Continuous ICT resilience testing for DORA compliance
DORA has required continuous technical testing of ICT systems from financial entities since January 17, 2025.
Pentest-Tools.com produces the evidence: scheduled assessments with timestamps, Confirmed findings backed by proof, retests after remediation, and exports that feed GRC tools.
What does DORA actually require?
DORA applies to more than 20 categories of financial entities in the EU, including banks, insurers, investment firms, payment institutions, and crypto-asset service providers, as well as the critical ICT providers that serve them. Six articles define the technical testing obligation.
Article 25: testing of ICT tools and systems
Requires a range of assessments, including vulnerability assessments, network security testing, and application-based testing, run on a cadence appropriate to the entity's risk profile.
Article 6: ICT risk management framework
The umbrella obligation. Financial entities must maintain a framework with continuous testing and improvement.
Article 24: general testing programme
Testing must be appropriate, comprehensive, with ICT systems supporting critical functions tested at least once a year. You can’t just say “we ran a scan last year.”
Articles 26-27: threat-led penetration testing (TLPT)
Applies only to entities identified by their competent authority. Requires advanced threat simulation with a scope agreed with supervisors.
Article 19: incident reporting clock
Once an incident is classified as major, the entity has 4 hours for the initial notification, 72 hours for the intermediate report, and one month for the final (set by Article 19 and RTS (EU) 2025/301).
Article 28: third-party ICT risk
Financial entities must assess their ICT providers against this article.
Where the DORA evidence gap lives
Vulnerability scanning and DORA compliance aren't the same thing.
Scanning is the start of the evidence chain, not the end. Most DORA compliance teams run into the same four problems:
GRC tools collect policies, not proof
They track that you scheduled a vulnerability assessment, logged a finding, and opened a ticket. They don't prove the vulnerability was real, that the fix actually worked, or that the exposure no longer exists. That gap is exactly what DORA supervisors are now probing.
Manual pentests produce a report valid for the day it was written
DORA's continuous assessment requirement makes it structurally insufficient - a quarterly snapshot doesn't tell a supervisor what your exposure looks like today.
Noisy scanners delay audit evidence
Noisy automated scanners create triage work without generating the evidence supervisors need. The more false positives a tool creates, the longer it takes for validated findings to reach an auditor.
Scanning creates work downstream
This happens in triage, verification, reformatting, and it does so without answering the questions a supervisor actually asks: was the vulnerability real, was it fixed, and is the fix still holding?
How Pentest-Tools.com closes the DORA evidence loop
The evidence chain runs in four stages: proof the vulnerability existed, proof it was validated, proof it was remediated, and proof the fix held.
Evidence the vulnerability existed
Scheduled scanning ties every finding to a defined date, scope, and asset. The timestamp exists before anyone asks for it. Set assessments to run on a cadence that matches your DORA review cycle, and the scan record is automatically included in the evidence package.
For on-premises or private-network environments, the VPN Agent runs inside the deployment without requiring a permanent on-premises appliance. Banks and financial entities with strict network boundary requirements can run the same workflow internally.
Evidence it was validated
Sniper Auto-Exploiter validates findings and backs them up with HTTP request/response, PoC, or payload evidence. Meanwhile, the ML Classifier reduces false positives by 50%, so validated findings reach the auditor faster.
What reaches the auditor is not a list of flags. It's a list of verified vulnerabilities with the evidence attached.
Evidence it was remediated
After remediation, a targeted retest runs against the specific finding. The before/after comparison exports alongside the original findings.
The auditor sees what existed, what changed, and when. They don't get a ticket reference that requires chasing or a verbal assurance that the fix held.
Evidence the fix held
Scheduled rescans run the same assessment on the next cycle. If a fix regresses, it surfaces as a new finding with its own timestamp, rather than a gap that only appears at the next audit. The evidence chain remains up to date without manual intervention.
Vulnerability monitoring covers the intervals between scheduled scans, alerting on new exposures as they appear rather than at the next cycle. For DORA's continuous-assessment expectation, this is the difference between evidence that's current and evidence that's merely periodic.
Audit-ready exports in PDF, DOCX, or JSON reduce manual formatting work. Custom report templates let you format evidence the way your compliance framework and supervisors expect.
JSON integrates directly with GRC tools and ticketing systems - so you don’t need to send findings to your workflows manually.
Vulnerability validation built into the scan from the start
Pentest-Tools.com starts the verification work during the scan
As web and network scanning run, findings that can prove to be exploitable get a Confirmed label, backed by request/response data, payload traces, or a proof of concept you can examine. The rest stay unconfirmed, so you always know which is which.
When a finding needs more, validation continues in the same product
Deeper exploitation confirms real impact and also captures the evidence. Assessment and validation under the same roof means that the proof an auditor or a buyer asks for is already attached to the finding.
Why Pentest-Tools.com’s European origin matters under DORA
Pentest-Tools.com is ISO/IEC 27001:2022 certified and processes data in the EU, which answers one category of the Article 28 third-party assessment before it is asked.
Article 28 works in both directions
Under DORA’s third-party concentration risk requirements, where your ICT provider processes data is a procurement question. It feeds directly into the Article 28 assessments financial entities must conduct on their suppliers, and that works in both directions. When you evaluate Pentest-Tools.com, EU-resident processing answers one category of that question up front. When you run assessments with it, the validated evidence you generate feeds your own Article 28 reviews of the ICT providers downstream of you.
One less category of due diligence
EU data residency doesn't resolve every due diligence question, but it removes one category of them. GDPR alignment, jurisdictional risk, and data sovereignty obligations - including NIS2 Article 21(2)(d) supply-chain security requirements - are simpler to manage when your ICT provider operates within the same regulatory perimeter.
Certified and EU-based
Pentest-Tools.com is ISO/IEC 27001:2022 certified and processes data in the EU.
Proof Pentest-Tools.com supports DORA compliance
Benchmark-proven accuracy
Our Network Scanner ranked 1st in a Network Scanners Benchmark, across 128 environments, for having the highest remote detection accuracy against Qualys, Nessus, OpenVAS, and others.
Deep application scanning
The Website Vulnerability Scanner covers vulnerabilities like XSS, SQL injection, HTTP Prototype Pollution, Directory Traversal, and 75+ more vulnerabilities in running web applications.
Proven global scale
In 2025, Pentest-Tools.com ran over 6M scans across 2000+ security teams in 119 countries, and sent tens of thousands of reports and exports to clients, teammates, and stakeholders.
Certified security standards
Pentest-Tools.com is ISO/IEC 27001:2022 certified and produces the validated vulnerability evidence those controls depend on, continuously, across the full certification cycle.
What customers are saying
The scans run quickly and the dashboard is easy to use. I like the attack surface feature. Organizing your scans and data is very simple to follow. Being cloud-based, you can get to the tools from anywhere without lugging around a dedicated device. The ability to generate and customize reports is very helpful.
Dr. Patrick Johnson
Business Owner at True North Consulting Group
See the DORA evidence trail in action
Start collecting audit-ready evidence yourself, or get a personalized walkthrough for your team's complex environment.
DORA compliance FAQs
What is DORA?
DORA, the Digital Operational Resilience Act (Regulation (EU) 2022/2554), is EU legislation that has applied to financial entities since 17 January 2025. It sets requirements for ICT risk management, incident reporting, digital operational resilience testing, and third-party ICT risk. Its testing obligations require continuous technical assessment of ICT systems, not just documented policies.
Does Pentest-Tools.com cover DORA's TLPT requirement?
Partially. Pentest-Tools.com covers the infrastructure-based and application-based testing types enumerated in Article 25. DORA threat-led penetration testing (Articles 26-27) requires advanced threat simulation agreed directly with supervisors, which is a separate engagement.
For organizations subject to both, Pentest-Tools.com supports the reconnaissance, scanning, and automated validation phases that precede manual red team operations.
What does "continuous testing" mean in practice for DORA?
It means your evidence is always up to date, not just at the last audit.
In practice, that means scheduled vulnerability assessments on a cadence aligned with your risk profile, monitoring alerts for new exposures between scans, and retest workflows to confirm remediation was effective. The result is a reproducible evidence loop that a supervisor can follow from detection through to a confirmed fix.
What export formats are available for DORA evidence submissions?
PDF, DOCX, and JSON. Custom report templates let you structure evidence the way your supervisors expect without manual reformatting. The JSON export integrates with GRC tools and ticketing systems so findings flow directly into your existing workflow rather than requiring re-entry.
Is Pentest-Tools.com itself a third-party ICT provider under DORA?
Yes. As a SaaS product processing data on behalf of financial entities, Pentest-Tools.com falls within DORA’s ICT third-party risk framework under Article 28. We’re ISO 27001 certified and process data in the EU. Documentation for your third-party risk assessment is available on request from your account team.
Does Pentest-Tools.com work for critical ICT providers, not just financial entities?
Yes. Critical ICT providers must demonstrate their own ICT resilience to the financial entities that depend on them, providing technical evidence of ongoing vulnerability management.
Pentest-Tools.com helps deliver that evidence: continuous DORA vulnerability management, confirmed findings, and audit-ready exports. For providers with on-premises requirements, internal scanning via VPN Agent is available within the same workflow.
Which DORA articles does Pentest-Tools.com support?
Article 25 for vulnerability assessments, network security testing, and application-based testing; Article 24 for the annual testing of systems supporting critical functions; Article 6 for continuous testing within the ICT risk management framework; and Article 28, where validated evidence supports third-party ICT risk assessments in both directions. Threat-led penetration testing under Articles 26 and 27 is a separate engagement.