What is TLPT? Threat-led penetration testing explained

Definition

Threat-led penetration testing (TLPT) is a form of advanced security testing in which skilled testers emulate the tactics, techniques and procedures of real threat actors against an organisation’s live production systems. The goal is to measure real resilience: can attackers get in, and can the organisation detect and respond before damage is done?

Under the EU DORA regulation, TLPT is built on TIBER-EU — the ECB’s Threat Intelligence-Based Ethical Red Teaming framework, published in 2018 and already run by several EU jurisdictions.

What makes it "threat-led"

The "threat-led" part is crucial. Instead of a generic checklist, a threat-intelligence provider first researches the specific adversaries most likely to attack the entity, and those findings shape realistic attack scenarios. The red team then tries to achieve those scenario objectives.

Who must do it

TLPT applies to significant financial entities identified by their competent authorities. In-scope entities must complete a TLPT at least every three years. Other entities run DORA’s baseline testing programme but are not required to perform full TLPT.

What it is not

• Not a vulnerability scan — it is a full, intelligence-led attack simulation.
• Not a standard penetration test of one system — it targets critical functions across the organisation.
• Not a pass/fail exam — the point is to find and close gaps.