According to the first observations published by European regulators on DORA compliance, 94% of financial entities in scope have established their ICT risk management policy and kept an incident register. Fewer than 12% have carried out a threat-led penetration test (TLPT) compliant with the TIBER-EU framework. This gap does not reflect a problem of prioritisation: it reveals a structural misunderstanding of what DORA actually expects from advanced testing programmes. What the first European TLPTs reveal is consistently telling: documentary compliance and real operational resilience do not measure the same thing.
DORA distinguishes two categories of tests, and most organisations master only the first
DORA structures operational resilience testing obligations around two distinct levels. Article 25 imposes "general" tests on all entities in scope: vulnerability assessment reviews, network security scans, business impact analyses, continuity and recovery tests. These tests verify that documented controls exist and work under normal conditions. Article 26 imposes advanced tests, including the TLPT, on entities of significant importance, designated by the competent authorities on the basis of an assessment of their systemic risk profile.
In France, the ACPR (French prudential supervisor) published the TLPT designation criteria in 2025. The entities concerned are mainly credit and investment institutions of significant importance, central securities depositories and market infrastructures, with a possible extension to entities presenting critical ICT interconnections with these players. The ECB, the direct authority for the 113 significant institutions under its direct supervision, has integrated the TLPT into its 2025-2026 supervisory programme.
But the issue goes beyond the strict regulatory scope. The TLPT reveals a structural tension that every GRC team must understand: the difference between a documented control and an operational capability. And the results of the first TLPTs now allow this tension to be mapped with a precision that documentary audits cannot reach.
What adversarial tests reveal where audits do not look
A TIBER-EU compliant TLPT is not an improved penetration test. It is an exercise built from threat intelligence on real threats, produced specifically for the entity being tested, simulating the tactics, techniques and procedures (TTPs) of threat actor groups that actually target the European financial sector. The Red Team operates under the same constraints as a real attacker: it has no access to internal procedures, and it must get past the real controls, not their documented representations.
Three observations dominate in the aggregated TLPT reports published by TIBER-EU and national regulators.
SIEM detection fails on slow attacks. The large majority of multi-stage infiltration scenarios lasting more than 72 hours trigger no alert in SIEMs configured with rules geared to speed of execution: brute force, rapid lateral movement, mass exfiltration. State-sponsored actors, the reference threat profile in TIBER-EU threat intelligence for critical financial entities, operate slowly and methodically. A service account that queries unusual databases at atypical hours, gradually, over several weeks, triggers no alert if a behavioural baseline has not been defined.
IR playbooks do not cover real incidents. The incident scenarios described in playbooks rarely match the structure of the sophisticated attacks observed during TLPTs. The operational question during an incident is not "which playbook should we activate?" It is "at what stage of compromise are we?" Containment, forensic investigation and recovery are three different sequences of actions that cannot be run simultaneously with the same resources. Most tested entities had not operationalised this distinction.
Communication to management and the regulator is not operational. When the Red Team triggers a scenario with visible impact, such as the unavailability of a payment service or the exfiltration of customer data, the process for communicating to the executive committee and the regulator does not trigger within regulatory deadlines. NIS2 requires notification within 24 hours, and DORA within similar timeframes. The notification decision must be possible at 3 a.m., without the incumbent CISO, within 30 minutes. In most tested organisations, this decision involves more than two levels of approval.
The paradox of documentary compliance
What makes TLPT results structurally useful for non-designated organisations is that they reveal a systemic gap that the DORA documentary compliance audit cannot detect.
A classic compliance audit, internal or carried out by a provider, validates documentary evidence: the ICT policy exists, the incident register is kept, supplier contracts include the Article 28 clauses. These first-level controls are essential and necessary. But they do not answer the central question the TLPT poses: will your detection and response capabilities hold up under the conditions of a sophisticated, prolonged attack?
Network segmentation documented in policies is not always the segmentation actually in effect. Configuration drift (undocumented operational changes, firewall rules not reviewed, temporary exceptions that became permanent) creates attack paths that are invisible to a documentary audit but immediately visible to a Red Team. This observation appears in around 65% of TLPT reports conducted on European entities in 2025-2026.
What organisations whose TLPTs yield solid results do
Organisations that obtain operationally solid TLPT results, not perfect ones but with identified and addressable gaps, share three distinctive practices.
They treat the TLPT as a calibration tool, not a compliance exam. The difference in mindset is fundamental. They run regular internal adversarial exercises, purple teaming, in the 12 months before the TLPT, which progressively calibrates their detection against real TTPs. Organisations that treat the TLPT as an audit to prepare for do not build capability: they produce documentation.
They have a documented behavioural baseline for each critical ICT service. For each critical system, they have formalised what constitutes normal behaviour: typical network flows, usage time windows, data access patterns. This baseline is not a technology deliverable. It is the result of an explicit governance decision: who is responsible for defining and maintaining the normal behaviour of this service, and at what review frequency.
IR communication is exercised quarterly as a decision under uncertainty. Not as a business continuity plan test, but as an exercise in which teams receive an incomplete scenario, are timed on the notification decision, and analyse gaps in their reasoning under pressure. Organisations that have never subjected their IR decision chain to a timed exercise consistently discover, during the TLPT, that the notification decision is structurally at risk.
Assessing your exposure: three indicators
The TLPT is not necessarily within your immediate regulatory scope. But the gaps it reveals (no behavioural baseline, non-operational playbooks, IR communication never exercised) are present in nearly every organisation that has never put its operational resilience to a real adversarial test.
Three questions help you gauge your exposure without waiting for a TLPT designation.
Do you have a documented behavioural baseline for your critical ICT systems? An inventory of "what is normal" for each service, maintained by an identified owner? If the answer is no, your SIEM detects blatant anomalies, not slow intrusions.
Did your most recent IR exercise include a long-duration compromise scenario (more than 30 days of attacker presence before discovery)? If not, your IR plan has never been tested under the conditions most common in real significant incidents.
Can the regulatory notification decision be taken within 30 minutes, without the incumbent CISO, at any hour? If the answer requires more than two levels of approval, your notification deadline is structurally at risk under NIS2 and DORA.
Presidio centralises incident qualification, NIS2/DORA notification templates, and traceability of IR decisions for the audit trail: contact our team for a 30-minute diagnostic. Also read: DORA at 18 months: persistent gaps in ICT governance.
Conclusion
DORA TLPT reveals what documentary audits do not measure: the difference between a detection policy and an effective detection capability; between an archived playbook and a team able to qualify an incident under pressure; between a notification obligation and a decision that can be taken within 30 minutes at 3 a.m.
Three takeaways for your GRC programme: your SIEM probably does not detect slow attacks, so calibrate your detection rules on real adversarial TTPs, not on documentary scenarios. Your playbooks are working hypotheses, not capabilities: capabilities are built through timed exercises. And IR communication is a decision-making skill under uncertainty: it is trained, not archived. The organisations that progress fastest are those that treat operational resilience as an organisational capability to practise, not as a set of documents to produce.