DORA Penetration Testing Requirements: Stay Compliant, Stay Audit-Ready.
DORA (EU Regulation 2022/2554) requires all financial entities operating in the EU to conduct ICT penetration testing of critical systems at least once per year under Article 25. StealthNet AI delivers AI-assisted pentests from $1,500 and hybrid AI plus human engagements from $5,000, with human-validated findings and audit-ready reports in 48 hours.
Get a DORA Pentest Quote
Tell us about your entity type and ICT scope. We'll respond with a scoped quote within one business day.
Trusted by Companies Where Security Isn't Optional
What customers say
Highly recommend StealthNet AI
"StealthNet AI performed a thorough and comprehensive pen test, fast turnaround on conducting the test, they were very responsive, and it was great value."
Richard B.
Founder · Avara Software · Health, Wellness & Fitness
The best choice for penetration testing
"The testing was thorough and the reports were structured precisely for the regulatory requirements. Explanation of issues along with steps to reproduce and remediation advice were detailed and clear, making corrections a breeze."
Jeremy M.
Director · IKO Corp · Medical Devices
What DORA Actually Requires for Penetration Testing
The Digital Operational Resilience Act entered into force on 17 January 2025 and applies to approximately 22,000 financial entities across the EU, including banks, insurance companies, investment firms, payment service providers, crypto-asset service providers, and fintech platforms. All covered entities must meet two tiers of penetration testing obligations.
Article 25: Annual ICT Penetration Testing
Every financial entity covered by DORA must test ICT systems and applications supporting critical or important functions at least once per year. Testing methods must be appropriate to the system's risk profile and must be independently conducted. This is the baseline requirement that applies to every covered entity regardless of size or systemic importance. StealthNet AI's AI-assisted and hybrid pentest bundles are purpose-built to satisfy this requirement at a cost and speed that works for fintechs and growth-stage financial platforms.
Article 26: Threat-Led Penetration Testing (TLPT)
Systemically important financial entities identified by their national competent authority must conduct Threat-Led Penetration Testing (TLPT) at least every three years. TLPT covers the entire organization, must be performed on live production systems, includes third-party ICT providers in scope, and involves an active red team phase of at least 12 weeks. The full engagement typically runs 6 to 12 months. StealthNet AI helps organizations prepare for TLPT by hardening their posture and resolving critical findings before the formal TLPT cycle begins.
Most Financial Entities Are Not Ready for DORA Testing Requirements
Traditional Pentests Are Too Slow
Legacy penetration testing firms take 4 to 8 weeks to scope, begin, and deliver results. DORA requires annual testing of ICT systems. A process that takes 2 months to kick off cannot realistically support a continuous compliance posture across all critical functions.
Enterprise Pricing Doesn't Fit Fintechs
Traditional pentest engagements start at $15,000 to $25,000 per test. For a Series A fintech or crypto-asset service provider that needs to test multiple systems annually, this cost model is unsustainable. DORA compliance should not require an enterprise security budget.
Reports Aren't Built for Regulators
Most pentest reports are written for developers, not compliance teams or national competent authorities. DORA requires testing to be documented in a way that demonstrates risk coverage and methodology alignment. StealthNet reports are structured for audit-readiness from the first page.
From Scoping to DORA-Ready Report in 48 Hours
Scope Your ICT Systems
Tell us which systems, applications, and functions are in scope for your DORA Article 25 obligation. We align the engagement to your risk profile and document the scope for your compliance record.
AI Agents Execute Testing
Our AI agents perform autonomous exploitation across your web applications, APIs, external network perimeter, and cloud infrastructure. Coverage is aligned to DORA's ICT testing requirements.
Human Tester Validates Findings
Every finding is reviewed and validated by a senior OSCP-certified penetration tester before it enters the report. You get AI speed with human-grade accuracy, not a glorified vulnerability scan.
Audit-Ready Report Delivered
You receive a structured pentest report with executive summary, CVSS-scored findings, reproduction steps, remediation guidance, and a methodology section demonstrating DORA Article 25 alignment for your compliance team and auditors.
ICT Systems and Functions Covered Under DORA Article 25
Web Applications and APIs
Testing of customer-facing and internal web applications, REST and GraphQL APIs, authentication systems, and business logic flows. Covers OWASP Top 10 and API Security Top 10.
External Network Perimeter
Enumeration and exploitation of internet-facing infrastructure, including exposed services, open ports, misconfigured firewalls, and CVE-matched vulnerabilities across your external attack surface.
Cloud Infrastructure
Assessment of AWS, Azure, and GCP environments for IAM misconfigurations, excessive permissions, exposed storage, insecure credentials, and privilege escalation paths.
Internal Network and Active Directory
Simulation of lateral movement, insider threat scenarios, and privilege escalation including Active Directory misconfigurations, Kerberoasting, and path-to-domain-admin analysis.
Source Code and SDLC
Security review of application source code for injection vulnerabilities, authentication bypasses, hardcoded secrets, and dependency risks. Aligned to DORA's requirements for SDLC security testing.
Third-Party ICT Provider Interfaces
Testing of integration points with third-party ICT providers, SaaS platforms, and data processors that fall within your DORA Article 25 scope, including API authentication and data handling controls.
DORA Pentest Pricing Built for Financial Entities, Not Just Enterprises
One-off tests for your annual Article 25 obligation. Quarterly bundles for continuous compliance posture.
AI-Assisted Pentest
$1,500
- DORA Article 25 aligned methodology
- Web app, API, and external perimeter coverage
- Human-validated findings, not a vuln scan
- Audit-ready compliance report
- 48-hour delivery
Best for: Smaller financial entities and fintechs satisfying the DORA Article 25 annual testing requirement
Hybrid (AI + Human) Pentest
Starting at $5,000
Typical engagements range from $5,000 to $10,000 depending on scope
- Everything in AI-Assisted
- Senior OSCP-certified tester engagement
- Business logic and chained vulnerability testing
- Third-party ICT interface coverage
- Free remediation retest included
- Compliance-mapped findings for your auditor
Best for: Financial entities with complex ICT environments, multiple critical functions in scope, or third-party ICT provider dependencies
Quarterly Compliance Bundle
Custom
Scheduled quarterly across the year
- Quarterly test cadence for continuous compliance
- Priority scheduling and account management
- TLPT readiness prep included
- Cumulative findings tracking across tests
Best for: Financial entities managing multiple critical functions or preparing for TLPT readiness under Article 26
Enterprise Security. Fintech-Friendly Speed and Pricing.
From scope confirmation to report delivery
Financial entities covered by DORA in the EU
Findings validated by senior human testers
Certified testers on every engagement
How the Test Maps to DORA Articles 24 to 28
DORA does not describe a penetration test in one place. These are the articles the engagement produces evidence for, and what your competent authority actually receives.
Also working to another framework? The same engagement can carry ISO 27001 penetration testing and PCI DSS penetration testing mappings. See compliance penetration testing for how the overlap works.
Article 25 Penetration Testing vs. Article 26 TLPT
Two different obligations that get conflated constantly. Most entities owe the first every year and the second only if designated.
Already in force
DORA has applied since 17 January 2025
Regulation (EU) 2022/2554 entered into force in January 2023 and became applicable on 17 January 2025. National competent authorities now expect a running digital operational resilience testing programme, which means a current report rather than a plan to commission one.
- Annual testing of every ICT system supporting a critical or important function.
- A documented programme: scope, methodology, results, remediation, verification.
- Third-party ICT components inside critical functions covered or explicitly excluded.
- TLPT readiness if your authority designates you under Article 26.
Pentest Services Included in Every Compliance Engagement
Every compliance pentest pulls from these test-type services as needed. Scope is sized to your environment, not padded with hours.
DORA Penetration Testing: Common Questions
Pentest Reports for Every Compliance Framework
Same AI plus human delivery model, mapped to the framework your auditor or customer cares about.
Trust Services Criteria CC6/CC7
Security Rule §164.312 safeguards
Requirement 11.3 / 11.4 testing
Annex A control validation
800-53, 800-171, and CSF mapped
Level 2 (NIST 800-171) crosswalk
510(k) cybersecurity for medical devices
Moderate/High baseline pentest
Get Your DORA Pentest Scoped This Week.
Share your entity type, ICT scope, and timeline. We'll respond with a scoped quote within one business day. No commitment required.
No commitment required. Every engagement is scoped before a proposal is sent.