1.06Security testing
DORA Threat-Led Penetration Testing
Controlled, intelligence-led testing of live production systems for financial entities designated for TLPT under DORA Article 26, following the applicable regulatory technical standards and TIBER-EU guidance.
DORA has applied since 17 January 2025. Financial entities identified by the competent authority under Article 26 must perform TLPT at least every three years, unless the authority adjusts the frequency based on risk and operational circumstances. The test covers critical or important functions and the live production systems that support them.
We can act as the red-team testing provider and coordinate with the entity’s control team, the competent authority and a separate threat-intelligence provider where required. Provider roles, independence, qualifications, insurance and contractual controls are agreed in accordance with the applicable rules.
The engagement includes preparation and scoping, threat-intelligence-led scenarios, controlled red-team testing, closure activities including purple teaming, and the reports and attestation required for supervisory review.
- 8 Jul 2025
- TLPT RTS directly applicable (Reg. (EU) 2025/1190)
- Article 26
- DORA advanced testing requirement
How it works
- 01
Preparation & scoping
Confirm TLPT applicability, identify critical or important functions, and agree the scope specification and rules of engagement with the authority and test control team.
- 02
Threat intelligence
A separate threat-intelligence provider builds a targeted threat profile and attack scenarios grounded in real adversaries facing your institution.
- 03
Red team execution
Covert, intelligence-led testing against live production over a multi-week active phase, with control flags and continuous risk management while the blue team stays unaware.
- 04
Purple-team replay
Mandatory closure phase replaying scenarios alongside your defenders to validate detections, tune response and capture residual risk.
- 05
Reporting & attestation
Prepare the prescribed test summary and remediation evidence for submission to the TLPT authority; the authority issues the attestation where requirements are met.
Packages
- Red Team Provider
- We run the red-team leg against an externally supplied threat-intelligence brief, with purple-team closure.
- TLPT End-to-EndPopular
- Full TIBER-EU-aligned engagement with threat intelligence, controlled live-system red-team testing and the required purple-team replay.
- Pooled & Programme
- Pooled TLPT for shared infrastructure and recurring three-year cycles coordinated with your authority.
Frequently asked questions
What clients say about working with us
Fintech“Partnering with OffSeq on a red team engagement gave us a genuine adversarial perspective that went well beyond a traditional penetration test.”
Oskars Zīle
CISO · Eleving Group
SaaS“Instead of slowing us down, they seamlessly integrate with our fast-moving engineering team, providing proactive, high-level insights that let us fortify our systems in real time as we grow.”
Karlis Broders
CTO · Trace.Space
E-commerce“Their structured methodology, clear communication, and actionable insights directly contributed to increased system reliability, scalability, and resilience.”
Oskars Podziņš
Head of Information Security · Printful
All services
Security Audits
Identify exploitable weaknesses and prioritise remediation.
Red Team & Adversary Emulation
Test whether the organisation can prevent, detect and respond to a goal-driven attack.
Social Engineering Assessment
Measure resilience to phishing, voice fraud and other social-engineering techniques.
Scope a test
[email protected]+371 2256 5353
Direct access to a senior specialist · Reply within 24 hours · NDA available on request