Crypto-Asset Regulation · glossary

Threat-led penetration testing

A controlled attack on a firm's live systems by an independent tester, the way a real attacker would try. Halcyon must run one at least every three years only if the Central Bank designates it. Ordinary scans and scenario tests run anyway. Binder §9.5 · Chapter 9

Explained in Chapter 9, DORA: When the Systems Fail, of Crypto-Asset Regulation.

How it comes up, in Chapter 9
The scans and scenario tests run whatever happens. Threat-led penetration testing is a step above. An independent tester attacks the live systems, under control, the way a real attacker would. Halcyon must do it only if the Central Bank designates it, and the test is expensive for a small firm.
Read Chapter 9, DORA: When the Systems Fail →

Chapter 1 and this glossary are open to everyone; the whole edition is free to read with a free account until 31 January, and it stays open to an account opened by then.

Related terms

Where this term lives

This term is part of one complete fictional deal, with every document attached and a test after every chapter. Open Crypto-Asset Regulation → · All terms A–Z →