Preparing for TIBER-EU and CBEST

For financial institutions preparing for TIBER-EU or CBEST, readiness depends on how well security, operations and risk teams respond when an attacker gets further than expected.

What TIBER-EU and CBEST Test

Threat-led penetration testing (TLPT) uses intelligence about relevant attackers to simulate how they might compromise an organisation and threaten its critical operations.

The objective is broader than identifying vulnerabilities in individual systems. These assessments examine whether an organisation can prevent, detect and respond to credible attacks against the people, processes and technology supporting its important services.

Two established frameworks shape this work in European financial services.

TIBER-EU: Europe's Framework for Realistic Adversarial Testing

The European Central Bank's TIBER-EU framework stands for Threat Intelligence-based Ethical Red Teaming.

It uses intelligence about real attackers and their tactics, techniques and procedures to design controlled attacks against an organisation's critical functions.

A small control team manages the engagement with the relevant authority, while the defending security team is generally unaware of the test during its active phase.

This allows assessors to examine how the organisation's normal controls and response processes operate.

The ECB updated TIBER-EU in 2025 to align it with the TLPT requirements under the EU's Digital Operational Resilience Act (DORA).

Under DORA, selected financial entities must conduct advanced TLPT at least every three years, subject to supervisory adjustment. The detailed requirements are established in Commission Delegated Regulation (EU) 2025/1190.

CBEST: The UK Approach to Testing Financial Resilience

CBEST is the UK financial sector's intelligence-led testing framework, used by the Bank of England, Prudential Regulation Authority and Financial Conduct Authority.

Its scope is anchored to important business services and the systems, people and processes supporting them.

The assessment follows four broad phases: initiation, threat intelligence, penetration testing and closure.

During testing, assessors simulate relevant adversary behaviour against live environments, while a designated Control Group manages risk and coordinates with the regulators.

The CBEST Implementation Guide explains the requirements, responsibilities and deliverables.

Although both frameworks use intelligence-led adversarial testing, their supervisory arrangements differ.

Neither framework should be treated as a simple pass-or-fail exercise. Their value lies in identifying weaknesses that can be addressed before attackers exploit them.

For organisations operating across the EU and UK, engagement requirements and potential recognition arrangements should be agreed with the relevant authorities.

The Bank of England Has Already Shown Where Teams Struggle

Financial institutions don't have to guess which weaknesses matter during realistic adversarial testing.

The Bank of England's 2025 CBEST thematic review examined findings from 13 assessments across financial firms and market infrastructures.

The findings covered five areas, including identity and access management, network security, infrastructure protection, detection and response, and staff awareness.

Several weaknesses are particularly relevant to preparation.

(1) Privileged access remained a problem. Overly permissive accounts and weak credential controls created opportunities for attackers to escalate privileges and move through networks.

(2) Detection gaps gave attackers room to operate. Poorly tuned endpoint monitoring, insufficient network visibility and weaknesses in detecting data exfiltration affected organisations' ability to recognise malicious activity.

(3) Network segmentation wasn't always effective. Inadequate separation of critical systems increased the potential consequences of a compromise.

(4) People and processes could be exploited. Social engineering, exposed credentials and weaknesses in helpdesk verification created opportunities for attackers to bypass otherwise established controls.

The report also identified third-party compromise, social engineering and malicious insider activity as frequent scenario themes.

Start With the Service an Attacker Could Disrupt

A common preparation mistake is building every scenario around a fashionable threat actor or attack technique.

A more useful starting point is the business consequence.

• For a bank, that might be disruption to customer payments. 
• For an insurer, it could be unauthorised changes to claims records. 
• For an asset manager, it may involve access to valuation data or interference with portfolio reporting.

Choose an important service and establish what supports it.

That includes applications, infrastructure, privileged identities, supplier connections and the people responsible for operational decisions. Then consider how an attacker could compromise one of those dependencies.

Turn Threat Intelligence Into a Relevant Scenario

Threat intelligence should establish why a particular attack path deserves attention.

If intelligence indicates that threat actors are exploiting outsourced service providers to gain access to financial organisations, consider whether your environment has comparable dependencies.

Which suppliers hold privileged access? How is that access monitored? Could the SOC identify unusual use of those accounts?

The ECB's targeted threat intelligence guidance sets out how intelligence informs realistic scenarios under TIBER-EU.

For internal preparation, a shorter intelligence brief can serve a similar planning purpose. Include the relevant threat behaviour, supporting sources, the business service at risk and assumptions that still need validation.

Prepare the People Responsible for Keeping the Test Safe

Threat-led testing introduces an unusual operational challenge. The organisation is deliberately allowing authorised attackers to test its defences while continuing to operate essential financial services.

That requires careful control. Under TIBER-EU, a small control team manages the engagement in coordination with the relevant authority. CBEST uses a Control Group with comparable responsibilities under its own framework.

These teams need enough technical and business knowledge to understand the consequences of testing activity. They also need the authority to manage unexpected situations.

Build the Skills the Assessment Will Depend On

Formal testing reveals how an organisation performs under specific conditions. Internal preparation offers an opportunity to improve the capabilities that will be examined.

For security teams, that usually means combining focused technical practice with exercises involving wider operational decisions.

Give Analysts Evidence They Have to Interpret

A useful investigation exercise should require more than identifying an obvious malicious indicator.

Consider an identity-based intrusion affecting an outsourced financial application.

The analyst receives authentication records showing unusual access. Application logs contain unexpected activity, but a legitimate maintenance operation occurred during the same period.

The task is to establish which events are related and whether the evidence supports escalation.

Introduce a second, legitimate account performing similar activity.

Can the analyst distinguish the two?

Then provide evidence suggesting that the suspicious account accessed sensitive records.

Can the team establish which records were affected and whether information actually left the environment?

These questions test evidence analysis, correlation and the ability to make supported decisions.

The team should also recognise what its sources cannot establish.

A supplied log file can demonstrate whether analysts interpret events correctly. It cannot prove that production logging would capture the same events during a real intrusion.

Rehearse the Response Beyond the SOC

Once analysts identify suspicious activity, bring service owners and incident leaders into the exercise.

Ask the team to recommend an appropriate containment action, explain its consequences and obtain the necessary approval.

If the affected account also supports a legitimate business process, the response needs to account for that dependency.

Observe whether participants can find the relevant owner, communicate the risk and verify the action taken.

This is where a technically competent investigation can run into operational difficulties.

The decision may be clear to the SOC, while the authority or business context needed to execute it sits elsewhere. Testing that handoff is just as important as testing the original alert.

Keep Formal Testing and Internal Practice Separate

A strong preparation programme doesn't attempt to recreate the exact confidential scenario an assessor will use.

Instead, it strengthens the broader capabilities the organisation needs against plausible threats.

That could involve practising compromised supplier access, unusual privileged activity, data exfiltration investigations or cross-team containment decisions.

The formal engagement should continue through its approved governance process, with its scope and scenario confidentiality protected.

There is also a place for purple teaming, where offensive and defensive specialists work together to understand findings and improve controls.

Under TIBER-EU's purple-teaming guidance, collaboration during active testing is subject to specific conditions, while the closure phase provides a more structured opportunity for learning.

Internal training can use collaborative methods more freely, provided it remains separate from the confidential formal assessment.

That distinction protects the integrity of the test while allowing the institution to continue developing its security capabilities.

The Result Is Only Useful if Something Changes

A threat-led assessment may reveal weaknesses the institution already suspected.

Perhaps an important service account has excessive permissions. The SOC may struggle to recognise activity involving a trusted supplier, or the incident commander may lack a reliable way to assess the impact of containment.

The important question is what happens next.

The ECB's remediation plan guidance emphasises ownership, prioritisation, corrective measures and the handling of identified risks.

The Bank of England's 2025 CBEST thematic review similarly recommends moving beyond isolated technical fixes towards addressing underlying weaknesses.

For internal preparation, apply the same discipline. A finding should explain what happened, why it matters and what would demonstrate that the correction works.

For example:

The SOC identified suspicious supplier access but could not retrieve the application audit records needed to establish whether valuation data was changed.

The response might involve correcting permissions, updating the investigation procedure and testing whether analysts can retrieve and interpret the records during a repeat scenario.

That gives the institution a measurable improvement. Keep evidence of the retest alongside the original finding, including any differences in the environment or assistance provided.

The result becomes much more useful when a risk owner can see how the action changed the team's ability to respond.

Give Your Defenders a Better Chance Before the Assessment

Financial institutions can reduce avoidable weaknesses by giving their security teams repeated opportunities to investigate realistic threats, make consequential decisions and learn from the results.

TryHackMe's Live Breach Exercises provide that kind of hands-on preparation through controlled incidents reflecting an organisation's relevant threats, tooling and response workflows.

Teams work through investigation, containment, eradication and recovery, with evidence-led reporting that identifies where performance can improve.

For institutions that want to rehearse escalation, approvals and cross-functional decisions, Tabletop Exercises offer a complementary way to test coordination before an incident.