TIBER-EU (Threat Intelligence-Based Ethical Red Teaming for the European Union) is the European Central Bank's framework for intelligence-led red teaming of financial entities, run with national central banks and adapted under national names such as TIBER-DE and TIBER-NL. Since early 2025 it is aligned with the Digital Operational Resilience Act (DORA), which mandates threat-led testing for critical financial entities. The list below opens with our Featured partner, clearly labelled, followed by the wider set of providers with documented TIBER-EU capability in our directory.
Related: Threat-led penetration testing (TLPT) · DORA threat-led testing · CBEST-accredited companies
TIBER-EU is the European framework for threat intelligence-based ethical red teaming, run by the ECB and national central banks across the EU. It is designed to work the same way in every jurisdiction, with each country able to adapt it under its own name (TIBER-DE, TIBER-NL, TIBER-IT, and so on) and extend it beyond finance to sectors like telecoms or energy. In early 2025 it was updated to align with DORA.
A TIBER-EU engagement runs across three phases (Preparation, Testing, and Closure) and can take between 24 and 27 weeks, with the active red team testing phase lasting two to three weeks. It is delivered by separate threat intelligence and red team providers that meet national procurement requirements, and, like DORA TLPT, does not produce a pass or fail result.
The providers below have documented TIBER-EU capability in our directory. Because national implementations set their own provider requirements, confirm a supplier's eligibility for the specific national scheme (for example TIBER-DE or TIBER-NL) you need before appointing them.
UK offensive security consultancy delivering CREST-accredited penetration testing, adversary simulation and CBEST, TIBER-EU and TBEST threat-led testing, mainly for financial services and other large organisations.
World-renowned cybersecurity firm now part of Google Cloud, delivering threat intelligence-led penetration testing and red teaming informed by front-line incident response experience.
Cybersecurity division of the Thales Group, with ANSSI, CREST, FedRAMP 3PAO, and NATO-cleared personnel. Defence, government, and critical infrastructure penetration testing worldwide.
Helsinki-headquartered Finnish cybersecurity firm with roots dating to 1988, offering CREST-accredited penetration testing and deep expertise in EU regulatory compliance including GDPR, NIS 2, and TIBER-EU.
Global risk advisory firm with a 400+ person cyber practice. IR-led penetration testing that feeds active breach intelligence straight into test scoping.
Airbus group cybersecurity consultancy with ANSSI PASSI qualification. Aerospace, defence, and critical infrastructure penetration testing across Europe.
TIBER-EU (Threat Intelligence-Based Ethical Red Teaming for the European Union) is the European Central Bank's framework for intelligence-led red teaming of financial entities. It is run with national central banks, adapted under national names such as TIBER-DE and TIBER-NL, and since early 2025 is aligned with the Digital Operational Resilience Act (DORA).
DORA's threat-led penetration testing (TLPT) requirement is built directly on TIBER-EU. Competent authorities decide which critical financial entities must carry out TLPT, and those entities test at least every three years with a red teaming phase of at least 12 weeks. TIBER-EU provides the methodology.
TIBER-EU uses separate threat intelligence and red team providers that meet national procurement guidelines. Requirements vary by national implementation (for example TIBER-DE or TIBER-NL), so confirm a provider's eligibility for the specific scheme you need.
A TIBER-EU engagement runs across three phases (Preparation, Testing, Closure) and typically takes 24 to 27 weeks end to end, with the active red team testing phase lasting two to three weeks.