TIBER-EU TTIR: New ECB guidelines for threat intelligence reports

In February 2025, the European Central Bank published updated guidelines for preparing the Targeted Threat Intelligence Report (TTIR) within the TIBER-EU framework. This document is a key element of digital resilience testing for financial institutions and has direct implications for NIS2 and DORA compliance. In this article, we will analyze the new guidelines in detail and their practical implications for organizations operating in the financial sector.

What is TIBER-EU and why is TTIR critically important?

TIBER-EU (Threat Intelligence-Based Ethical Red Teaming) is a European framework for conducting advanced penetration tests based on real threat intelligence. Unlike standard penetration testing, TIBER-EU requires that attack scenarios be based on real threats specific to a given organization.

Targeted Threat Intelligence Report (TTIR) is the foundation of the entire testing process. This report provides:

• Contextual analysis of the threat landscape for a specific institution
• Threat actor profiles and their motivations
• Attack scenarios based on real adversary techniques
• The basis for red team testers to operationalize tests

According to the new ECB guidelines, TTIR serves as the starting point for red team testers (RTT) to develop and execute realistic attack scenarios during the active testing phase.

📚 Read the complete guide: SOC: Security Operations Center - what it is, how it works, how to choose

Required TTIR content according to new guidelines

The ECB precisely specifies which elements a properly prepared TTIR must contain:

1. Scope of intelligence research

The report must clearly define:

• Critical or important functions (CIF) covered by the test scope
• Geographic location of the systems under investigation
• Official language used in the organization
• Significant ICT service providers (external providers)
• Time period during which research was conducted

2. Assessment of available intelligence information

TTIR should contain a comprehensive analysis of information that could be exploited by attackers:

• Employee usernames and passwords found on the internet
• Look-alike domains that could be confused with the institution’s official domains
• Technical reconnaissance: vulnerable and/or exploitable software, systems, and technologies
• Information published by employees on social media
• Dark web data concerning the organization
• Information about physical access to buildings (when relevant)

3. Threat landscape analysis

The document requires consideration of:

• Geopolitical environment
• Economic environment
• Technological trends affecting the financial sector

4. Threat actor profiles

Each TTIR must contain detailed threat actor profiles:

• Identification of specific groups or threat classes
• Organization systems most vulnerable to compromise
• Motivations and intentions of potential attackers
• Modus operandi (tactics, techniques, and procedures - TTP)

5. Threat scenarios

New guidelines require a minimum of three comprehensive scenarios for the highest-risk threat profiles:

Scenario type	Impact area	Example
Scenario 1	Service availability	DDoS attack on payment systems
Scenario 2	Data integrity	Manipulation of transaction data
Scenario 3	Information confidentiality	Exfiltration of customer data

Additionally, the guidelines introduce the concept of “Scenario X” - a forward-looking scenario based on anticipated future threats.

Intelligence gathering process - key sources

The ECB points to a multidimensional approach to information gathering:

OSINT (Open Source Intelligence)

Intelligence from publicly available sources including:

• Analysis of employee social media
• Technical infrastructure research (DNS, SSL certificates, etc.)
• Monitoring of industry forums and the darknet

HUMINT (Human Intelligence)

Information obtained from human sources - while maintaining ethical standards of operation.

Business Overview

The organization should provide the Threat Intelligence Provider (TIP) with:

• Explanation of critical business functions and their significance to the sector
• Own threat assessment along with incident history
• Information about the business model and organizational structure
• Data on dependencies on external suppliers

Integration with MITRE ATT&CK

The new ECB guidelines clearly indicate the need to use the MITRE ATT&CK framework as a model for developing threat scenarios. Each scenario should be mapped to specific:

• Tactics - the attacker’s strategic objectives
• Techniques - methods of achieving objectives
• Procedures - specific implementations of techniques observed in real attacks

Example mapping from the ECB document:

Actor	Target/Flag	Tactic	Technique	Procedure
APTxx (Nation State)	Exfiltration of sensitive data	Exfiltration	Automated Exfiltration	Machete - automatic exfiltration to remote servers

TTIR and NIS2 and DORA compliance

Although the ECB document is not directly a NIS2 regulation, it has significant compliance implications:

Supporting NIS2 requirements

The NIS2 Directive requires operators of essential services to:

• Manage cybersecurity risk
• Protect critical services
• Analyze threats
• Conduct regular resilience testing

TTIR provides structured data supporting all these areas through:

• Documenting threat analysis in a standard format
• Providing the basis for risk assessment
• Preparing for compliance audits

Meeting DORA requirements

The ECB document explicitly states that TTIR meets the minimum TLPT requirements (Threat-Led Penetration Testing) arising from the DORA regulation. This is key information for financial institutions that must conduct advanced penetration testing.

Note from the ECB document:

“In addition to the minimum requirements for complying with the TLPT obligations under DORA, this document also includes operational TIBER-EU guidance based on best practices, knowledge and experience from numerous previous tests.”

Practical aspects of TTIR preparation

Role of the Threat Intelligence Provider (TIP)

The Threat Intelligence Provider is responsible for:

1. Gathering intelligence information
2. Analysis and contextualization of data
3. Identification of relevant threat actors
4. Development of test scenarios
5. Delivery of the final TTIR report

Process timeline

According to ECB guidelines, the threat intelligence phase typically lasts 4-6 weeks and includes:

Week 1-3: Intelligence gathering and scenario creation
Week 3-4: Scenario selection meeting (shortlist)
Week 4-6: TTIR finalization
→ Approval by TIBER authority

Collaboration with the control team

The Control Team (CT) and Test Manager (TM) of the organization should:

• Provide TIP with information specified in the Scope Specification Document (SSD)
• Participate in scenario selection meetings
• Verify and approve the final TTIR

Consideration of ICT providers

New guidelines place particular emphasis on risk associated with external suppliers. TIP should analyze:

• Which external suppliers have been previously compromised?
• How could a supplier compromise enable an attack on the organization?
• Which ICT services supporting critical functions could serve as an attack vector?

In the case of multi-party tests involving an ICT provider, at least one scenario must concern that provider’s systems, processes, and technologies.

Implications for European financial institutions

For organizations covered by TIBER requirements (national implementations of TIBER-EU), the new guidelines mean:

1. Need to update processes - adapting testing procedures to new requirements
2. Greater emphasis on third-party risk - analysis of supplier-related risk
3. Integration with DORA compliance - using TTIR as an element of regulatory compliance
4. Investments in threat intelligence - ensuring access to high-quality threat intelligence

Summary

The new ECB guidelines for TIBER-EU TTIR represent another step toward increasing the digital resilience of the European financial sector. The document provides:

• Clear structure for threat intelligence reports
• Specific requirements for TTIR content
• Practical guidance for intelligence providers and organizations
• Links to regulations NIS2 and DORA

For organizations planning TIBER-EU tests or preparing for DORA requirements, familiarizing themselves with the new guidelines is essential. The document serves as a practical tool for documenting threat analysis, risk assessment, and preparing for compliance audits.

---

Need support in preparing for TIBER-EU tests or DORA compliance? Our experts offer comprehensive services in threat intelligence, penetration testing, and compliance consulting. Contact us to discuss your organization’s needs.

Related Terms

Learn key terms related to this article in our cybersecurity glossary:

• OSINT — OSINT, or Open Source Intelligence, is the process of collecting, analyzing,…
• Security Operations Center (SOC) — Security Operations Center (SOC) is a central location where a team of security…
• SOC as a Service — SOC as a Service (Security Operations Center as a Service), also known as…
• Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
• IT Infrastructure Penetration Testing — IT infrastructure penetration testing is a controlled and ethical process of…

---

Learn More

Explore related articles in our knowledge base:

• KSC NIS2 vs. software house: Why is audit from the customer the new business reality?
• TLPT Cybersecurity Testing Based on Cyber Intelligence
• Cybersecurity certifications: Which ones really build value and competence in a team?
• Digital Operational Resilience Act (DORA)
• DORA compliance: the role of penetration testing and advanced TLPT testing

---

Explore Our Services

Need cybersecurity support? Check out:

• SOC as a Service - 24/7 security monitoring
• Incident Response - rapid response to security incidents

---

Cybersecurity for Your Industry

Learn more about cybersecurity in your industry:

• Cybersecurity for Finance & Banking

---

Related topics

See also:

• NIS2 for hospitals — compliance