequently Asked Questions About DORA Penetration Testing

What is DORA penetration testing?

DORA penetration testing refers to the resilience testing required by the EU Digital Operational Resilience Act, including annual testing of critical systems and threat-led penetration testing for designated entities.

When did DORA start to apply?

DORA has applied since 17 January 2025 to in-scope financial entities across the European Union.

How often is penetration testing required under DORA?

Systems supporting critical or important functions must be tested at least yearly, and designated entities must complete TLPT at least every three years.

What is TLPT?

Threat-led penetration testing is an intelligence-driven red team test of live production systems, based on the TIBER-EU framework, required for entities designated by their competent authority.

Does DORA apply to ICT providers?

Yes. ICT providers are affected through contracts with financial entities, and critical ICT third-party providers are subject to direct oversight and may participate in TLPT.

Can one test meet DORA and other frameworks?

Yes. A well-designed testing program can support DORA, PCI DSS, ISO 27001 and other requirements at the same time.

Final Thoughts

DORA penetration testing is a core part of DORA compliance and of real operational resilience. Map your critical functions, build a risk-based testing program, test critical systems at least yearly, prepare for TLPT if designated, fix and retest findings, and keep clear evidence for your management body and supervisors.

To plan DORA penetration testing for your organization, explore Privaxi's financial services cybersecurity services.