Cybersecurity for financial services

DORA (Digital Operational Resilience Act) is EU regulation that sets harmonised requirements for the ICT risk management, incident reporting, operational-resilience testing and ICT third-party risk of financial entities — banks, insurers, investment firms, payment institutions and crypto-asset service providers — and their critical ICT providers. It applies across the EU.

TLPT (Threat-Led Penetration Testing) is DORA's advanced red-team-style resilience test. It is required for financial entities identified by their competent authorities under DORA's selection criteria, generally at least every three years. It uses current threat intelligence to simulate a realistic cyber attack against live production systems. Passeca supports TLPT engagements through scoping, preparation and coordination in accordance with applicable TLPT requirements; ordinary penetration testing is not equivalent.

A pre-negotiated incident-response retainer commits Passeca's team to respond within agreed SLAs when an incident occurs — no procurement delay mid-crisis. It supports timely containment and evidence handling, and helps financial entities meet applicable regulatory reporting deadlines.

Passeca deploys Panorays for automated third-party and supply-chain risk assessment and structures the register of ICT arrangements, contractual clauses and concentration-risk monitoring that DORA requires for critical ICT third-party providers.

There is deliberate alignment, but DORA is lex specialis for the financial sector — it takes precedence for in-scope financial entities. Passeca maps controls once so evidence serves both frameworks, avoiding duplicated effort while respecting each regime's specific reporting and testing duties.

Yes. SOC-as-a-Service delivers 24/7 monitoring, detection and response on Passeca's own SIEM (PassIRP) and AI automation layer (PassAI-Guard), with EU data residency and incident-handling that supports DORA major-incident reporting timelines.

Beyond TLPT, financial entities need web and API testing of digital-banking and payment platforms, network testing of core environments, and cloud testing of hosted services. Passeca delivers these under OWASP, PTES and NIST methodology with reports suitable for regulator and board review.

Passeca's incident-response team can be reached through the urgent request form on its Incident Response page. Under a retainer, response SLAs are pre-negotiated; without one, Passeca mobilises as rapidly as possible — but a retainer removes procurement friction during the most costly minutes of an incident.