Pentest vs TLPT: What’s the Difference?
A standard penetration test and a threat-led penetration test (TLPT) are not the same. A pentest scopes a defined system, runs for a week or two, and the security team knows about it. TLPT is a covert, intelligence-led red-team exercise on live production systems, overseen by the competent authority. For an entity identified for TLPT, a pentest does not satisfy the obligation.
This is the single most important distinction in DORA testing — and the one firms most often get wrong. Getting it right tells you what you actually need to buy.
The core difference
A penetration test is a focused technical assessment of a defined target, run over a short window, usually with the security team’s knowledge. A TLPT is a full, intelligence-led red-team exercise against live production systems, run covertly and overseen by your competent authority from scoping through to attestation.
Side by side
The key contrasts:
Scope — pentest: a defined system or application. TLPT: the live systems supporting critical or important functions.
Intelligence — pentest: scoped by you or your tester. TLPT: driven by an external threat-intelligence report on real adversaries.
Covertness — pentest: the blue team usually knows. TLPT: the blue team is not told; only a small control team knows.
Duration — pentest: typically one to two weeks. TLPT: the active red-team phase alone must last at least 12 weeks.
Oversight — pentest: none required. TLPT: the competent authority is involved throughout and issues an attestation.
Who must do it — pentest / baseline testing: most non-micro entities. TLPT: only entities identified by their competent authority.
Which do you need?
Most firms need baseline resilience testing — which can include penetration testing — under Articles 24–25. Only entities identified for TLPT by their competent authority need the advanced exercise under Articles 26–27. If you are unsure which applies, that is exactly the question to resolve before commissioning anything.
See DORA resilience testing, TLPT explained, and Who needs to do TLPT?.
Not sure whether you need baseline testing or TLPT? See our DORA testing services — we’ll help you scope the right one.