Briefing
DORA readiness guide
This guide is for security and compliance leaders at UK and EU regulated financial institutions. It shows where DORA compliance exists on paper but not in practice, and how to prove resilience before a regulator or an attacker tests it for you.
Five things that look like DORA compliance but aren’t
What Articles 24 and 26 and the TLPT standard actually require
What supervisory enforcement looks like in 2026
How to test your posture before you’re asked to prove it
Free download
You don’t need more documentation. You need proof.
A 2025 survey of European financial institutions found 96% did not feel fully resilient under DORA’s standards. Most of them have the paperwork: the ICT risk framework exists, the Register of Information was filed, the annual penetration test was signed off.
If your board treats that paper trail as proof of resilience, that’s the gap supervisors are now assessing. DORA findings feed directly into Pillar 2 capital requirement determinations.
This guide explains where DORA compliance commonly exists on paper but not in practice, what regulators are looking for now, and how to close the gap before they find it.
A pen test isn’t resilience testing.
An annual penetration test is a point-in-time snapshot of a pre-agreed scope. Article 24 asks whether your testing assesses preparedness for handling ICT incidents, and Article 26 requires testing on live production systems.
Testing the way an attacker would, without warning and against real infrastructure, shows whether your controls hold and whether your defenders would even notice.
Paper trails don’t survive supervision.
Article 5 puts ICT risk governance on the board, not the CISO. Supervisors are reviewing board minutes, ICT budgets and training evidence. Since April 2026, submitted Register of Information data is also cross-referenced against incident reporting histories, and inconsistencies are escalated.
More documentation won’t resolve a flag like that. Correcting the classification and testing it against operational reality will.
TLPT is coming.
Around 250 EU entities will be designated for threat-led penetration testing, with accredited testers running a full red team exercise on live systems and no warning to the blue team. The first mandatory cycle deadline is 17 January 2028.
Firms that already run adversarial exercises treat TLPT as formal attestation of resilience they’ve proven. Everyone else is building a test program from scratch under regulatory oversight.
Stop testing.
Start knowing.
You’ll know exactly where you stand, and you’ll be able to prove it. To your board, your regulator, and yourself.
Transform to a proactive, continuous offensive security programme
Your budget is aimed at the risk that matters, not the one you were handed
You show the board what security prevented, not a request for more
Security clears the way for the business to move faster
You enter the boardroom in command
It starts with a 30-minute Attack Discovery call.
No access to your systems required.