Security & privacy · DORA Penetration Testing
DORA resilience testing for EU finance and its ICT providers
Penetration testing, source code review and scenario-based testing for your DORA testing programme, plus the evidence ICT providers need when banks and insurers ask.
Does DORA require penetration testing?
Yes, as part of a testing programme. DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025. Article 24 requires financial entities, other than microenterprises, to test all ICT systems and applications supporting critical or important functions at least yearly, and Article 25 lists penetration tests, vulnerability assessments, source code reviews and scenario-based tests among the tests that programme should include.
Last reviewed by the Mighty Infosec team. This page is guidance, not legal advice.
Regulation (EU) 2022/2554
What DORA asks for
Article 24
A risk-based digital operational resilience testing programme, with critical systems tested at least yearly by independent testers.
Article 25
Tests including vulnerability assessments, open source analyses, network security assessments, source code reviews, scenario-based tests and penetration testing.
Article 26
Threat-led penetration testing (TLPT) at least every three years for entities designated by their competent authority.
Articles 28 to 30
ICT third-party risk. Financial entities must manage risk from their ICT providers, so software vendors are asked for testing evidence.
How we help
AI-native testing, verified by experts
Article 25 test programme
Application, API, cloud and network penetration testing plus source code review, scoped to your critical or important functions.
Scenario-based testing
Red team style scenarios that test detection and response, not only vulnerabilities.
Prepare for TLPT
TLPT is a regulator-led exercise with its own tester requirements under Article 27. Our testing and red teaming help you find and fix issues before it starts.
Evidence for vendors
If you sell software to EU banks or insurers, we give you the testing evidence their DORA third-party risk teams ask for.
What you receive
- Report mapped to DORA Article 25 test types
- Risk ratings aligned to critical or important functions
- Remediation plan and retest evidence
- Vendor-ready summary for financial entity customers
FAQ
DORA Penetration Testing questions
We are a SaaS vendor, not a bank. Does DORA affect us?
Often, yes. Financial entities must manage ICT third-party risk under DORA, so they ask vendors for security testing evidence and contract terms. Critical ICT providers designated by the European Supervisory Authorities face direct oversight.
Do you perform TLPT?
TLPT follows specific rules set by the regulation and the TIBER-EU framework, including tester requirements in Article 27. We focus on the Article 25 testing programme and on preparing you for TLPT.
Can you test from outside the EU?
Yes. We test remotely and agree data handling and location terms with you before testing starts.
Services
Services behind this engagement
Web Application Pentesting
AI-native, expert-verified testing of your web apps, from auth bypass to business-logic abuse.
Secure Code Review
AI-assisted, expert-led source code auditing that catches deep logic flaws, auth bypasses, and injection risks before deployment.
Red Teaming
Objective-based adversary simulation that tests people, process and technology.
Talk to us about DORA Penetration Testing
Tell us what you're building. In a free 30-minute scoping call we'll map your risks and recommend the right engagement, whether you need a pentest, a threat model or an AI security review.