Threat intelligence for TIBER-EU, done properly.
Independent targeted threat intelligence for TIBER-EU and national TIBER implementations. We have delivered the threat intelligence phase of TIBER-EU tests — giving control teams, test managers and red teams an evidenced, executable picture of the threat.
The European standard for intelligence-led red teaming.
TIBER-EU — Threat Intelligence-Based Ethical Red Teaming — is the European framework for controlled, intelligence-led red team tests of financial entities’ live production systems, first published by the European Central Bank in 2018.
Authorities adopt it nationally as TIBER-XX — TIBER-NL, TIBER-DE, TIBER-BE, TIBER-DK and others — with a TIBER Cyber Team and test managers overseeing each test. Tests mimic the tactics, techniques and procedures of real threat actors against an entity’s critical functions.
The 2025 update aligned TIBER-EU with the DORA regulatory technical standards on threat-led penetration testing, so a TIBER-EU test can be designed to meet DORA TLPT requirements.
The parties in a TIBER-EU test.
A TIBER-EU test works because each party has a distinct, independent role. Ours is highlighted.
TIBER Cyber Team & test managers
Oversee the test on behalf of the authority, ensure the framework is followed and support attestation.
Control team
A small group inside the entity who know about the test, manage risk and keep it confidential.
Threat intelligence provider
Assesses the threat and produces the Targeted Threat Intelligence Report and scenarios the test is built on.
Red team provider
Plans and executes the attack scenarios against live systems, independent of the intelligence provider.
Blue team
The entity’s defenders — unaware of the test, so their detection and response are tested for real.
Generic threat landscape
Where available, a national or sector threat landscape report provides the baseline we build on.
From preparation to closure.
Set up for success
- Support procurement with methodology, team and independence documentation
- Kick-off with the control team and test manager
- Agree scope, critical functions and secure communications
Define the threat
- Build on the generic threat landscape
- Assess digital footprint and relevant threat actors
- Design scenarios with flags and leg-up considerations
- Deliver and brief the Targeted Threat Intelligence Report
- Hand off to the red team for its test plan
Support to the end
- Intelligence updates and answers to requests during the red team phase
- Input to replay and purple teaming
- Feedback and lessons learned for future tests
What separates strong TIBER intelligence from weak.
Test managers and red teams can tell quickly whether the intelligence behind a test is genuine. These are the standards we hold ourselves to.
- Specific to the entity — not a reworded sector report. Scenarios reflect your critical functions, footprint and suppliers.
- Executable — every scenario has a credible actor, a clear objective and an attack path a red team can actually plan against.
- Evidenced — graded sources, stated confidence and openly declared intelligence gaps.
- Mapped — actor behaviour aligned to MITRE ATT&CK so findings translate into detection and remediation.
- Confidential — code names, need-to-know distribution and encrypted communications throughout.
Experience beyond a single jurisdiction.
National TIBER implementations
We work within the specific requirements and guidance of the national authority running the test.
Cross-jurisdictional tests
For groups operating in several countries, intelligence that reflects the full footprint across jurisdictions.
DORA TLPT alignment
Where a TIBER-EU test is also intended to satisfy DORA TLPT, intelligence produced to meet both.
Intelligence you can defend in front of a regulator.
Every judgement we make is graded, sourced and stated with an explicit level of confidence — so your control team, red team and board know exactly how much weight to put on it.
Admiralty-style reliability and credibility
Sources are graded for reliability and each piece of information for credibility, so a single unverified forum post is never presented with the same weight as corroborated reporting.
Calibrated probabilistic language
Assessments use a consistent probability scale (in line with UK intelligence practice), so “likely” always means the same thing.
MITRE ATT&CK mapping
Threat actor behaviour and scenarios are mapped to ATT&CK tactics and techniques, giving red teams, SOCs and auditors a shared reference.
Structured analysis and TLP
Structured analytic techniques challenge our own assumptions, intelligence gaps are stated openly, and reporting is marked and shared using the Traffic Light Protocol.
Is TIBER-EU mandatory?
TIBER-EU itself is a framework adopted by authorities; whether a test is required depends on the national authority. Under DORA, financial entities selected by their competent authority must carry out threat-led penetration testing, and TIBER-EU is aligned with those requirements.
What is the difference between TIBER-EU and DORA TLPT?
DORA TLPT is a legal requirement for selected financial entities, with detailed rules set out in regulatory technical standards. TIBER-EU is the framework those standards are based on, and since its 2025 update it can be used to run a test that meets DORA TLPT requirements.
What is the Targeted Threat Intelligence Report?
The TTI report sets out the entity’s digital footprint, the threat actors most relevant to its critical functions and the threat scenarios the red team will use to plan the test.
Are you independent of the red team?
Yes. We act as the threat intelligence provider only, separate from the red team provider, which avoids conflicts of interest between defining the threat and emulating it.
How long does the threat intelligence phase take?
It depends on the scope and the number of critical functions, and is agreed during preparation. It typically runs for several weeks before the red team phase begins.
What do you need from us?
A clear scope and list of critical functions, a control team contact, and agreed secure communications. Most of our collection is from an attacker’s perspective, so we keep the demands on your team to a minimum.
More on threat-led testing.
DORA TLPT threat intelligence
Threat intelligence for DORA threat-led penetration testing.
Learn moreiCAST threat intelligence
Intelligence for HKMA iCAST under the Cyber Resilience Assessment Framework.
Learn moreManaged threat intelligence
Analyst-led cyber threat intelligence built on your priority intelligence requirements.
Learn morePlanning a TIBER-EU test?
Talk to us about the threat intelligence phase — in confidence.