[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:dora\u002F26":3},{"item":4,"lessons":16,"controls":22,"related":35},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"dora","26","Article 26","Advanced testing of ICT tools, systems and processes based on TLPT",1,"Digital Operational Resilience Act","**What it asks for.** Financial entities identified by their competent authority must carry out threat-led penetration testing at least every three years, unless the authority sets a different frequency. Each test covers several or all critical or important functions and is performed on live production systems.\n\n**In practice.** The financial entity identifies the relevant ICT systems, processes and technologies supporting critical or important functions, including those outsourced, and the competent authority validates the scope. Where ICT third-party service providers are in scope, the entity ensures they participate, and pooled testing can be used where a provider serves several entities. Testing follows the regulatory technical standards, which align with the TIBER-EU framework, and includes threat intelligence, red teaming and controlled risk management. At the end, the entity and testers provide a summary of findings, remediation plans and documentation, and the authority issues an attestation that the test was performed in line with the requirements. Remediation must then be tracked to closure.\n\n**Common gaps.** Gaps include weak risk management around testing in production, poor engagement with third-party providers, and remediation plans that are agreed but not followed through.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022R2554#art_26","Read the article on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18],{"slug":19,"title":20,"published_at":21},"ai-accelerated-exploitation-outpaces-traditional-security-response","AI-Accelerated Exploitation Outpaces Traditional Security Response","2026-09-16T12:21:12.44+00:00",[23,27,31],{"slug":24,"name":25,"problem":26,"stories":9},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",{"slug":28,"name":29,"problem":30,"stories":9},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":32,"name":33,"problem":34,"stories":9},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[36,41,45,50,55,59,64],{"family":37,"item":38,"code":39,"title":40,"together":9},"cis","11","Control 11","Data Recovery",{"family":37,"item":42,"code":43,"title":44,"together":9},"7","Control 7","Continuous Vulnerability Management",{"family":46,"item":47,"code":48,"title":49,"together":9},"mitre-attack","overview","ATT&CK","MITRE ATT&CK",{"family":51,"item":52,"code":53,"title":54,"together":9},"nist-800-53","ir-4","IR-4","Incident Handling",{"family":51,"item":56,"code":57,"title":58,"together":9},"ra-5","RA-5","Vulnerability Monitoring and Scanning",{"family":60,"item":61,"code":62,"title":63,"together":9},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",{"family":65,"item":66,"code":67,"title":68,"together":9},"nist-sp","800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management"]