DORA & Threat Lead Penetration Testing with Marko

Banks are now required to do red teaming exercises. Marko Buuri (Bank of Finland) showed us how TIBER-FI helps to create threat intel based red teaming exercises.

Marko's visit was part of my Penetration Testing course. You can join my list to get invitations to similar events.

Synopsis

Cybersecurity red team testing has evolved from underground art to regulated operations in the European financial sector. This lecture explores the requirement for advanced threat-led penetration testing in EU's DORA regulation, and practical guidance on how those projects are organized and delivered according to the TIBER-EU guidance across Europe.

Slides

Buuri 2026: DORA and TLPT testing - Lecture for Haaga-Helia on 31 March 2026 (pdf, 2 MB)

DORA (Regulation ... on digital operational resilience for the financial sector)

  • Article 26 defines threat-lead penetration testing. "Advanced testing of ICT tools, systems and processes based on TLPT"
  • Article 27 defines the requirements for the testers. "Requirements for testers for the carrying out of TLPT"

Bank of Finland (Suomen Pankki): TIBER-FI and TIBER-EU guidance

Buuri 2026: D26 - Releasing Your Inner TIBER in Regulated Adversary Simulations. Video, 45 min. Disobey 2026.

Slides taster

You can download the whole deck.

Bio

Marko Buuri is cyber security adviser in the Bank of Finland (Suomen Pankki). He has over 20 years of in-house and consulting cyber experience. Since 2020 he's been involved in implementing and operating TIBER-FI red team testing framework for the financial sector in Finland.