Scope the intelligence
Confirm the framework, overseeing authority, functions, third parties, geography, research window, classification and priority questions. Agree the decisions the report must support.
← Threat HubThe intelligence phase
THREAT HUB / FORMAL TEST INTELLIGENCE
The intelligence phase
sets the test.
Targeted threat intelligence for DORA and TIBER-EU threat-led penetration testing. Evidence-led actor assessment and scenarios designed for the functions in scope.
The role
Make the scenarios worth testing.
A formal threat-led penetration test starts with the entity's critical or important functions. The intelligence provider then examines which adversaries could credibly target those functions, what is externally exposed and which routes are worth emulating. The result gives the red team a defensible basis for its test plan.
SMARTSEC can deliver the targeted threat intelligence phase where the appointed red team is separate and the applicable procurement and conflict requirements are met. We agree the role, authority, framework and reporting route before work begins.
Method
Five connected stages.
Map the footprint
Assess the business and digital footprint from an adversary's perspective: public services, exposed technology, supplier relationships and relevant personnel or credential exposure.
Assess the threat
Identify actors with credible intent, capability and opportunity. Separate sourced facts from analytic assessment, record confidence and avoid filling evidence gaps with assumptions.
Build scenarios
Develop end-to-end attack paths tied to the functions in scope. Each scenario explains the intelligence rationale, entry point, objective and observable techniques.
Handoff and support
Provide the targeted intelligence report and red-team inputs, answer control-team questions and clarify the intelligence as the test plan is developed.
Deliverable
A report built for execution and scrutiny.
The exact format follows the scheme and engagement scope. Every substantive judgement should be traceable to evidence, with limits and confidence stated.
Targeted Threat Intelligence Report
- Scope, requirements and document controls
- Business and digital footprint assessment
- Threat landscape and prioritised actor profiles
- Scenario rationale and mapped attack techniques
- Source, confidence and analytic caveats
- Red-team test-plan handoff material
DORA and TIBER-EU
Use the right framework for the right engagement.
The updated TIBER-EU framework aligns its test process with DORA's threat-led penetration testing requirements for designated financial entities. Formal scope, provider eligibility and sign-off are set with the entity and relevant authority. A preparatory threat assessment can still be useful when no formal test has been mandated, but it is a different engagement.
We document the intelligence and red-team responsibilities at scoping and do not present a preparatory assessment as a completed formal TLPT.
Frequently asked questions
Before we begin.
Are you the red team provider as well?
For this intelligence engagement, the red team is appointed separately. We check the relevant independence and conflict requirements during procurement and scoping.
Do all financial firms need a formal DORA TLPT?
No. Designation and the applicable testing route depend on the entity and its competent authority. We establish the framework and scope before proposing a formal intelligence phase.
What do you need from us?
We need the functions and systems in scope, relevant third parties, the framework and authority, agreed contacts, research boundaries and the intelligence questions the test must answer.
Can we commission the intelligence before the formal test?
Yes. A preparatory assessment can help clarify functions, threats and external exposure. Its scope and deliverables are stated separately from any later formal TLPT.
Talk to SMARTSEC
Start with your objective.
Tell us the decisions, test or exercise this work needs to support. We'll suggest a scope and the right next step.