Threat-Led Penetration Testing

What is Threat-Led Penetration Testing?

The new Digital Operational Resilience Act (DORA) requires significant financial entities in the EU to carry out controlled assessments – ‘Threat-Led Penetration Tests (TLPTs)- of their cyber resiliency on a regular basis. This involves an intelligence-led approach to classic red team testing that target your most critical business systems by mimicking the tactics, techniques and procedures (TTPs) of real-life threat actors. Kroll's intelligence-driven approach to TLPTs combines cutting-edge methodologies and real-world attack simulations to assess your resilience against adversaries.

What Are the Key Requirements Under the DORA Regulation?

• Articles 25-27 stipulate that TLTPs take place against IT assets:  
  • Supporting ‘critical or important functions’ of a financial entity (including third party systems if/as appropriate).
  • Using real world TTPs obtained via tailored Threat Intelligence Analysis.
  • To proactively identify - and allow entities to swiftly mitigate/remediate - any weaknesses, deficiencies or gaps in their implementation of controls and counteractive measures.
• TLPTs must be performed at least every 3 years if your organisation is deemed in scope by the supervising authorities.
• TLPTs for DORA should be followed in accordance with the pre-existing TIBER-EU framework, with some additional considerations and aspects now also formalised and included in DORA e.g. purple team exercises are now mandatory. 

Why Kroll?

• Real-World Threat Intelligence
  With over 150,000 hours of offensive security engagements annually, Kroll leverages real-world insights from advanced adversaries, ensuring your defenses are tested against the latest TTPs observed globally.
• Regulatory Expertise
  Kroll ensures compliance with critical frameworks like DORA and TIBER-EU by delivering structured, auditable reports and evidence tailored to meet regulatory standards.
• Tailored Testing Scenarios
  Every engagement is customized to align with your unique risk landscape, critical assets, and business objectives, providing actionable and prioritized insights.
• Comprehensive Reporting
  Our detailed reports include root cause analysis, MITRE ATT&CK mappings, and prioritized remediation strategies to empower effective vulnerability management.
• Collaborative Approach
  Replay sessions and purple team workshops foster collaboration between your teams and our experts, enhancing detection and response capabilities while strengthening overall defenses.