TLPT exists because standard penetration testing, while valuable, is bounded by its scope and method. A conventional pentest attacks defined systems over a defined window and reports the vulnerabilities found. It does not, by design, test whether an organisation can detect and respond to a sustained, intelligence-driven attack by a determined adversary — which is the scenario that matters most for systemic financial stability. TLPT addresses this gap by making the test threat-led: the targets, the tactics, and the objectives are derived from real threat intelligence about actors who actually attack financial institutions, and the test is conducted over weeks by teams qualified to emulate those actors.
The framework underlying TLPT in Europe is TIBER-EU (Threat Intelligence-based Ethical Red Teaming), developed by the European Central Bank and national authorities. DORA, the Digital Operational Resilience Act, requires financial entities selected by competent authorities to conduct TLPT, and the European Supervisory Authorities have published detailed regulatory technical standards governing how these tests must be conducted. The test is overseen by the regulator, who approves the scope, the threat intelligence, and the providers, ensuring a consistent and rigorous standard across the sector.
A TLPT is structured into distinct phases. The scoping phase identifies the live business services, critical or important functions, and supporting systems that will be tested, in consultation with the regulator. The threat intelligence phase produces intelligence-led scenarios, derived from real actors and TTPs, that the red team will execute — these are the heart of what makes the test threat-led. The red-team execution phase conducts the attack over an extended period, typically weeks, using the agreed scenarios, with the blue team unaware of the specifics so that detection and response are tested for real. The closing phase produces a report on the vulnerabilities found, the detection and response performance, and the remediation required, shared with the regulator.
What TLPT tests, beyond vulnerabilities, is the organisation's detection and response. A conventional pentest might find that a system can be compromised; a TLPT finds out whether the organisation noticed. Because the blue team is not told the specifics of the attack, the test produces a genuine measure of whether the SOC detected the intrusion, how long it took, and how effectively the incident response process contained it. For a financial entity, this is arguably the most valuable output — not the vulnerabilities, which can be found other ways, but the validation that the defensive operation works against a realistic adversary. The lessons from a TLPT therefore drive improvements in both the controls and the detection-and-response capability.
Passeca delivers TLPT under the DORA and TIBER-EU frameworks, with scoping, threat-intelligence-led scenario development, and red-team execution by qualified Passeca testers. The engagement is conducted in coordination with the relevant regulator and follows the DORA regulatory technical standards for advanced testing. TLPT is the most demanding form of penetration testing, and it sits at the top of a testing programme that typically also includes conventional pentests, vulnerability assessments, and the regular resilience testing that DORA requires for all in-scope entities. Passeca helps financial entities design and run the full programme, of which TLPT is the capstone.