Cyber Threat Intelligence

DORA (Digital Operational Resilience Act) is an EU regulation designed to enhance the digital resilience of financial entities by establishing harmonized requirements for ICT risk management, incident reporting, security testing, and oversight of third-party ICT providers. The regulation, which entered into force on 17 January 2025, places strong emphasis on the use of cyber threat intelligence as an integral part of financial entities’ security operations. One of its core pillars focuses on information-sharing arrangements, encouraging voluntary collaboration among trusted parties in the financial services community. 

Threat intelligence also plays a central role in Threat-Led Penetration Testing (TLPT) mandated under DORA. The DORA Regulatory Technical Standards (RTS) on TLPT, effective 8 July 2025, require a dedicated threat intelligence phase to be completed before conducting red team assessments. The results in a Targeted Threat Intelligence (TTI) report outlining the relevant threat landscape, aligned with the TIBER-EU Framework (updated February 2025). 

By leveraging cyber threat intelligence, financial institutions subject to DORA can proactively strengthen their defenses against emerging cyber threats. In particular, threat intelligence helps you:

• Stay ahead of threats: Obtain early insight into potential attacks, enabling proactive rather than reactive security measures.
• Prioritize resources: Focus cybersecurity investment and attention on the most critical threats to your organization, sector, or region.
• Share information securely: Participate in trusted information-sharing communities to enhance collective resilience across the financial ecosystem.

Enable TLPT compliance: Support DORA-mandated TLPT activities with intelligence-driven attack scenarios aligned with TIBER-EU requirements.

Leveraging our deep expertise in cyber threat intelligence and red teaming, Deloitte Luxembourg helps financial institutions build intelligence-driven security operations that fully meet regulatory expectations.

Our threat intelligence services include:

• Threat landscape assessments: Comprehensive analysis of threats targeting your organization, industry, and region.
• Targeted Threat Intelligence (TTI) Reports: DORA-compliant threat intelligence deliverables TLPT exercises, aligned with TIBER-EU 2025 and TIBER-LU frameworks.
• Strategic, operational and tactical intelligence: From executive-level insights to real-time indicators of compromise (IoCs), and malware analysis.
• Information sharing arrangements: Support in establishing and facilitating secure intelligence-sharing groups within trusted financial-sector communities, as encouraged under DORA.
• Threat intelligence integration: Seamless integration of intelligence feeds and processes into your existing SIEM, EDR, and SOAR platforms.
• Continuous monitoring: 24/7 threat monitoring and analysis through Deloitte's global Cyber Intelligence Centre.