A Guide to DORA Penetration Testing Requirements for Financial Services in 2026

Summary

• DORA (Regulation (EU) 2022/2554) standardizes Information and Communications Technology (ICT) risk management across 21 categories of EU financial entities and their ICT vendors.
• The regulation requires threat-led penetration testing (TLPT) on live production systems at least every three years.
• TLPT must be conducted by accredited testers and cover critical functions, including those outsourced to third parties.
• Continuous, intelligence-driven pentesting gives financial entities a realistic measure of detection and response capability against advanced threats.

Key Terms

• Digital Operational Resilience Act (DORA): An EU regulation that standardizes how financial entities manage ICT risk, report incidents, test resilience, and oversee third-party ICT providers.
• Threat-led Penetration Testing (TLPT): An intelligence-driven testing approach that simulates the tactics, techniques, and procedures (TTPs) of real adversaries against live production systems.
• Critical Third-party Provider (CTPP): An ICT vendor whose services support a financial entity’s critical or important functions.
• Competent Authority: The regulator designated by each EU member state to receive ICT incident reports and TLPT documentation.
• Adversarial Exposure Validation (AEV): An automated approach to running multistep, threat-intelligence-led attack scenarios to surface real exposures.

DORA Penetration Testing Requirements for Financial Services

A financial institution could patch every known vulnerability on schedule and still need more evidence that its incident response team would catch a determined attacker moving through production systems. That gap between having controls and knowing they hold up under real pressure is what DORA is built to close.

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) gives the EU’s financial sector a single standard for managing ICT risk, reporting incidents, testing resilience, and overseeing third-party vendors. It applies to 21 categories of financial entities, from banks to insurers to investment firms, and to every ICT vendor that supports them, including those that do business in the EU.

DORA Penetration Testing Requirements

DORA’s technical requirements span five areas. Financial entities need a risk management framework that covers the full ICT lifecycle: identifying critical assets, running continuous risk assessments, classifying threats, and implementing controls like patch management, identity and access management, XDR, SIEM, and SOAR.

• They need third-party risk management that maps ICT dependencies and prevents over-reliance on any single vendor.
• They need standardized incident reporting to their Competent Authority.
• Information-sharing on cyber threats is encouraged, though not mandatory.
• The fifth pillar, digital operational resilience testing, is where penetration testing requirements live.

Why DORA Penetration Testing Requirements Specify Threat-Led Testing

Article 25 requires advanced penetration testing, and article 26 narrows that further: in-scope organizations must run threat-led penetration testing at least every three years. The standard is specific by design. Annual vulnerability scanning tells you what’s exposed. TLPT goes deeper by telling you whether your team would catch and contain an attacker who’s already found a way in.

DORA TLPT requirements set a high bar. Testing must cover critical or important functions, including those outsourced to ICT vendors, not just the systems a financial entity directly controls. It must run against live production environments rather than staging or test instances, because that’s the only way to validate real-world resilience. And it must be performed by testers who can demonstrate expertise in threat intelligence, penetration testing, and red teaming service, certified by an accreditation body in an EU member state (Article 27).

After testing, the financial entity reports findings, a remediation plan, and documentation proving the test met DORA’s standards to its Competent Authority. The paperwork matters, but it’s a byproduct of the real work: knowing where your defenses actually fail.

What TLPT Reveals That Traditional Testing Doesn’t

Traditional pentesting answers a narrower question than most security leaders realize. It tells you which vulnerabilities exist. TLPT, by simulating the tactics, techniques, and procedures of real threat actors against live systems, tells you whether your detection and response capabilities would actually hold up against a multi-stage attack.

That distinction matters for compliance, but it matters more for the boardroom conversation that follows the latest headline about a data breach. A remediation list shows due diligence. A TLPT report shows whether the organization would have caught the attack in progress, how long it would have taken, and what needs improvement along the way. For a financial entity reporting to a Competent Authority, that’s a materially stronger position than a point-in-time vulnerability count.

Building Continuous TLPT Into a DORA Compliance Program

Three-year cycles set the regulatory floor, not the operational target. Threat actors don’t wait three years between attempts, and a financial entity’s attack surface doesn’t stay static between testing windows. Continuous, threat-led testing turns DORA compliance from a periodic obligation into an ongoing measure of actual security posture.

BreachLock’s continuous, threat-led penetration testing services help financial entities and critical third-party providers assess the strength of their preventive, detection, response, and recovery capabilities, then prioritize remediation around the issues that put critical functions at the most risk. Testing simulates bespoke, real-world attack scenarios so security teams see how an adversary would actually move through their environment, not just where a scanner flagged a CVE.

BreachLock’s Adversarial Exposure Validation platform extends this further. The autonomous, gen-AI enabled solution runs multistep, threat-intelligence-led attack scenarios continuously, helping financial entities and ICT vendors surface real exposures and prioritize true risk between formal testing cycles.

DORA sets the bar for operational resilience. Meeting its requirements consistently is what keeps financial entities ready to defend against the latest incident.

Request a demo to learn more about BreachLock’s DORA-aligned offensive security services.

Frequently Asked Questions about DORA Penetration Testing Requirements

What is DORA penetration testing?

DORA penetration testing refers to the threat-led penetration testing (TLPT) requirements established under the EU’s Digital Operational Resilience Act. TLPT is an intelligence-driven testing method that simulates the tactics, techniques, and procedures of real-world threat actors against an organization’s live production systems. Under DORA Article 26, in-scope financial entities must undergo TLPT at least once every three years to assess their ability to detect, withstand, and recover from sophisticated attacks.

How is TLPT different from traditional penetration testing?

TLPT focuses on simulating realistic, multi-stage adversary behavior against live production systems, while traditional penetration testing typically identifies discrete vulnerabilities in a defined scope, often in non-production environments. Traditional testing answers what is exposed. TLPT answers whether an organization’s detection and response capabilities would actually stop an attacker who has already gained a foothold. DORA requires the latter because it produces a more accurate picture of operational resilience under real conditions.

Which organizations are required to conduct TLPT under DORA?

DORA applies to 21 categories of financial entities operating in the EU, including banks, insurance companies, and investment firms, as well as the ICT third-party providers (CTPPs) that support their critical or important functions. Testing scope extends to outsourced functions, meaning a financial entity’s TLPT program must account for the systems and services its vendors provide, not only its internally managed infrastructure. ICT vendors that cannot demonstrate DORA compliance risk losing contracts with in-scope financial entities.

Should financial entities test only every three years, or more frequently?

DORA’s three-year cycle under Article 26 is a regulatory minimum, not a recommended testing frequency. Because attack surfaces and threat actor techniques change continuously, organizations that test only at the minimum interval risk operating with an outdated picture of their resilience for long stretches between assessments. Continuous, threat-led testing approaches close that gap by validating exposures on an ongoing basis rather than at fixed three-year checkpoints.

Does TLPT replace an organization’s existing vulnerability management program?

TLPT complements rather than replaces vulnerability management. Vulnerability management identifies and tracks known weaknesses across an environment on an ongoing basis, while TLPT validates whether an organization’s people, processes, and technology can actually detect and respond to an adversary exploiting those weaknesses in a realistic attack chain. Organizations need both: vulnerability management to maintain baseline hygiene, and TLPT to verify that detection and response capabilities hold up under simulated real-world pressure.

What should a financial entity look for when selecting a TLPT provider for DORA compliance?

A qualifying TLPT provider must be certified by an accreditation body in an EU member state and able to demonstrate expertise in threat intelligence, penetration testing, and red team testing, as specified in DORA Article 27. Beyond meeting the regulatory minimum, organizations should evaluate whether a provider can test live production systems safely, simulate threat actor behavior specific to the financial sector, and produce documentation suitable for submission to a Competent Authority. Providers offering continuous or AI-enabled validation, rather than only point-in-time engagements, give entities an ongoing view of risk between formal testing cycles.

Author

BreachLock Labs