Threat-Led Penetration Testing (TLPT) emerges as an advanced ethical hacking methodology, focused on the simulation of realistic attacks based on threat intelligence.

This article aims to explore the concept of TLPT in detail, analyzing its distinctive characteristics, the crucial phases of an exercise, the fundamental differences compared to traditional penetration testing, and the importance of relying on specialized providers to maximize its effectiveness.

What is Threat-Led Penetration Testing (TLPT)?

Threat-Led Penetration Testing (TLPT) is an advanced ethical hacking framework that stands out for its use of threat intelligence to emulate the tactics, techniques, and procedures (TTPs) of real threat actors perceived as capable of posing a genuine cyber threat to the organization. Unlike traditional penetration tests, which often follow standardized methodologies and focus on specific technical vulnerabilities, TLPT adopts an intelligence-led approach, creating controlled, customized attack scenarios directed at the entity’s critical production systems.

The primary objective of TLPT is not simply to identify a list of vulnerabilities, but rather to evaluate the overall effectiveness of an organization’s prevention, detection, response, and recovery capabilities when faced with advanced and persistent cyber threats (APTs). Through the simulation of realistic attacks, TLPT offers invaluable insights into the actual exploitability of potential weaknesses and the ability of personnel and security systems to withstand a targeted attack.

Regulatory context of Threat-Led Penetration Testing

In the regulatory context, particularly in the financial sector, TLPT assumes crucial importance. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) requires certain identified financial entities to conduct advanced digital resilience testing through TLPT at least every three years. This requirement underscores the recognition of TLPT as a fundamental tool for ensuring the stability and integrity of the financial system in the face of increasingly evolved cyber threats. The TIBER-EU framework is an example of a framework applied in the European Union, aligned with international standards (such as the G7 Fundamental Elements for Threat-Led Penetration Testing) and designed to facilitate the execution of TLPT in a consistent and controlled manner within the financial sector.

TLPT represents a significant evolution in the field of ethical hacking, shifting the focus from simple vulnerability searching to a complete and realistic assessment of an organization’s ability to defend itself against sophisticated cyberattacks, guided by a deep understanding of the current threat landscape.

Threat-Led Penetration Testing vs. Penetration Testing

TLPT and PT (Penetration Testing) are both fundamental for Ethical Hacking activities, but they are not the same thing. TLPT positions itself as an advanced form of ethical hacking that integrates the penetration testing methodology with the crucial element of threat intelligence. Here are the key differences between TLPT and traditional penetration testing:

• Objective: While penetration testing primarily aims to identify technical vulnerabilities and evaluate the response of security systems to real-time attacks, TLPT focuses on simulating realistic attack scenarios based on concrete threats, with the goal of evaluating the overall digital operational resilience of the organization, including people, processes, and technologies. TLPT also offers suggestions for strengthening security, but with a broader perspective based on the context of real threats.
  
• Scope: Penetration testing often has a limited scope to specific systems or applications due to budget and time constraints. TLPT, while it may focus on critical or important functions, tends to have a broader scope, aiming to cover multiple critical or important functions of a financial entity and the live production systems that support them. Furthermore, TLPT can include third-party ICT service providers that support such critical functions.
  
• Approach: Penetration testing follows a systematic approach, starting from reconnaissance and scanning, then moving to exploitation. TLPT adopts an intelligence-led approach, using detailed information about threat actors, their motivations, intentions, and TTPs to define credible attack scenarios. This approach makes the simulation much more realistic and targeted. TLPT can be considered intelligence-led red teaming.
  
• Depth of analysis: Although penetration testing can be comprehensive, it may not always delve into advanced attack techniques unless specifically requested. TLPT, being focused on advanced threats, often implies a deeper analysis and the exploration of potential attack vectors, including zero-day exploits and custom techniques, to emulate realistic attacks.
  
• Threat Intelligence: The crucial distinctive element of TLPT is the integration of threat intelligence at every stage of the process. Threat intelligence provides the context to define plausible attack scenarios, identify targets, and guide the actions of the testing team (often called the “Red Team”). Traditional penetration testing may not make such extensive and targeted use of threat intelligence.

For an in-depth look at the differences between the two approaches, it is also useful to read the analysis dedicated to ethical hacking and penetration testing compared. While penetration testing is a valuable tool for identifying specific technical vulnerabilities, TLPT represents a more sophisticated and comprehensive approach, focused on simulating real attacks based on threat intelligence to evaluate the digital operational resilience of an organization as a whole. It is an evolution of ethical hacking that goes beyond simple weakness identification, providing a deep understanding of an organization’s ability to withstand and respond to targeted and advanced cyber threats.

The phases of a Threat-Led Penetration Testing exercise

Although specific details may vary depending on the framework used (such as TIBER-EU or CBEST) and the needs of the organization, the general phases of a TLPT exercise typically include:

Scope and analysis

• Scope definition: A crucial initial phase to establish the objectives of the test, identify the critical or important functions (CIFs) that will be the focus of the exercise, and define the boundaries of the test.

The Scope Specification Document (SSD) in the TIBER-EU framework is an example of a document that summarizes the CIFs of a financial entity as a basis for a TIBER test. In this phase, the flags or specific objectives that the Red Team will attempt to reach during the test are also defined. Planning also includes defining the rules of engagement, which establish the limits and authorizations for testing activities.

• Threat Intelligence collection and analysis: Here, a Threat Intelligence Provider (TIP) collects, analyzes, and disseminates information on relevant threat actors and likely attack scenarios that could target the organization.

This threat intelligence includes details on the attackers’ motivations, their objectives, and their TTPs. The TIP produces a Targeted Threat Intelligence Report (TTIR) that formulates targeted threat scenarios, based on an analysis of the generic threat landscape and the specific digital footprint and circumstances of the entity. The TTIR provides the Red Team with the basis to design and justify their penetration test plan. Threat intelligence can be collected from various sources, including OSINT (Open Source Intelligence) and HUMINT (Human Intelligence).

Targeting and planning

• Targeting: Some frameworks, such as CBEST, include a targeting phase where the understanding of the organization’s attack surface is further refined and initial targets for the Red Team are identified. A Targeting Report can provide valuable input for the more in-depth and targeted targeting activities of the Penetration Testing Service Provider (PTSP) or Red Team; it is an optional but recommended phase.
  
• Penetration Test Planning (Red Team Test Plan): Based on the TTIR and, if present, the Targeting Report, the penetration test team (often called Red Team Testers – RTT) develops a detailed Penetration Test Plan (PT Plan) or Red Team Test Plan (RTTP).

This plan describes how the attack scenarios defined in the TTIR will be implemented, which TTPs will be used (and which will not), the test timelines, communication channels, and risk management procedures. The PT Plan must explicitly show how the test steps link back to the TTIR scenarios and the systems supporting the CIFs in scope.

Execution and testing

• Penetration Test Execution (Red Teaming): In this phase, the Red Team executes the attack plan, simulating the actions of the threat actors identified in the threat intelligence phase. The goal is to attempt to compromise the systems in scope and reach the defined flags, while evaluating the effectiveness of the organization’s security controls and the detection and response capabilities of the defense team (often called the “Blue Team”). The Red Team should adapt its attack methodology to replicate the threat scenarios.
  
• Test management (Control Team): Throughout the duration of the test, a Control Team (CT) supervises and manages the exercise. The CT is responsible for ensuring that the test remains within the defined scope, that risks are managed appropriately, and that the impact on business operations is minimized. The CT acts as a point of contact between the Red Team and the organization, managing communication and intervening if necessary to control the escalation of attacks.

Reporting and follow-up

• Analysis and reporting: At the end of the execution phase, the Red Team analyzes the test results, documenting the exploited vulnerabilities, the attack paths followed, the level of access obtained, and the effectiveness of the defense mechanisms. Several reports are produced, including a detailed technical report for the organization’s security team and a high-level Test Summary Report (TSR) for senior management and competent authorities. The TSR provides an overview of the entire test, including attack scenarios, high-level results, recommendations, and the remediation plan.
  
• Remediation and follow-up: Based on the reporting results, the organization develops and implements a remediation plan to address the identified vulnerabilities and improve its security controls. It is essential to establish a formal follow-up process for the timely verification and correction of the critical issues found. The effectiveness of TLPT is also measured by the organization’s ability to translate test results into concrete improvements in its cybersecurity and operational resilience.

In some circumstances, during the execution phase or the closing phase, Purple Teaming (PT) can be implemented, a collaboration between the Red Team and the Blue Team to share knowledge, techniques, and perspectives, improving both the offensive and defensive capabilities of the organization. PT can take various forms, from theoretical discussion to the practical execution of specific attack scenarios on live or test systems.

Relying on specialized providers to maximize TLPT effectiveness

Executing an effective Threat-Led Penetration Test (TLPT) requires specialized skills and a deep understanding of both the current threat landscape and advanced attack techniques. For this reason, it is fundamental that organizations rely on specialized and qualified service providers to conduct TLPT exercises. A concrete starting point is to evaluate a structured ethical hacking service with a red team approach, which integrates threat intelligence and targeted simulations on the organization’s critical functions.

Considerations when choosing a provider:

When selecting a provider for a TLPT exercise, it is important to consider several factors:

• Reputation and experience: Their experience in conducting similar TLPT tests and successful case studies.
• Qualifications and certifications: Such as OSCP (Offensive Security Certified Professional) or CEH (Certified Ethical Hacker). However, it is important not to rely solely on certifications, but to actively evaluate the actual knowledge and experience of the staff.
• Threat Intelligence skills.
• Red Team’s ability to simulate advanced and realistic attacks.
• Reporting and remediation process: Evaluate the clarity and quality of the reporting process and the support provided for remediation.
• Contractual and confidentiality aspects: Clearly define contractual aspects, including non-disclosure agreements (NDAs) and protocols for the destruction of sensitive information at the end of the test.

Relying on specialized and qualified providers is a crucial investment to ensure that a TLPT exercise is conducted effectively, providing valuable insights into the organization’s actual security posture and contributing significantly to strengthening its digital operational resilience in the face of increasingly sophisticated cyber threats.

Advantages of relying on specialized providers:

• Providers specialized in TLPT have teams with specific skills and experience in threat intelligence, red teaming, and understanding the attack methodologies used by real threat actors. These professionals are constantly updated on the latest cybercrime trends, new vulnerabilities, and emerging TTPs.
  
• A competent Threat Intelligence Provider (TIP) is able to collect and analyze relevant, high-quality threat intelligence from a variety of sources, including proprietary and open-source intelligence feeds.
  
• The Red Team of a specialized provider is able to simulate complex and sophisticated attacks that faithfully replicate the actions of real threat actors. This includes the use of advanced techniques such as privilege escalation, persistence, and lateral movement.
  
• Relying on an external provider ensures an objective and independent approach to evaluating the organization’s security, avoiding potential conflicts of interest that could arise with internal teams.
  
• In the DORA regulatory context, relying on qualified providers can help financial entities meet the requirements for conducting TLPT in compliance with applicable standards and frameworks (such as TIBER-EU). Specialized providers are familiar with these requirements and can guide the organization through the process.

The structured phases of a TLPT exercise, from scope definition to remediation, ensure a methodological and comprehensive process. However, the effectiveness of a TLPT depends largely on the competence and experience of the team conducting it. For this reason, relying on specialized and qualified providers is of primary importance to maximize the value and insights derived from the test. These providers bring specific skills in threat intelligence, red teaming, and understanding the threat landscape, ensuring realistic simulations and detailed, actionable reports. To get a concrete idea of how such a project is structured in practice, it is useful to read the ISGroup case study of corporate ethical hacking with Acmebank.

Frequently Asked Questions about Threat-Led Penetration Testing

• Is TLPT mandatory for all organizations?
• No. The DORA Regulation provides for the TLPT obligation only for certain financial entities identified by competent authorities, typically those with the highest systemic impact. For other organizations, TLPT remains a voluntary but recommended tool when one wants to evaluate operational resilience in a realistic and in-depth manner.
• What is the practical difference between a Red Team engagement and a TLPT?
• A Red Team engagement is a simulated offensive activity that can be conducted with varying degrees of structure. TLPT is a specific and regulated form of red teaming where threat intelligence mandatorily guides the definition of scenarios, the perimeter includes live production systems, and the entire process follows a formal framework (such as TIBER-EU) with supervision by a Control Team and the production of standardized reports for authorities.
• How long does a TLPT exercise typically last?
• The duration varies based on the complexity of the organization and the defined scope, but a complete TLPT exercise generally requires several months: from threat intelligence collection and planning, to red teaming execution, up to report production and the remediation phase. It is a structured process and not a one-off test.