Threat-led adversarial testing for DORA, TIBER-EU, CBEST, and the next wave of regulatory cyber mandates.

DORA TLPT (Threat-Led Penetration Testing) is a mandatory advanced testing regime under the EU's Digital Operational Resilience Act for in-scope financial entities. It is required at least once every three years and must be performed against live production systems by an external provider meeting the criteria in Articles 26 and 27 of DORA and the related Regulatory Technical Standards. Scope includes credit institutions, payment institutions, investment firms, crypto-asset service providers, and certain critical ICT third-party providers above defined thresholds.

Yes. Bluefire delivers TLPT engagements aligned to the EBA Regulatory Technical Standards under DORA, the TIBER-EU framework published by the European Central Bank, and CBEST methodology defined by the Bank of England. Our delivery teams include CREST-aligned operators, dedicated threat intelligence analysts, and senior offensive security practitioners with hands-on experience in regulated financial environments. We are happy to provide credentials, references, and qualifications documentation under NDA during scoping.

Yes. Live ransomware simulation is delivered under a controlled engagement protocol with named scope, pre-agreed kill switches, real-time SOC notification gates, and full reversibility. We use custom-developed simulation tooling that replicates ransomware behaviors — encryption staging, lateral movement, exfiltration patterns, command-and-control infrastructure — without deploying actual ransomware payloads or causing data loss. Every action is logged, monitored, and reversible. The engagement protocol is jointly designed with your team during scoping.

Standard penetration testing is checklist-driven, scope-bounded, and largely vulnerability-focused. Threat-led testing starts with bespoke threat intelligence — your industry, geography, and adversary set — and runs adversarial campaigns aligned to the specific TTPs of threat actors who actually target your sector. It is the engagement model required by DORA, TIBER, CBEST, and iCAST. Standard pen tests are still appropriate for application-layer assurance and are available outside this program; threat-led testing is what regulators now require for operational resilience evidence.

Yes. Every engagement produces a regulator-ready evidence package mapped to the specific control objectives of your framework — including the TLPT Initiation Document, Threat Intelligence Report, Red Team Test Report, and Remediation Plan required by DORA RTS, and the equivalent artifacts required by TIBER-EU, CBEST, iCAST, and other supervisory regimes. We support your team through the submission and supervisor review process.

The Resilience program is structured as a 12 to 24-month engagement aligned to your regulatory testing cycle. DORA TLPT requires testing at least once every three years; many institutions choose continuous engagement with annual full-scope tests and quarterly intermediate exercises (assumed-breach scenarios, ransomware tabletops, physical operations) to maintain a permanent state of readiness rather than scrambling for a three-year deadline.

Bluefire operates under the standard White Team / Blue Team / Red Team structure required by TIBER and DORA. Your designated White Team has full visibility into the engagement; your Blue Team does not (this is what makes it a test). Throughout the engagement, the White Team can pause, redirect, or terminate operations. After the test, we run a joint Red Team / Blue Team replay session to walk through every action, every detection opportunity, and every gap — the most valuable part of the engagement for most clients.

Yes. While DORA / TIBER / CBEST are financial-services-focused, the same threat-led methodology applies to NERC CIP-regulated electric utilities, IEC 62443-regulated industrial environments, and HIPAA-covered healthcare entities. Engagements are tailored to the operational technology constraints, safety requirements, and regulatory expectations of each sector — and delivered by operators with sector-specific experience.