DORA penetration testing companies
DORA has two layers of testing: a yearly resilience programme that can include penetration tests, and threat-led penetration testing (TLPT) for entities that authorities select. This page lists pentest providers whose own pages mention DORA, A to Z, with check dates. A DORA mention is not proof of TLPT delivery, so ask each provider about TLPT directly.
DORA penetration testing companies describe their DORA work in very different ways. Some name threat-led penetration testing (TLPT), most mention DORA in a list of frameworks. The table lists providers whose own pages mention DORA, in A to Z order with no ranking. Each row shows the facts we could source, and "Not published" where a provider says nothing. Facts were checked on 9 November 2026. This page is not legal advice.
8 of 8 providers shown (67 in the full table). Sorted A to Z, not ranked. Checked up to 9 November 2026.
| Provider | Delivery | Web apps | APIs | Cloud | Network | Mobile | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|---|
| BreachLockPTaaS platform | hybrid | Yes | Yes | Yes | Yes | Yes | ? | Custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive).… | on request |
| BugcrowdPTaaS platform, United States | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Tests launch in under 72 hours; Standard: launch within 3 business… | Standard: one year of retesting with one report revision, for web… | Public |
| HackerOneCrowdsourced platform | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Product page gives no start time or test length. HackerOne docs list… | Retesting is included after remediation. Docs say unlimited retests… | not published |
| HadrianAutonomous testing platform, Netherlands | hybrid | Yes | ? | ? | ? | ? | ? | From EUR 1,250 per test, excluding VAT | Most tests finish within 24 to 48 hours; same-day start possible. | Not published | not published |
| Pentest-Tools.comVulnerability scanning and pentest platform | hybrid | Yes | Yes | Yes | Yes | ? | Yes | from $96 per month, 16 assets +3 more | Not published | Unlimited rescans on all paid plans (tool scans). | not published |
| SchellmanConsultancy, United States | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | Not stated on the page. | Public |
| Secure IdeasConsultancy | human-led | Yes | Yes | ? | Yes | Yes | ? | $8,160 per test (flat fee, starting) +4 more | Testing usually starts two to four weeks after contracting; one to… | Not included by default; retesting is listed as a factor that can… | Public |
| SecuritumConsultancy, Poland | human-led | Yes | ? | Yes | Yes | Yes | Yes | 640 EUR to 890 EUR per man day +1 more | Not published. Typical engagement length is 1 to 4 weeks for a… | Not published | Public |
No provider matches every filter. Remove a filter to see more.
"?" means the provider does not say on its public pages. It does not mean "no". Prices use each provider's own unit: a test, a year, a month or credits. Do not compare them as equal units. How we collect and check this data.
What does DORA ask for?#
DORA is Regulation (EU) 2022/2554, dated 14 December 2022, and EIOPA states that it "entered into application on 17 Jan 2025". The testing rules sit in two layers. Articles 24 and 25 cover a digital operational resilience testing programme, with yearly tests on systems that support critical or important functions. Articles 26 and 27 cover TLPT, which selected entities run at least every 3 years.
We read the articles on an unofficial mirror because EUR-Lex blocks automated fetches. Check wording on EUR-Lex before you rely on it. The plain-words explanation is on DORA penetration testing at penetrationtestservices.com.
| Layer | Articles | What it is |
|---|---|---|
| Resilience testing programme | 24 and 25 | Risk-based tests, which can include penetration tests, run yearly on key systems |
| TLPT | 26 and 27 | Advanced testing on live production systems, at least every 3 years for selected entities |
Who needs a DORA test, and when?#
Financial entities in scope of DORA run the resilience programme. Competent authorities select the entities that run TLPT, using factors such as impact on the financial sector, systemic importance and ICT risk profile. A SaaS vendor is not subject to TLPT unless it is a financial entity.
A supplier to a bank still meets DORA through its customers. Expect contract clauses and questionnaires that ask for test evidence. A normal pentest report answers part of that request. It is not TLPT.
What should you ask DORA pentest providers?#
Ask for these answers in writing.
| Question | Why it matters |
|---|---|
| Have you run TLPT, and under which authority's process? | A DORA mention does not show TLPT experience. |
| How do you meet the tester conditions in Article 27? | Authorities check the testers. |
| Do you run tests on live production systems? | TLPT covers production, which needs a risk plan. |
| Who contracts the testers if we use internal staff? | Article 26(8) requires external testers every three tests for entities that use internal ones. |
| What does the report contain, and can we share it with a customer? | Reports hold sensitive detail. |
| How do you handle retest and remediation checks? | Compare the Retest column below with the quote. |
What drives the price?#
Price follows the number of critical functions in scope, the systems behind them, the threat intelligence work, the length of the live test and the retest terms. Providers in this table mostly quote after scoping. The "Published price" column shows a figure only where a provider lists one. See penetration testing cost for the ranges we sourced.
How do you read the table?#
A provider appears when its own pages mention DORA. The mention may refer to a service, a compliance page or a feature list, so click a provider name for its source and the date we checked it. The dataset records TLPT mentions apart from DORA mentions, so a provider that names only TLPT, such as usd AG, is not in this table. Read the provider row, then ask the question in the table above.
Providers sort A to Z, and no provider pays for a position. Read how we compare for the rules. For related frameworks, see SOC 2 and ISO 27001.
What do authorities and customers check in the report?#
Authorities validate the TLPT scope before testing starts. After testing, they and the entity's customers read the output as evidence. Ask the provider what a report holds: scope, test window, method, findings with evidence, closure status and the testers' conditions under Article 27. A red team report differs from a standard pentest report, so see red teaming if you need the broader exercise.
Questions
Does DORA require a penetration test?
Article 25 lists penetration testing among the tests a financial entity's programme can include, and Article 24(6) requires yearly appropriate tests on systems that support critical or important functions. The entity picks the tests by risk.
What is TLPT?
Threat-led penetration testing is advanced testing on live production systems. Under Article 26(1), selected financial entities run it at least every 3 years. Authorities validate the scope, and Article 27 sets conditions for the testers.
Does TLPT apply to a SaaS vendor?
Not unless the vendor is a financial entity that an authority has selected. A SaaS vendor that sells to banks is an ICT supplier. Bank customers may still ask for test evidence through contracts.
Can a standard pentest count as TLPT?
No. A web and API pentest is narrower and does not follow the TLPT process. Ask a provider whether it has run TLPT, and what the RTS asks of testers.
Sources
- EIOPA: Digital Operational Resilience Act (DORA) (checked 9 November 2026)
- DORA Article 24 (unofficial mirror of the Regulation text) (checked 9 November 2026)
- DORA Article 25 (unofficial mirror) (checked 9 November 2026)
- DORA Article 26 (unofficial mirror) (checked 9 November 2026)
- DORA Article 27 (unofficial mirror) (checked 9 November 2026)
- PentestCompare provider dataset (each row links to its provider sources) (checked 9 November 2026)
Compare like with like
An automated scan, a manual test and annual credits are different units. Check scope, delivery and retest terms before price.