Great intelligence is foundational to TLPT
Whichever framework applies, the intelligence phase sets the quality of everything that follows.
Learn more about our threat-led penetration testing services.
Whichever framework applies, the intelligence phase sets the quality of everything that follows.
Learn more about our threat-led penetration testing services.CBEST, TIBER-EU and DORA TLPT are not three competing tests. They are one testing discipline — threat-led penetration testing (TLPT) — resting on three different legal and supervisory footings. Which one applies depends on where your firm is regulated, and whether an authority has designated it for testing. A group regulated in more than one country may be subject to multiple testing regimes.
This guide sets out who owns each framework, who decides whether it applies to you, and what changes in practice when several do.
CBEST, TIBER-EU and DORA TLPT all govern the same activity in different ways: threat-led penetration testing, a controlled simulated attack on live production systems built from intelligence on real adversaries. DORA TLPT is a binding obligation on designated EU financial entities to carry out such testing. TIBER-EU is a methodology and guidance that European authorities may adopt to run those tests consistently. CBEST is a UK supervisory framework with its own legal basis, unaffected by DORA.
One way to understand the relationship between CBEST, TIBER-EU and DORA TLPT is to imagine a fire drill. DORA is the EU law that sets out when a fire drill must happen and who must conduct it. TIBER-EU is the agreed method for running those drills. CBEST is the United Kingdom's own set of fire drill rules. The methods and practices in the EU and the UK are broadly similar. The differences are the authority that orders it, who signs it off, and which rulebook is applied.
For a fuller definition of TLPT, and an explanation of how it differs from other testing methods, see How threat-led penetration testing differs from a traditional pentest.
They differ in who owns the framework, which jurisdiction it applies in, how a firm comes to be tested, and what each requires of the testers. The table below compares them attribute by attribute.
It helps to separate the law from the method. In the EU, the requirement and the method sit in separate instruments: DORA is the EU law that requires the test, and TIBER-EU is the method for running it. In the UK, CBEST does both.
None of them derives its legal authority from the others, but CBEST is the oldest, and the European method descends from it.
That descent is why they closely resemble each other in practice. The similarity is in the method, not the law. DORA does not apply in the United Kingdom, and CBEST rests on UK financial regulation rather than on any EU instrument.
The two regimes meet when a group holds separate authorisations on each side. A UK-authorised firm and a subsidiary licensed in, say, Germany or Ireland are two separately regulated companies rather than one business with offices abroad, and each answers to its own regulator. The UK firm may be asked to complete a CBEST. The EU subsidiary may be designated for DORA TLPT by its own competent authority, the national regulator that supervises it. Where both are triggered, the group can run two separate tests, or one joint test that counts for both if both sets of regulators take part.
For a fuller explanation of DORA and its specific implications for financial institutions, read what DORA requires in practice.
On the EU side, the full text of DORA is available on EUR-Lex, and the detailed rules sit in the Regulatory Technical Standards on threat-led penetration testing, published as Commission Delegated Regulation (EU) 2025/1190 in the Official Journal on 18 June 2025 and in force since 8 July 2025.
There is no UK statute to set alongside them. No UK legislation names threat-led penetration testing, and CBEST operates under the regulators' general supervisory powers, with the framework itself set out in the Bank of England's CBEST Implementation Guide. CBEST is scoped around a firm's important business services, the services firms must identify under the UK's operational resilience rules (explained for PRA-regulated firms in SS1/21).
TIBER-EU is the framework for conducting the tests mandated by DORA, the EU Regulation. Published by the ECB in May 2018, TIBER-EU is guidance, not a law. National authorities — a country's central bank or financial regulator — are not required to adopt it, though most have done so.
A national authority that adopts the TIBER-EU framework oversees tests conducted within its jurisdiction and publishes its own national implementation. Each carries its own name: TIBER-DK in Denmark, TIBER-NL in the Netherlands, TIBER-BE in Belgium, and others. All apply the same framework, under the adopting authority's own arrangements. The ECB last updated it on 11 February 2025, aligning it with DORA's technical standards. The framework and its guidance documents are published on the ECB's TIBER-EU pages.
SecAlliance provides threat intelligence for TIBER-EU testing under national implementations of the framework.
If your firm is authorised in the EU or EEA, you still have to test. Not every national authority has adopted TIBER-EU, and DORA applies to firms in those countries exactly as it does elsewhere. Testing follows whatever arrangements the authority has put in place. What changes is the method, never the obligation.
CBEST is the UK's threat-led penetration testing framework. It has been part of the supervisory toolkit of the Bank of England, the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) since 2014. It applies to systemically important firms and financial market infrastructures. The regulators agree between themselves which firms to assess and approach those firms directly, so being in scope is something you are told rather than something you work out.
In the Bank's own words, it is a guiding framework rather than a prescriptive methodology. It is built on bespoke threat intelligence produced specifically for your firm by an accredited external provider. Those providers must first be accredited by CREST, and then need CBEST accreditation from the regulators. SecAlliance delivers CBEST threat intelligence assessments as an accredited provider.
There are three routes. The regulator may request one as part of the supervisory cycle. You may request one yourself as part of your cyber resilience programme, with the regulator’s agreement. Or your supervisors can require you to carry out a test, including a CBEST, after an incident or where they have serious concerns. They do this under their skilled person powers (section 166 of the Financial Services and Markets Act), and decide the provider and the scope.
The Bank of England is explicit that there is no pass-or-fail. The assessment closes with a remediation plan agreed with the regulator, which then tracks delivery as part of ordinary supervision. The Bank of England also publishes an annual CBEST thematic report, drawn from assessments completed during that period, sharing anonymised findings with firms outside the CBEST population.
The Bank of England, the FCA and CREST launched Simulated Targeted Attack & Response for the Finance Sector (STAR-FS) in March 2024, extending threat-led testing to a wider set of firms and financial market infrastructures than CBEST reaches. It sits alongside CBEST in the PRA and FCA supervisory toolkit and uses CREST-accredited providers.
The difference is who drives it. STAR-FS is firm-led rather than regulator-led and asks less of both you and the regulator than CBEST does. You can choose to run one as part of your own testing programme, and the regulators can also use it in their supervision. If you want a test you initiate to count as a supervisory assessment, you tell your supervisor, give them the chance to comment on the scope, and send them your remediation plan. It is a distinct framework, not a lighter-touch CBEST. SecAlliance delivers CREST STAR-FS assessments.
Both frameworks are documented on the Bank of England’s operational resilience pages. STAR-FS providers need CREST accreditation, while CBEST providers also need CBEST accreditation from the regulators.
It depends on where you are regulated and whether an authority has designated you for testing. EU firms fall under DORA TLPT only if their competent authority identifies them. UK firms fall under CBEST if the regulators select them, which they do for systemically important firms. STAR-FS is open to a wider set of UK firms, including those that do CBEST.
The frameworks and regulations are not mutually exclusive. Groups regulated in both places face both separately. For example, a UK firm with EU-regulated subsidiaries and a Hong Kong presence can be within three frameworks at once, each with its own authority and scope.
You may also be drawn into a test without being designated yourself. If you supply technology to a regulated firm, that firm can include your systems in the scope of its own test, and your obligations then come from your contract with them rather than from the regulation. Under DORA, contracts for ICT services that support critical or important functions must oblige the supplier to take part in the firm's TLPT (Article 30(3)(d)). In the UK, the CBEST Implementation Guide expects firms to arrange the participation of third parties whose systems support the services in scope, where needed.
This is not something you can work out for yourself. The competent authority legally responsible for supervising your type of firm will tell you what's required. Within one country, that may be a different body for banks, insurers and investment firms. It assesses how far your services affect the financial sector, whether you are systemically significant nationally or across the EU, and your ICT risk profile and maturity, and notifies you directly once that assessment is made.
You can reuse the intelligence, but not the paperwork. Your picture of the adversaries targeting the group is the same whether you test in London or Dublin, so that research does not need to be done twice. Anything a regulator signs — the scope, the sign-off, the attestation — belongs to the authority that issued it and cannot be carried over.
Scoping must always be done afresh. Each authority approves the scope for the firms it supervises, decides which functions are covered, and reviews the results. So, unless you arrange a joint test, expect to share one intelligence picture across two separate tests.
There are potentially three ways to share one test:
None of the three happens automatically. Each must be agreed with all relevant authorities before the scope is fixed, not once the test is underway. Raise it at the point you are designated, not when you start procuring.
There are several. In the UK, two schemes apply the CBEST approach to other sectors. Outside Europe, a number of regulators run their own.
GBEST and TBEST both sit with CBEST in what CREST calls the BEST family, sharing its structure while answering to different authorities.
GBEST works differently from the others in one respect. The Cabinet Office coordinates the scheme, but each exercise is procured, led and owned by the department carrying it out, with the National Cyber Security Centre validating the threat intelligence.
SecAlliance provides threat intelligence under GBEST for UK government bodies and TBEST for telecoms providers.
Several regulators outside Europe run their own schemes. They apply similar discipline but share no legal connection with DORA or CBEST, so being tested under one does nothing for your obligations under another.
iCAST forms part of the Hong Kong Monetary Authority's Cyber Resilience Assessment Framework and applies to authorised institutions assessed at the intermediate or advanced maturity level rather than to a fixed list of firms. CORIE is run by Australia's Council of Financial Regulators, which brings together APRA, ASIC and the Reserve Bank. AASE is the odd one out: industry guidance issued by the Association of Banks in Singapore rather than a framework imposed by a regulator.
If you operate elsewhere, check what your own regulator requires.
SecAlliance provides threat intelligence for iCAST engagements in Hong Kong.
SecAlliance is a CREST and Bank of England (CBEST) approved supplier of cyber threat intelligence services. We provide the threat intelligence component of threat-led penetration testing across CBEST, STAR-FS, TIBER-EU and its national variants, DORA TLPT, GBEST, TBEST and iCAST. Details are on our accreditations page.
Once a framework is in place and a test is scheduled, the governance around it determines how much you get back. On that, see how to get more value from a TLPT programme. To date, we have provided threat intelligence for around 70 TIBER-EU and DORA tests, around 25 CBESTs and around 10 GBESTs. We have also carried out more than 200 threat intelligence assessments, both within and outside regulatory frameworks.
DORA stands for the Digital Operational Resilience Act, formally Regulation (EU) 2022/2554. It is EU legislation on the digital operational resilience of the financial sector and has applied since 17 January 2025. Article 26 contains the requirement for advanced testing based on threat-led penetration testing. Article 27 sets the standards testers must meet.
CBEST is a UK supervisory framework run by the Bank of England, the PRA, and the FCA. TIBER-EU is a European methodology published by the ECB and adopted on a country-by-country basis. CBEST both requires and describes the test. TIBER-EU only describes it, with DORA supplying the legal requirement.
No. DORA TLPT is a legal obligation on designated firms; TIBER-EU is a method for running such a test. TIBER-EU predates DORA by nearly seven years and is open to firms outside DORA's scope. Designation by your competent authority, not the method used, determines whether a test is a DORA TLPT.
Not quite. Red teaming is the technique: a simulated attack by a team acting as an adversary. Threat-led penetration testing is red teaming driven by intelligence on real adversaries and run under a regulator's framework. TIBER-EU's full name, Threat Intelligence-based Ethical Red Teaming, captures the relationship.
The national regulator legally responsible for supervising your type of firm. Within one country, banks, insurers and investment firms may answer to different bodies. For threat-led testing, some member states have designated a single authority or delegated the task, so it may not be your usual supervisor.
Not directly. DORA applies to firms authorised in the EU, so a UK-authorised firm is not in scope itself. It reaches UK firms in two other ways: a subsidiary authorised in an EU member state is subject to DORA in its own right and may be designated for testing; and DORA's third-party rules apply to a UK firm supplying technology to EU financial firms through its contracts.
CBEST is regulator-led and applies to systemically important UK firms and financial market infrastructures. STAR-FS, launched in March 2024, extends threat-led testing to a wider set of firms. It is firm-led rather than regulator-led and asks less of both you and the regulator. You can choose to run one yourself, or your supervisor can ask for one. Both sit in the PRA and FCA supervisory toolkit and use CREST-accredited providers.
It depends on the framework. CBEST threat intelligence and testing providers must first be accredited by CREST, the accreditation body for the cyber security testing industry, and then need CBEST accreditation from the regulators. Under DORA, testers must meet the requirements set in the technical standards, and TIBER-EU sets its own criteria for judging provider quality during procurement.
Neither is pass nor fail. A CBEST closes with a remediation plan agreed with the regulator, which then tracks delivery through ordinary supervision. A DORA test ends with an attestation from your competent authority confirming it was run properly, alongside the findings and a remediation plan.
Yes. The ECB updated TIBER-EU on 11 February 2025 to align with the process set out in the DORA technical standards. Where your test has met both requirements, your authority issues an attestation on completion. Confirm the arrangement with your competent authority before the scope is fixed.
Both, separately. The UK company falls under CBEST if the regulators select it, and can also run STAR-FS. Each EU-authorised subsidiary falls under DORA TLPT if its own competent authority designates it. But one joint test can count for both, if both sets of regulators take part.
{{standout}}
