# DORA penetration testing companies

Source: https://pentestcompare.com/compliance/dora/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

DORA penetration testing providers that mention DORA on their own pages, A to Z, with sources and dates, plus TLPT versus yearly testing in plain words.

> **Short answer:** DORA has two layers of testing: a yearly resilience programme that can include penetration tests, and threat-led penetration testing (TLPT) for entities that authorities select. This page lists pentest providers whose own pages mention DORA, A to Z, with check dates. A DORA mention is not proof of TLPT delivery, so ask each provider about TLPT directly.

DORA penetration testing companies describe their DORA work in very different ways. Some name threat-led penetration testing (TLPT), most mention DORA in a list of frameworks. The table lists providers whose own pages mention DORA, in A to Z order with no ranking. Each row shows the facts we could source, and "Not published" where a provider says nothing. Facts were checked on 9 November 2026. This page is not legal advice.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [BreachLock](https://pentestcompare.com/providers/breachlock/) | PTaaS platform | hybrid | yes | yes | yes | unknown | custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting. | on request |
| [Bugcrowd](https://pentestcompare.com/providers/bugcrowd/) | PTaaS platform | hybrid | yes | yes | yes | yes | custom quote | Tests launch in under 72 hours; Standard: launch within 3 business days. | Standard: one year of retesting with one report revision, for web apps, networks and APIs only. Plus: same terms for every asset type. Max: same as Plus. | public |
| [HackerOne](https://pentestcompare.com/providers/hackerone/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | custom quote | Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends. | Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording. | not published |
| [Hadrian](https://pentestcompare.com/providers/hadrian/) | Autonomous testing platform | hybrid | yes | unknown | unknown | unknown | From EUR 1,250 per test, excluding VAT | Most tests finish within 24 to 48 hours; same-day start possible. | Not published | not published |
| [Pentest-Tools.com](https://pentestcompare.com/providers/pentest-tools/) | Vulnerability scanning and pentest platform | hybrid | yes | yes | yes | yes | from $96 per month, 16 assets | Not published | Unlimited rescans on all paid plans (tool scans). | not published |
| [Schellman](https://pentestcompare.com/providers/schellman/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the page. | public |
| [Secure Ideas](https://pentestcompare.com/providers/secure-ideas/) | Consultancy | human-led | yes | yes | unknown | unknown | $8,160 per test (flat fee, starting) | Testing usually starts two to four weeks after contracting; one to two weeks of testing. | Not included by default; retesting is listed as a factor that can change the quote. | public |
| [Securitum](https://pentestcompare.com/providers/securitum/) | Consultancy | human-led | yes | unknown | yes | yes | 640 EUR to 890 EUR per man day | Not published. Typical engagement length is 1 to 4 weeks for a single application or area. | Not published | public |

## What does DORA ask for?

DORA is Regulation (EU) 2022/2554, dated 14 December 2022, and EIOPA states that it "entered into application on 17 Jan 2025". The testing rules sit in two layers. Articles 24 and 25 cover a digital operational resilience testing programme, with yearly tests on systems that support critical or important functions. Articles 26 and 27 cover TLPT, which selected entities run at least every 3 years.

We read the articles on an unofficial mirror because EUR-Lex blocks automated fetches. Check wording on EUR-Lex before you rely on it. The plain-words explanation is on [DORA penetration testing at penetrationtestservices.com](https://penetrationtestservices.com/guides/dora-penetration-testing/).

| Layer | Articles | What it is |
|---|---|---|
| Resilience testing programme | 24 and 25 | Risk-based tests, which can include penetration tests, run yearly on key systems |
| TLPT | 26 and 27 | Advanced testing on live production systems, at least every 3 years for selected entities |

## Who needs a DORA test, and when?

Financial entities in scope of DORA run the resilience programme. Competent authorities select the entities that run TLPT, using factors such as impact on the financial sector, systemic importance and ICT risk profile. A SaaS vendor is not subject to TLPT unless it is a financial entity.

A supplier to a bank still meets DORA through its customers. Expect contract clauses and questionnaires that ask for test evidence. A normal pentest report answers part of that request. It is not TLPT.

## What should you ask DORA pentest providers?

Ask for these answers in writing.

| Question | Why it matters |
|---|---|
| Have you run TLPT, and under which authority's process? | A DORA mention does not show TLPT experience. |
| How do you meet the tester conditions in Article 27? | Authorities check the testers. |
| Do you run tests on live production systems? | TLPT covers production, which needs a risk plan. |
| Who contracts the testers if we use internal staff? | Article 26(8) requires external testers every three tests for entities that use internal ones. |
| What does the report contain, and can we share it with a customer? | Reports hold sensitive detail. |
| How do you handle retest and remediation checks? | Compare the Retest column below with the quote. |

## What drives the price?

Price follows the number of critical functions in scope, the systems behind them, the threat intelligence work, the length of the live test and the retest terms. Providers in this table mostly quote after scoping. The "Published price" column shows a figure only where a provider lists one. See [penetration testing cost](/guides/penetration-testing-cost/) for the ranges we sourced.

## How do you read the table?

A provider appears when its own pages mention DORA. The mention may refer to a service, a compliance page or a feature list, so click a provider name for its source and the date we checked it. The dataset records TLPT mentions apart from DORA mentions, so a provider that names only TLPT, such as usd AG, is not in this table. Read the provider row, then ask the question in the table above.

Providers sort A to Z, and no provider pays for a position. Read [how we compare](/methodology/) for the rules. For related frameworks, see [SOC 2](/compliance/soc-2/) and [ISO 27001](/compliance/iso-27001/).

## What do authorities and customers check in the report?

Authorities validate the TLPT scope before testing starts. After testing, they and the entity's customers read the output as evidence. Ask the provider what a report holds: scope, test window, method, findings with evidence, closure status and the testers' conditions under Article 27. A red team report differs from a standard pentest report, so see [red teaming](/services/red-teaming/) if you need the broader exercise.

## Questions

### Does DORA require a penetration test?

Article 25 lists penetration testing among the tests a financial entity's programme can include, and Article 24(6) requires yearly appropriate tests on systems that support critical or important functions. The entity picks the tests by risk.

### What is TLPT?

Threat-led penetration testing is advanced testing on live production systems. Under Article 26(1), selected financial entities run it at least every 3 years. Authorities validate the scope, and Article 27 sets conditions for the testers.

### Does TLPT apply to a SaaS vendor?

Not unless the vendor is a financial entity that an authority has selected. A SaaS vendor that sells to banks is an ICT supplier. Bank customers may still ask for test evidence through contracts.

### Can a standard pentest count as TLPT?

No. A web and API pentest is narrower and does not follow the TLPT process. Ask a provider whether it has run TLPT, and what the RTS asks of testers.

## Sources

- [EIOPA: Digital Operational Resilience Act (DORA)](https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en)
- [DORA Article 24 (unofficial mirror of the Regulation text)](https://www.digital-operational-resilience-act.com/Article_24.html)
- [DORA Article 25 (unofficial mirror)](https://www.digital-operational-resilience-act.com/Article_25.html)
- [DORA Article 26 (unofficial mirror)](https://www.digital-operational-resilience-act.com/Article_26.html)
- [DORA Article 27 (unofficial mirror)](https://www.digital-operational-resilience-act.com/Article_27.html)
- [PentestCompare provider dataset (each row links to its provider sources)](https://pentestcompare.com/methodology/)