The intelligence phase sets the test.
Independent targeted threat intelligence for DORA threat-led penetration testing (TLPT), TIBER-EU and iCAST. We’ve delivered the intelligence phase of regulated threat-led tests — and we produce the scenarios that make a red team exercise realistic, defensible and worth the investment.
A red team test is only as realistic as the intelligence behind it.
Threat-led testing exists to answer one question: could the attackers most likely to target you compromise the functions that matter most? The answer depends on getting the intelligence right.
Weak intelligence produces generic scenarios, wasted red-team weeks and findings that don’t reflect real risk. Strong intelligence gives your control team, red team and authority a shared, evidenced picture of who would attack, why, and how — and turns that into scenarios that can actually be executed.
That is the work we specialise in. As an independent threat intelligence provider, we sit alongside — not inside — the red team, so there is no conflict between the people defining the threat and the people emulating it.
Delivered against the frameworks regulators use.
We have delivered threat intelligence for TIBER-EU, DORA TLPT and iCAST engagements, and apply the same rigour to threat-led testing outside a formal scheme.
DORA TLPT
The Digital Operational Resilience Act requires financial entities identified by their competent authority to carry out threat-led penetration testing on live production systems supporting critical or important functions — at least every three years.
Detailed requirements are set out in the joint regulatory technical standards (RTS) on TLPT, which follow the TIBER-EU model. ICT third-party providers can be brought into scope, including through pooled testing.
TIBER-EU
The European framework for threat intelligence-based ethical red teaming, adopted nationally as TIBER-NL, TIBER-DE, TIBER-BE, TIBER-DK and others.
The 2025 update aligned TIBER-EU with the DORA TLPT RTS, so a test run under TIBER-EU can be designed to meet DORA requirements — with a structured preparation, testing and closure process overseen by the authority’s test managers.
TIBER-EU threat intelligenceiCAST
The Hong Kong Monetary Authority’s Intelligence-led Cyber Attack Simulation Testing, part of the Cyber Resilience Assessment Framework under the Cybersecurity Fortification Initiative.
The depth of intelligence required scales with an institution’s inherent risk — from sector-level intelligence through to institution-specific targeting and scenarios.
iCAST threat intelligenceNot in scope of a formal scheme? The same methodology underpins our threat-led red team scenario work and TLPT readiness assessments.
Your threat intelligence provider across the whole test.
Formal threat-led tests run in three phases. Our core deliverable sits in the testing phase, but we contribute from preparation through to closure.
Preparation
- Support scoping of critical or important functions
- Kick-off with the control team and authority
- Agree intelligence requirements, timelines and secure communications
- Confirm independence and conflict-of-interest arrangements
Testing — threat intelligence
- Collection and analysis against the agreed scope
- Digital footprint, threat actor profiling and targeting
- Scenario workshop with control team, red team and authority
- Targeted Threat Intelligence Report delivered and briefed
- Handoff to the red team for test planning
Red team testing & closure
- Intelligence support and updates during the red team phase
- Answer requests for intelligence as the test evolves
- Contribute to replay and purple teaming
- Lessons learned for your threat intelligence and detection programme
Inside a Targeted Threat Intelligence Report.
Written for three audiences at once: an authority that needs to see rigour, a red team that needs executable scenarios, and a board that needs to understand the risk.
Executive summary
The threat picture, the most credible scenarios and what they mean for the business — in plain English.
Scope and critical functions
The critical or important functions in scope and the people, processes and systems that support them.
Digital footprint
What an attacker can learn about you: organisational, human and technical exposure, including key suppliers.
Threat landscape
The threats facing your sector and organisation, building on generic threat landscape reporting where available.
Threat actor profiles
Relevant actors assessed for intent, capability and likely targeting, with behaviour mapped to MITRE ATT&CK.
Threat scenarios
Realistic, end-to-end attack scenarios against the functions in scope, with objectives, attack paths, flags and considerations for leg-ups.
Sources, confidence and gaps
How each judgement was reached, how confident we are, and what we couldn’t establish — stated openly.
Red-team handoff
A practical brief that lets the red team build its test plan directly from the scenarios.
Four ways we support threat-led testing.
Formal TLPT threat intelligence
Full threat intelligence provider for a DORA TLPT, TIBER-EU or iCAST engagement — from preparation to closure, working alongside your independent red team and the authority.
TLPT readiness assessment
Expecting to be selected? A preparatory threat assessment and readiness review: mapping critical functions, testing your intelligence picture and preparing your control team. It’s preparation — never presented as a formal test.
ICT third-party & pooled TLPT support
For ICT providers to financial entities brought into a TLPT, including pooled tests — intelligence that reflects your role in your clients’ critical functions.
Threat-led red team scenarios
Outside a formal scheme, the same methodology produces intelligence-led scenarios for your internal or external red team — so exercises reflect real adversaries, not generic playbooks.
Intelligence you can defend in front of a regulator.
Every judgement we make is graded, sourced and stated with an explicit level of confidence — so your control team, red team and board know exactly how much weight to put on it.
Admiralty-style reliability and credibility
Sources are graded for reliability and each piece of information for credibility, so a single unverified forum post is never presented with the same weight as corroborated reporting.
Calibrated probabilistic language
Assessments use a consistent probability scale (in line with UK intelligence practice), so “likely” always means the same thing.
MITRE ATT&CK mapping
Threat actor behaviour and scenarios are mapped to ATT&CK tactics and techniques, giving red teams, SOCs and auditors a shared reference.
Structured analysis and TLP
Structured analytic techniques challenge our own assumptions, intelligence gaps are stated openly, and reporting is marked and shared using the Traffic Light Protocol.
Specialist, independent and senior-led.
Delivered under the frameworks
We have delivered the threat intelligence phase for TIBER-EU, DORA TLPT and iCAST engagements. We know what control teams, test managers and red teams need — and when they need it.
Independent of the red team
We are a threat intelligence provider, not a red team. The people defining the threat are separate from the people emulating it.
Senior analysts, start to finish
The analyst who scopes your intelligence is the one who writes and briefs the report. No hand-offs to juniors.
Confidential by design
Code names, need-to-know distribution, encrypted communications and agreed retention — because a threat-led test only works if it stays secret from those being tested.
DORA TLPT and TIBER-EU questions.
References: ECB — TIBER-EU · DORA (EUR-Lex) · HKMA — cyber resilience
Who has to perform TLPT under DORA?
Financial entities identified by their competent authority, based on factors such as their impact, systemic importance and ICT risk profile. Selected entities must perform TLPT at least every three years, covering several or all of their critical or important functions on live production systems.
How does DORA TLPT relate to TIBER-EU?
The DORA TLPT regulatory technical standards are based on the TIBER-EU methodology, and TIBER-EU was updated in 2025 to align with them. In practice, a TIBER-EU test can be designed to meet DORA TLPT requirements. National authorities set out how they implement both.
What does the threat intelligence provider actually do?
We assess your digital footprint and the threat actors most likely to target your critical functions, then turn that into realistic attack scenarios. The output, the Targeted Threat Intelligence Report, is what the red team uses to build its test plan. We continue to support the test through to closure.
How many threat scenarios will there be?
Several — commonly three — agreed with the control team, the red team and the authority. Each scenario is built around a credible actor, an objective linked to a critical function and a realistic attack path.
Are you the red team as well?
No. We act as an independent threat intelligence provider, separate from the red team. That separation avoids conflicts of interest and is what frameworks and authorities expect.
We haven’t been selected for TLPT yet. Can you still help?
Yes. A TLPT readiness assessment helps you map critical functions, understand your threat picture and prepare your control team. It is preparation and is never presented as a completed formal test.
Do you support iCAST engagements in Hong Kong?
Yes. We have delivered intelligence for iCAST engagements and can provide the depth of intelligence required by the institution’s inherent risk level.
How do you keep the test confidential?
Engagements use code names and need-to-know distribution, communications are encrypted, and data is handled and retained under agreed terms. Only the control team knows the test is taking place.
Build an intelligence-led resilience programme.
Planning a DORA TLPT, TIBER-EU or iCAST test?
Speak to a specialist about the intelligence phase — in confidence.