PROFESSIONALLY EVIL EDUCATIONAL RESOURCE
Threat-Led Penetration Testing
(TLPT)
Learn what threat-led penetration testing involves, how it differs from a standard pentest, and what your organization needs to know about TLPT requirements.
What is Threat-Led Penetration Testing?
Threat-led penetration testing (TLPT) is a targeted security assessment that simulates the Tactics, Techniques, and Procedures (TTP) of real threat actors most likely to target your organization. Rather than following a regular process or checklist, TLPT is built around specific threat intelligence relevant to your industry, geography, and risk profile.
The goal is not just finding vulnerabilities. Testers will work to demonstrate how a sophisticated adversary could chain vulnerabilities together to compromise your environment, access sensitive data, or disrupt operations. TLPT tests your technology, your processes, and your people under conditions designed to simulate a real attack.
In practical terms, TLPT is a full-scale red team exercise guided by current threat intelligence, conducted against your live production environment, with most of your organization unaware that a test is even happening.
Fill out the form to get more information on how Secure Ideas can help your organization with TLPT.
Get a Quote for Expert Threat-Led Penetration Testing
Fill out the form below and we’ll be in touch.
Security Engineer
Software & SaaS
1 Credit = Up to 1 Full Day of Expert Work
Purchase credits ahead of time, and arrange testing as you need it. Partnership-based security testing on your schedule. One credit gets you up to one full day of expert work from consultants who understand your business. Engage our team as needed with complete flexibility.
Ongoing advisory services included for no extra charge. No rigid scopes, real-time collaboration, and engagement tailored to your priorities.
Exclusively from Secure Ideas.
TLPT vs. Traditional Penetration Testing
TLPT and traditional pentesting serve different purposes, and operate at different scales. Neither replaces the other. Understanding the difference helps understand which solution works best for you.
| Traditional Pentest | Threat-Led Pentest |
|---|---|
| ScopeSpecific system or application | Entire organization: tech, processes, people |
| IntelligenceDefined methodology, known scope | Built on threat intelligence specific to your threats, geography, and potential threat actors |
| AwarenessKey stakeholders are aware | Most of the organization does not know, only the control team is notified |
| DurationDays to weeks | Three to four months across full lifecycle |
| OutcomeFindings report with remediation | Findings report, detection assessment, purple team debrief, and potential attestation |
Looking for focused security testing?
Schedule a free scoping call to discover your cybersecurity needs ›
The Regulatory Landscape
TLPT did not emerge in a vacuum. Many regulators worldwide are moving away from an “annual pentest” model toward continuous and intelligence-driven security validation approaches. Understanding where this trend is heading helps organizations stay ahead of compliance requirements rather than scrambling to catch up.
DORA and the EU
The most formalized TLPT requirement comes from the EU’s Digital Operational Resilience Act (DORA), which took effect on January 17, 2025. DORA requires certain financial entities to conduct TLPT at least every three years. The regulatory technical standards for TLPT, published on June 18, 2025, became directly applicable across all EU member states on July 8, 2025. These standards were developed in accordance with the TIBER-EU framework and include requirements for mandatory purple teaming, external threat intelligence providers, and formal attestation from supervising authorities.
If your organization has EU operations, serves EU customers, or provides Information and Communication Technology (ICT) services to EU financial entities, DORA’s TLPT requirements may apply to you directly, even if you are a US-based company.
Key DORA TLPT Requirements
- TLPT must be performed at least every three years, or more frequently if the supervising authority requires it.
- Testing must be conducted on live production systems against critical functions.
- The threat intelligence provider must always be external, even if internal testers are used for the red team.
- When using internal testers, every third test must be conducted by an external red team.
- Purple teaming is mandatory during the closure phase.
- The supervising authority may issue a formal attestation confirming the TLPT was performed according to requirements.
The US Is Heading in the Same Direction
DORA is worth understanding not because every US organization is subject to it, but because it represents where the industry is going. The organizations that adopt threat-led, continuous testing practices now will be ahead of the curve when similar requirements arrive domestically.
Even if DORA does not apply to your organization today, it represents a regulatory trend that is already showing up in US frameworks. For example, PCI DSS 4.0 is pushing the payment card industry toward continuous security validation rather than point-in-time annual assessments. GLBA expectations for financial institutions continue to tighten, with examiners increasingly asking for evidence of ongoing testing programs. HIPAA security rule enforcement is placing greater emphasis on regular, meaningful security validation for healthcare organizations. And cyber insurance underwriters are asking more detailed questions about testing frequency, methodology, and continuous monitoring.
CONTINUOUS TESTING
Who Needs TLPT?
DORA requires TLPT for financial entities whose failure could have systemic effects, and organizations that are most likely to be targeted by sophisticated threat actors. Specifically:
- Credit institutions identified as globally or otherwise systemically important
- Payment institutions and electronic money institutions meeting certain thresholds
- Central securities depositories and central counterparties
- Trading venues and certain investment firms
- Insurance and reinsurance undertakings meeting significance criteria
- Crypto-asset service providers meeting significance criteria
- ICT third-party service providers supporting critical functions for in-scope entities
However, even if your organization is not currently mandated to perform TLPT, the exercise is valuable for any organization with a mature security program that wants to understand how they would fare against a targeted, intelligence-driven attack. Organizations with high-value assets, regulatory scrutiny, or complex supply chains benefit the most.
How TLPT Works
TLPT engagements are designed based on specific threat intelligence relevant to your industry, geography, and risk profile. Outside of a control group within your organization, the rest of your security team does not know testing is happening, allowing the testers to simulate real-world attacks.
While these tests do not follow a standardized checklist or process, there is a lifecycle that these engagements tend to follow:
The Testing Lifecycle
Phase 1: Preparation
Your organization forms a control team, a small group made up of the only people aware that the test is scheduled to take place. The control team coordinates with the testing providers and the supervising authority, defines the scope, establishes communication protocols, and ensures all legal and operational safeguards are in place.
Phase 2: Threat Intelligence
An external threat intelligence provider researches the specific threat actors most relevant to the organization. This includes analyzing the threat landscape, identifying likely attack vectors, and developing realistic attack scenarios based on the TTPs of those threat actors. The output is a targeted threat intelligence report that serves as the blueprint for the red team section of the engagement.
Phase 3: Red Team Execution
The red team conducts the simulated attack against the organization’s live production systems. This phase can last several weeks to months, depending on how the engagement is structured. During this time, the red team operates covertly, attempting to achieve the objectives defined in the threat intelligence scenarios without the blue team’s knowledge. The testers evaluate not just technical vulnerabilities but also the organization’s detection, response, and escalation capabilities.
Phase 4: Purple Teaming and Closure
After the red team phase concludes, a mandatory purple teaming exercise brings the red team and the company’s existing blue team together. The red team reveals what they did, how they did it, and what they found. The blue team shares what they detected and what they missed. This collaborative phase is where the most learning happens.
Phase 5: Remediation and Reporting
The control team coordinates the remediation of identified issues, produces a final TLPT report, and works with the supervising authority toward formal closure. If requirements are met, the authority may issue an attestation.
An evaluation of your security program against the PCI Data Security Standard, covering PCI security assessments, self-assessment support, and advising on scope, applicability, and controls. You get direct access to a Qualified Security Assessor who speaks plainly and knows the standard inside and out.
Led by the “PCI Guy” himself – Jeff Man.
How Secure Ideas Approaches TLPT
Every organization faces unique threats. Our approach to TLPT starts with understanding yours.
We work closely with your control team to identify the most relevant threat actors and attack scenarios for your organization. Our consultants build bespoke testing approaches based on real threat intelligence, rather than generic playbooks. Throughout the engagement, we maintain clear communication with your control team while preserving the operational secrecy that makes TLPT effective.
Our reporting goes beyond listing findings. We provide context on how vulnerabilities were chained together, what their real-world impact would be, and practical remediation steps your team can act on. During the purple teaming phase, we also collaborate with your defenders to ensure that the lessons gained from the exercise translate into measurable security improvements.
Secure Ideas is CREST-accredited and brings decades of hands-on experience in penetration testing, red teaming, and adversary simulation across multiple industries including financial services, healthcare, energy, and technology.
Beyond the Test
Building Continuous Resilience
TLPT is a powerful exercise, but it happens once every three years. The threats facing your organization do not pause between tests. While lessons learned from the TLPT can inform your ongoing security practices, changes to your environment may introduce vulnerabilities that your security team does not yet know about.
Building true resilience requires ongoing security testing and advisory support between TLPT cycles. Regular penetration testing of applications, networks, and infrastructure ensures that new vulnerabilities are caught as your environment changes. Advisory services provide guidance on remediation priorities, architectural decisions, and emerging threats.
This is exactly what continuous pentesting solutions, like Secure Ideas’ PETaaS® (Professionally Evil Testing as a Service), are designed for. PETaaS® provides continuous, human-led penetration testing through a flexible credits-based model, with built-in advisory services and real-time communication. Between TLPT cycles, PETaaS® keeps your testing program active and your team informed.
Think of TLPT as the comprehensive stress test that happens periodically. PETaaS® is the ongoing fitness program that keeps your defenses strong in between.
TLPT
Frequently
Asked
Questions
Have a question that isn’t answered here?
See our full FAQ page.
What does TLPT stand for?
Threat-Led Penetration Testing. TLPT is a structured, intelligence-driven security assessment that simulates real-world attacks against an organization’s live production systems. Rather than following a standardized testing process, TLPT engagements start with threat intelligence reports relevant to an organization’s industry, maturity, geography, and specific threat landscape.
Is TLPT required by law?
For certain financial entities under the EU’s Digital Operational Resilience Act (DORA), yes. DORA requires qualifying entities to perform TLPT at least every three years.
Organizations outside of the EU that provide service to EU residents, operate in the EU, or provide ICT services to EU entities may also be subject to DORA and its TLPT requirements. Consult a legal expert to determine whether it applies to your organization.
While there is no current US law requiring TLPT, regulations may shift in the future toward more continuous and threat-let pentesting practices.
How is TLPT different from a regular pentest?
TLPT engagements are driven by specific threat intelligence, and has a broader scope, as it covers the entire organization. Testing is conducted covertly (except for a control group in the organization), and includes mandatory purple teaming.
Traditional pentesting focuses on specific systems or applications, based on a pre-determined scope. Stakeholders are aware of the test, and no purple team component is required.
How long does a TLPT take?
The full lifecycle, from preparation through remediation, can span several months. The red team execution phase alone can take three to four months.
By contrast, a typical pentest engagement lasts from a few days to two weeks.
Can internal teams perform TLPT?
Under DORA, yes, with conditions. The threat intelligence provider must be external to the company, and internal testers must meet qualification requirements. Additionally,every third TLPT cycle must use an external red team.
What is the relationship between TLPT and TIBER-EU?
DORA’s TLPT requirements were developed in accordance with the TIBER-EU framework. The two have been aligned, and in practice TIBER-EU can be used to fulfill DORA TLPT requirements.
Does Secure Ideas perform TLPT?
Yes. Our team has extensive experience in red teaming and adversary simulation. We work with organizations to plan and execute TLPT engagements tailored to their specific threat landscape and regulatory requirements.
Read More About The Difference Between Web App and API Pentests Here ›
What happens after the TLPT?
The red team testesr work with the company’s blue team to conduct a purple teaming exercise. The control team coordinates remediations, and a final report is produced. The supervising authority may issue a formal attestation.
Can we see a sample report from a Penetration Test?
Absolutely. Any reputable penetration testing company should provide sample reports upon request. Reports are your primary deliverable and should include an executive summary, testing narrative, detailed findings with risk ratings, replication steps for verification, and actionable remediation recommendations. Not all reports are created equal, so reviewing samples helps ensure the format and content meet your needs. Most companies will accommodate reasonable modifications to reporting formats.
What is Professionally Evil Testing as a Service (PETaaS®)?
PETaaS® is on-demand pentesting services, which provides you with continuous access to our penetration testing expertise rather than a one-time assessment. This approach offers on-demand or scheduled testing, which integrates with your software development lifecycle, and delivers regular vulnerability analysis with ongoing support. While it may initially appear more expensive than traditional testing, PETaaS® is significantly more cost-effective than hiring full-time security staff and provides proactive, real-time vulnerability identification.
Note: The industry lacks a standard definition for penetration testing as a service, so verify that your provider’s approach aligns with your expectations.
Other Pentesting Approaches
Continuous Penetration Testing
Continuous Pentesting keeps testing running instead of leaving your network exposed between annual checkups. We pair ongoing vulnerability scanning with a real consultant reviewing the results, and catching new risks as they appear across web apps, APIs, and IoT ecosystems. Regular reporting means you always know what’s new, what has changed, and where to point the roadmap next.
Security that doesn’t wait for next year’s test.
Purple Team Penetration Testing
Purple Team Pentesting engagements put our red team and your blue team on the same call, testing and defending in real time. As we run attacks, your team watches, tunes detection, and learns what an actual intrusion might look like on your systems. It’s a faster way to validate specific controls and walk away with sharper monitoring.
Your defenders, tested and trained at the same time.
Red Team Penetration Testing
Red Team Pentesting engagements go beyond finding vulnerabilities. Our consultants simulate a determined adversary, and chain together recon, phishing, and physical access attempts to show how far a real attacker could get and what they could walk away with. Most engagements wrap up in a month or less, with reporting delivered within a week.
See your whole attack surface the way an attacker does.
Ride Along Penetration Testing
Ride Along Pentesting embeds our consultants directly with your internal security team, working side-by-side instead of independently. Your team gets a front-row seat to our techniques and methodology, letting them pick up skills in real time as the engagement unfolds. It’s a hands-on way to level up your team while still getting a full assessment.
Testing that trains your team while it runs.
Time-Boxed Penetration Testing
Time-Boxed Pentesting focuses effort on your highest-priority assets within a set window, instead of trying to cover everything at once. It’s a strong fit for large environments, budget-conscious teams, or anyone just getting started with testing. We work to set the scope through a quick scoping call, so the timeframe fits your risk profile, instead of a generic template.
Focused coverage, built to fit your timeline.
Recognized authority and trusted guidance built on years of uncovering risks for organizations like yours.
