What is a TLPT provider? A TLPT provider is the external organisation a financial entity engages for one of the two roles in a threat-led penetration test: threat intelligence or red-team testing. DORA and RTS 2025/1190 set minimum requirements for both roles, and the control team must document compliance and present the evidence to the TLPT authority before signing a contract.
The choice of provider determines whether the test ends with an attestation or with a repeat. The fundamentals – who is in scope, phases and deadlines – are covered in TLPT under DORA – how to start.
Canonical definition: A TLPT provider is, under Article 1(11) of Commission Delegated Regulation (EU) 2025/1190, a tester or a threat intelligence provider engaged by a financial entity to carry out threat-led penetration testing.
How to choose a TLPT provider – key takeaways:
- Article 27 of DORA requires testers of the highest suitability, with expertise in threat intelligence, penetration testing and red teaming, certification or a code of conduct, an independent assurance report and professional indemnity insurance.
- Article 7 of RTS 2025/1190 adds detail: a manager with 5 years’ experience, team members with 2 years, 3 references for the TI provider and 5 for testers, and separation of staff between the two roles.
- The threat intelligence provider must always be external; the control team assesses both teams and presents evidence to the authority before contracting (RTS Art. 9(11)).
- Public market compilations (regulation-dora.eu, 2026) put a full TLPT cycle for a mid-to-large EU entity at roughly EUR 140,000-560,000 excluding remediation, with the red team as the largest line.
- The most common red flags are a “TLPT in 6 weeks” proposal, no procedure for detection by the blue team, and a single team performing both TI and red-team roles.
- Patronusec delivers both TLPT roles with separated teams, supplies the full evidence pack required by Article 7 of the RTS, and provides a fixed price after a readiness assessment.
Table of Contents
What is a TLPT provider, and why does DORA distinguish testers from the threat intelligence provider?
DORA distinguishes two provider roles because they need different skills and must remain independent: the threat intelligence provider profiles the adversaries and builds the scenarios, and the testers execute them. If one team did both, scenarios could be shaped around what the red team can do rather than what actually threatens the entity.
Article 1(10) of RTS 2025/1190 defines the threat intelligence provider as experts external to the financial entity and to its intra-group ICT providers, who gather targeted intelligence and develop realistic scenarios. Testers (Article 1(5)) are the red team, internal or external. The difference in status comes from Article 27(2) of DORA: testers may be the entity’s own staff with the authority’s approval, but the threat intelligence provider never.
In a TLPT, the threat intelligence provider is responsible for the targeted threat intelligence report and at least three attack scenarios, while the testers are responsible for the red-team test plan, active testing and the red-team report – both roles are defined in Article 1 of RTS 2025/1190.
This has a direct procurement consequence. You are buying two different products: a TTI report structured to Annex III of the RTS and a 12-week offensive operation with a report structured to Annex V. Even when one firm delivers both, you evaluate them separately – against different criteria, with different references and a different team composition.
Patronusec Insight: In our project experience, entities selecting a TLPT provider start from the red team’s portfolio and treat the TI phase as an add-on. Yet the TTI report is the first document the authority’s test manager approves – if the scenarios are generic, the whole schedule slips. You recognise a good test by TTI actor profiles that reference groups actually targeting the financial sector in your jurisdiction over the past 12-24 months, not a generic APT catalogue. Patronusec runs the threat intelligence phase in a team separated from the testers, as Article 7(1)(e)(v) of the RTS requires, and delivers the report in the Annex III structure from the outset.
What formal requirements do Article 27 DORA and Article 7 RTS impose, and what must you document for the authority?
Before signing, the control team must collect from each TLPT provider a full evidence pack: detailed CVs and certifications, a professional indemnity policy, 3 (TI) or 5 (testers) references, declarations of no conflict of interest and staff separation, and – from Article 27 of DORA – an independent assurance report on the management of test-related risks. Article 9(11) of the RTS requires this evidence to be presented to the test managers before contracting.
The complete set of requirements:
| Requirement | Basis | What you should receive |
|---|---|---|
| Highest suitability and reputability | DORA Art. 27(1)(a) | references, absence of proceedings, company track record |
| Technical and organisational capability; expertise in TI, pentesting and red teaming | DORA Art. 27(1)(b) | methodology, C2 infrastructure, tooling, OPSEC procedures |
| Certification by an accreditation body in a Member State, or adherence to a formal code of conduct / ethical framework | DORA Art. 27(1)(c) | organisational certification (e.g. CREST) or a signed code of conduct |
| Independent assurance or audit report on sound management of TLPT risks | DORA Art. 27(1)(d) | auditor’s report covering protection of confidential information and redress for business risk |
| Professional indemnity insurance, including errors and omissions | DORA Art. 27(1)(e), RTS Art. 7(1)(b) | policy with cover proportionate to scope |
| Individual CVs and certifications | RTS Art. 7(1)(a) | CV of every team member, copies of certificates |
| References | RTS Art. 7(1)(c)-(d) | at least 3 for the TI provider, at least 5 for testers |
| Team composition | RTS Art. 7(1)(e)-(f) | manager ≥5 years, others ≥2 years; TI: at least 2 people; red team: at least 3 |
| No conflict with blue-team tasks | RTS Art. 7(1)(e)(iv), (f)(iv) | declaration that the provider delivers no SOC/IR services to the entity or its ICT providers |
| Separation of TI and red-team staff | RTS Art. 7(1)(e)(v), (f)(v) | project organisation chart, declaration of no reporting line |
| Post-test procedures | RTS Art. 7(1)(g)-(h) | plan for tool removal, C2 deactivation, credential return |
Under Article 9(11) of RTS 2025/1190, the control team may not contract a TLPT provider if the TLPT authority considers that the provider does not meet the requirements of Article 27 DORA or Article 7 of the RTS.
Article 7(2) of the RTS permits an exception: in exceptional circumstances, an entity may engage a provider that fails one of the requirements in points (a)-(f), provided it documents mitigating measures. That is a safety valve for provider scarcity, not a way to lower the bar – the test manager will assess each case individually.
In practice, the request for proposals should explicitly require these 11 items as annexes. A provider delivering TLPT engagements regularly will have them ready; a provider new to this market will ask for time.
One provider or two – when should the TI and red-team roles be combined?
A single provider for both roles is permitted if the threat intelligence and red-team staff are separated and do not report to each other (RTS Art. 7(1)(e)(v) and (f)(v)). The single-provider model shortens coordination and lowers cost; the two-provider model gives stronger scenario independence. Base the decision on the control team’s maturity and the availability of qualified providers.
Decision tree – one or two TLPT providers?
- Does your control team have experience coordinating two independent external teams (from previous TIBER tests or large red-team engagements)?
→ NO: consider one provider with documented team separation; its project manager takes over TI-to-red-team coordination.
→ YES: go to step 2. - Is maximum independence of scenarios from red-team capability a priority (first test, supervisory expectations, board sensitivity)?
→ YES: two providers.
→ NO: go to step 3. - Is there a provider on the market meeting Article 7 for both roles that can evidence a separation structure? → YES: one provider, with a contractual separation clause and the authority’s right to verify.
→ NO: two providers.
Comparison of the two models:
| Criterion | One provider (both roles) | Two providers |
|---|---|---|
| RTS compliance | yes, with staff separation | yes |
| Total cost | typically 10-20 % lower (single project overhead) | higher |
| TI-to-red-team handover | internal to the provider, faster | via the control team, requires handover meetings |
| Scenario independence | depends on genuine team separation | structural |
| Conflict-of-interest risk | requires declarations and an organisation chart | lower |
| Control team workload | lower | higher (two contracts, two schedules) |
A single-provider TLPT model is compliant with RTS 2025/1190 provided the threat intelligence staff and the red-team staff are separated from each other and neither reports to the other.
Unsure which procurement model your control team and your authority will accept?
Patronusec prepares a TLPT procurement model analysis: within 5 working days you receive a recommendation (one or two providers) justified against Article 7 of the RTS, a draft requirements section for your request for proposals, and the list of evidence annexes to demand from bidders.
Request a TLPT procurement model analysis
Which 9 substantive criteria separate a good TLPT provider from one that meets the minimum?
Article 7 of the RTS is the entry threshold; test quality depends on nine criteria the RTS does not measure: financial-sector experience, the ability to sustain a 12-week undetected operation, a detection procedure, reporting the blue team can use, familiarity with the supervisory process, threat intelligence capability for your market, social engineering and physical testing, production risk management, and post-test support.
| # | Criterion | How to verify it in procurement |
|---|---|---|
| 1 | Financial-sector experience | request anonymised descriptions of 3 red-team engagements in banking, payments or insurance from the past 3 years |
| 2 | Long undetected operations | ask about C2 infrastructure, domain rotation, OPSEC rules and the longest operation without detection |
| 3 | Detection procedure | request a written procedure aligned with RTS Art. 11(9): who decides, how the test continues, how confidentiality is preserved |
| 4 | Red-team report usable by the blue team | request an anonymised sample: MITRE ATT&CK mapping, timestamps, IoCs the blue team can replay in its logs |
| 5 | Familiarity with the TLPT authority process | ask how many times the team has attended TTI and test-plan approval meetings with test managers (TIBER or TLPT) |
| 6 | Threat intelligence for your market | request a sample actor profile targeting your national financial sector and the sources used (dark web, leaks, national CERT) |
| 7 | Social engineering and physical penetration | RTS Art. 7(1)(f)(ii) lists these among required skills – ask about ethical boundaries and prior engagements |
| 8 | Production risk management | request the safeguards list: kill switches, time windows, exploit testing in a lab, 24/7 control team contact |
| 9 | Post-test support | ask whether the provider runs the replay and purple teaming and supports the remediation plan under RTS Art. 13 |
A good TLPT provider differs from one meeting the RTS minimum in being able to document its procedure for detection by the blue team and to deliver a report the defensive team can reproduce from its own logs.
Criteria 3 and 4 are the most decisive and the least often checked. Detection of the testers in week 6 is not a failed test – it is a valuable result. But without a procedure for who decides on continuation and how confidentiality is preserved from the wider organisation, the control team loses control and the authority may question the test’s conduct. The same applies to the red-team report: if the blue team cannot reproduce it in its logs, the blue-team report (Annex VI) will be empty and the purple teaming worthless.
Patronusec Insight: Criterion 5 – experience with test managers – is worth reading more broadly than the number of TIBER tests. In our project experience, a provider that understands the supervisor’s and the auditor’s perspective writes differently: it justifies every scenario, documents deviations from the plan and labels every leg-up. Patronusec combines a testing team certified to OSCP, CREST and OSWE with audit experience (QSA status, ISO 27001 audits), so the red-team report has the Annex V structure from the start and the control team does not need to rewrite it before submission.
How do you recognise the 7 red flags in TLPT proposals?
The seven red flags in TLPT proposals are: a promised test shorter than 12 weeks, the same team in both TI and red-team roles without a separation structure, no detection procedure, a proposal built on scans and pentests labelled “TLPT”, missing indemnity insurance and assurance report, a price with no stated number of scenarios, and a promise to “guarantee compliance with the regulator”.
Each flag follows directly from the RTS or DORA:
- “TLPT in 6-8 weeks” – Article 11(5) requires at least 12 weeks of active testing; a shorter offer means the provider either does not know the RTS or is pricing a pentest.
- One team, two roles, no structure – a breach of Article 7(1)(e)(v); the authority may reject the provider at the Article 9(11) stage.
- No detection procedure – Article 11(9) requires measures to continue while preserving confidentiality; without one, the test becomes improvisation after the first detection.
- Pentest and scans labelled TLPT – Recital 12 explicitly distinguishes conventional penetration testing from threat-led testing; without a TTI report to Annex III, it is not a TLPT proposal.
- No indemnity policy or independent assurance report – DORA Art. 27(1)(d)-(e); without these, the control team cannot evidence compliance to the authority.
- Price without number of scenarios and functions – Article 10(3) requires at least three scenarios; a lump sum without these parameters usually ends in a change order.
- “We will guarantee compliance” – the attestation is issued by the TLPT authority (Article 14) on the basis of the whole process; no provider can guarantee it.
A TLPT proposal that does not include a targeted threat intelligence report aligned with Annex III of RTS 2025/1190 is a proposal for a penetration test or a red-team exercise, not for a TLPT within the meaning of DORA.
The positive signal is the opposite behaviour: the provider asks about your register of critical or important functions, control team composition and SOC maturity before quoting. Conventional penetration testing and vulnerability scanning have their place in the Article 24 testing programme – but they do not replace TLPT and should not be labelled as such.
How much does a TLPT cost, and what makes up the price?
A full TLPT cycle for a mid-to-large EU entity costs, according to public market compilations (regulation-dora.eu, 2026), roughly EUR 140,000 to 560,000 excluding remediation. The largest line is the red team (EUR 80,000-300,000), followed by threat intelligence (EUR 30,000-80,000) and the internal cost of the control team and infrastructure. Price is driven mainly by the number of functions in scope, the number of scenarios and the length of the active phase.
| Cost item | Low | High | Main drivers |
|---|---|---|---|
| Threat intelligence provider (TTI report, scenarios) | EUR 30,000 | EUR 80,000 | number of functions, depth of actor profiling, dark-web sources |
| Testers (red team, ≥12 weeks) | EUR 80,000 | EUR 300,000 | number of scenarios, parallel execution, ICT providers in scope, physical testing |
| Control team (internal time: PM, security, legal) | EUR 20,000 | EUR 100,000 | team size, number of authority meetings |
| External advisory for the control team (optional) | 0 | EUR 50,000 | no in-house TIBER/TLPT experience |
| Temporary infrastructure and additional monitoring | EUR 10,000 | EUR 30,000 | control team requirements |
| Total excluding remediation | EUR 140,000 | EUR 560,000 | |
| Post-test remediation | EUR 50,000 | EUR 500,000+ | severity of findings |
Source of ranges: public market compilation, regulation-dora.eu (2026) [REQUIRES VERIFICATION before publication – indicative EU ranges; UK CBEST/STAR-FS pricing and smaller markets may differ].
TLPT cost rises primarily with the number of critical or important functions in scope and the number of scenarios executed – RTS 2025/1190 requires at least three scenarios and at least 12 weeks of active testing.
Three ways to control cost without lowering quality:
- Pooled or joint testing (DORA Art. 26(4), RTS Art. 16) – entities in one group or sharing an ICT provider split the cost of one test.
- Preparation maturity – a current register of functions and ready contracts with ICT providers shorten the preparation phase, which you pay for in control team and adviser time.
- One provider for both roles – with documented separation, this reduces project overhead.
In practice, budget for TLPT 12-18 months before the expected notification, because procurement and the authority’s provider review must fit inside the 6-month preparation phase.
Need a board-ready budget and a price that will not change mid-test?
After a free readiness assessment (10 working days), Patronusec provides a fixed-price TLPT proposal for both roles or one, broken down by RTS phase, with the number of scenarios and a schedule tied to the Article 9-13 deadlines. The price does not increase if the blue team detects the test and the continuation procedure is triggered.
Request a fixed-price TLPT proposal
What questions belong in the request for proposals, and what clauses belong in the TLPT contract?
A TLPT request for proposals should require the 11 evidence annexes from Article 27 DORA and Article 7 RTS, questions on the 9 substantive criteria, and requirements on document structure (Annexes III-V). The contract should govern confidentiality and the code name, staff separation, permitted TTPs, kill switches, post-test procedures, liability and cooperation with the TLPT authority.
Minimum contract clauses:
- Confidentiality and code name – no disclosure beyond the persons listed in RTS Art. 4(2)(a); all references by code name (Art. 4(2)(f)).
- Staff separation – named TI and red-team members, no reporting line, verification rights for the control team and the authority.
- Scope and ethical boundaries – permitted and prohibited TTPs, social engineering limits (Annex IV(b)), and the prohibited actions of Art. 7(1)(i) (equipment destruction, deliberate continuity disruption, out-of-scope systems).
- Risk management – kill switches, time windows, duty to report any unplanned impact, 24/7 contact.
- Reporting – weekly progress reports (Art. 11(7)), red-team report within 4 weeks of the active phase (Art. 12(2)), participation in the replay and purple teaming (Art. 12(5)).
- Post-test procedures – C2 deactivation, backdoor removal, secure deletion of credentials and data (Art. 7(1)(g)-(h)).
- Liability and insurance – indemnity policy as an annex, liability for production damage, in line with DORA Art. 27(3).
- Cooperation with the authority – obligation to attend test manager meetings and to provide documents at the authority’s request.
- Ownership and retention of results – who holds the TTI report and test reports, for how long, with what access.
Under Article 27(3) of DORA, the contract with external testers must ensure sound management of the TLPT results, and the processing of data – including its generation, storage and deletion – must not create risks for the financial entity.
To the questions on the 9 criteria, add three about process: who will lead the team and whether that changes during the 12 weeks, how the provider documents leg-ups and deviations from the plan, and in what form it hands IoCs to the blue team after the test.
Patronusec Insight: The clause entities most often forget concerns changes in team composition. The RTS assesses named individuals (CVs, years of experience), so replacing the red-team manager in week 5 triggers a fresh assessment by the control team and potentially by the authority. In our project experience, it pays to write the named team into the contract, require the control team’s prior consent to any change, and oblige the provider to deliver the replacement’s documents in advance. Patronusec includes the named composition of both teams with its proposal – CVs, certifications and separation declarations – so the control team can assemble the Article 9(11) evidence immediately.
How should you schedule procurement so providers are contracted before the testing phase?
TLPT procurement realistically takes 3-5 months: 2-4 weeks to prepare the request, 4-6 weeks for proposals and clarifications, 2-4 weeks for evaluation and negotiation, and 2-4 weeks to present evidence to the authority and sign. It must fit between approval of the project charter (D + 3 months) and completion of the scope specification (D + 6 months), because Article 9(9) requires providers to be contracted before the testing phase.
Indicative schedule relative to the notification date (D):
| Window | Activity | Notes |
|---|---|---|
| D – 6 to D | market sounding, budget, provider longlist | before notification; do not inform the blue team |
| D to D + 1 month | project charter, decision: one or two providers | model approved by the board |
| D + 1 to D + 2 | request for proposals with 11 evidence annexes and 9-criteria questions | in parallel with the scope specification |
| D + 2 to D + 4 | proposals, Q&A sessions, sample report presentations | scored evaluation |
| D + 4 to D + 5 | compliance assessment against DORA Art. 27 and RTS Art. 7; evidence to test managers | RTS Art. 9(11) |
| D + 5 to D + 6 | contract; scope specification shared with providers (Art. 9(8)) | TI phase starts after the authority approves the scope |
Article 9(9) of RTS 2025/1190 requires the procurement or designation of testers and the threat intelligence provider to be completed before the testing phase begins – in practice within 6 months of the TLPT authority’s notification.
Entities subject to public procurement law or internal tender thresholds should add time for those procedures – the main reason to sound the market before notification. If nobody in the organisation can run this process from a substantive position, a vCISO or an IT Compliance Officer can advise the control team, provided they are separated from the teams under test and from the TLPT providers.
FAQ – how to choose a TLPT provider
Must a TLPT provider hold CREST or a similar certification?
Not explicitly. Article 27(1)(c) of DORA requires certification by an accreditation body in a Member State or adherence to formal codes of conduct or ethical frameworks. Organisational certifications (e.g. CREST) and individual ones (OSCP, OSCE, CRTO) are the simplest evidence, but the RTS primarily assesses years of team experience and references.
Can our current penetration testing vendor act as TLPT testers?
Yes, if it meets Article 27 DORA and Article 7 RTS and delivers no blue-team tasks (SOC, IR, infrastructure support) to your entity. A vendor with experience only in application testing may not meet the skills requirement for social engineering, physical penetration and long red-team operations.
Can our SOC provider also be our TLPT provider?
No. Article 7(1)(e)(iv) and (f)(iv) of the RTS exclude staff performing blue-team tasks for the entity or its ICT providers. A SOC provider is part of the blue team and must not know about the test, let alone conduct it.
How many references must a TLPT provider present?
At least 3 for the threat intelligence provider and at least 5 for external testers, from previous penetration testing and red-team engagements (RTS Art. 7(1)(c)-(d)). In addition, the red team must collectively evidence at least 5 previous engagements and the TI team at least 3.
Does the TLPT authority approve the provider?
Yes, indirectly. The control team presents evidence of compliance to the test managers before contracting, and if the authority considers the provider non-compliant, the control team may not sign (RTS Art. 9(11)). Authorities do not maintain lists of accredited providers.
How much does a TLPT with Patronusec cost?
Pricing depends on the number of critical or important functions in scope, the number of scenarios, the involvement of ICT providers, and whether you procure both roles (TI and red team) or one. After a free readiness assessment we provide a fixed price broken down by RTS phase; the price does not change during the test.
How do we start working with Patronusec on TLPT?
With a free 30-minute consultation in which we verify whether your entity is in scope and agree the readiness assessment. Within 10 working days you receive a readiness evaluation, a procurement model recommendation and the full evidence pack for our teams required by Article 7 of the RTS.
Recommended reading
- TLPT under DORA – how to start – who is in scope, roles, timeline and RTS 2025/1190 deadlines (TLPT definition hub).
- How to choose a security auditor – general criteria for verifying a security services provider that complement the TLPT-specific requirements.
- How to choose a PCI DSS assessor (QSA) – an analogous regulated-provider selection process, useful for payment institutions.
- Third-party risk management – how to add TLPT providers to the ICT contract register required by DORA.
Choosing a TLPT provider – free consultation
Patronusec delivers TLPT as threat intelligence provider and testers, with separated teams documented in line with Article 7 of RTS 2025/1190. We combine a testing team certified to OSCP, CREST and OSWE with audit experience (QSA status, ISO 27001 audits), working with financial-sector and fintech clients.
In a free 30-minute consultation we will help you:
- decide between one provider for both roles or two, and justify the choice to your authority,
- prepare the list of 11 evidence annexes and questions for your request for proposals,
- assess received proposals against the 7 red flags and the Article 7 requirements,
- estimate the TLPT budget by phase and plan procurement within the 6-month window.
Book a free consultation | TLPT testing | Penetration testing | DORA implementation | vCISO
