What a TIBER-EU test costs and what decides the total
The tested entity pays for the whole test, and the authority never does. The ESA estimate cited in the Commission's 2020 impact assessment (SWD(2020) 199) puts threat-led penetration testing at between 0.1 % and 0.3 % of the total ICT budget of the firms concerned, and the Banco de Espana's TIBER-ES guide states that the costs and risks are borne in all cases by the tested entity, never by the authorities adopting the framework. Treat that range as a planning figure for the budget owner, not a quote. No published price list exists for TIBER-EU tests, so the real total is set by the threat intelligence and red team provider quotes, the scope agreed with the test manager, the headcount your own teams must release, and the remediation work the findings trigger.
Those four cost sources are the ones the DNB and Bundesbank short read groups together: the threat intelligence provider, the red team provider, control team and operational staff hours (including replay and purple teaming), and investment to remediate findings, which may need new systems or services. Provider fees are one-time per test, but the test cycle recurs, and the framework treats three-year intervals as the norm, so budget the next cycle alongside the current one. Ask each provider to price its team against the minimum experience levels the procurement guidance sets, and to state separately what is included in a re-test or a purple teaming session. Hours cost less than fees, but the control team lead's weekly commitment across preparation, testing and closure is large enough to need a backfill decision before notification.
Scope drives the bill more than any other single factor. A test that covers more critical or important functions and flags, runs more scenarios, or touches third-party infrastructure needs more provider days and more control team time. Where entities share ICT systems or an intra-group provider, joint testing may reduce costs, and Article 16 gives host authorities a role in cross-border tests, which can affect coordination effort. Some jurisdictions charge oversight fees: for example, Riksbank regulation RBFS 2025:2, in force from 1 January 2026, sets an annual fee for entities Finansinspektionen has ordered to test, split 70% evenly across entities and 30% by balance sheet total. Confirm with your national authority whether any fee applies to you, and ask every provider for a written scope and day-rate breakdown before you sign.
Who is paid for each part of a TIBER-EU test
This table compares the main cost components of a TIBER-EU test by who is paid, whether the cost is one-time or recurring, and what moves the bill up or down. Read it as a checklist for asking providers and internal leads what each line includes. The main takeaway is that the tested entity carries all costs, and the test manager and authority do not receive provider fees.
| Cost component | Who is paid or who bears the cost | One-time or recurring | What drives it up or down |
|---|---|---|---|
| Threat intelligence provider | The tested entity pays the external provider it procures, through the control team's procurement | One-time per test, with the targeted threat intelligence report as the main deliverable | Scope size, number of scenarios, depth of entity-specific research, and the provider's team size and experience |
| Red team provider | The tested entity pays the external red team testers it procures | One-time per test, covering the test plan, at least 12 weeks of active testing, and reports | Number of flags and scenarios, parallel or sequential testing, whether the test is multi-party, and tester seniority |
| Control team and operational staff hours | Paid through the entity's own payroll or internal budget, including the control team lead and other members, blue team and operational staff | Recurring across all three phases, with replay and purple teaming in closure | Phase length, the lead's weekly hours (ECB Control Team Guidance gives indicative ranges), staffing gaps, and whether an external control team lead is used |
| Remediation investment | Paid by the tested entity to its own staff, vendors or new systems and services that fix findings | Mostly one-time per finding, though some fixes lead to ongoing licence or service costs | Number and severity of weaknesses found, existing tooling, and whether fixes need new systems or services |
| Authority fees (where charged) | Paid by the entity to the national authority, for example the Riksbank fee under RBFS 2025:2 (illustrative only) | Recurring annually where a country charges them | Rules set by each jurisdiction, such as the split used in the Riksbank regulation (70% shared evenly, 30% by balance sheet total) |
| Test manager and authority | Receive no provider fees from the entity; the costs they incur are part of the authority's own remit, as stated in the Banco de Espana guide | Not applicable to provider fees | Confirm with your authority which charges, if any, apply in your jurisdiction |
What makes a TIBER-EU test more or less expensive
The bill for a TIBER-EU test follows from a few decisions made early: what is in scope, how many entities test together, how large the external teams are, and how much the organization must fix afterward. Each driver below can be controlled before the authority's notification, which is the cheapest point to influence it.
Scope of functions and flags
The scope sets how many critical or important functions and flags the red team must try to reach, which drives threat intelligence work, scenario design and the length of active testing. Fix the scope in writing in the scope specification document before procurement starts, and ask the TIBER Cyber Team to confirm which functions fall in scope. A broader scope added late usually means re-scoping and re-procurement, so ask for every change to be priced separately.
Joint and multi-party testing
When several entities share ICT systems or an intra-group provider, a joint test can replace several separate tests. Article 16 of DORA lets host authorities follow a cross-border test or assign a test manager, and the framework prefers joint testing where it reduces costs. Ask the authority early whether a shared test is possible, and agree in writing who pays which share of provider fees and control team time.
Provider team size and references
The framework sets minimum reference counts and team experience for red team and threat intelligence providers, and a larger, more senior team costs more per week of testing. Compare quotes on the same named roles, experience levels and week counts, not on headline day rates. Ask each provider to show that its proposed team meets the minimums before you sign, because a team that falls short can block the contract.
Internal control team headcount
Internal staff time is a real cost even though no invoice arrives for it. The control team lead's time rises during red teaming, and every other member spends roughly half that lead's time, so the hours add up across three phases. Plan named people and their share of time in advance, and confirm whether backfill or overtime is needed for the blue team during active testing.
Evidence and systems maturity
Costs grow when logging, asset inventories and backups are incomplete, because the control team must then assemble evidence by hand and the test takes longer to reach a useful result. Review detection coverage, asset records and recovery procedures before the test, and budget for gaps you find. Ask providers how they will use your existing evidence so they do not repeat discovery work.
Remediation scale
Remediation is usually the largest unplanned cost, because findings may require new systems, services or contract changes. The size of the bill depends on how many weaknesses the red team reports and how deep they go into critical functions. Build a remediation budget and a prioritized plan during the closure phase, and ask the test manager to confirm which findings are mandatory to fix within the deadlines.
How many control team hours a test takes
The ECB's TIBER-EU Control Team Guidance gives a rough order of magnitude for the weekly time the control team lead spends in each phase: about 4 to 8 hours a week during the 24-week preparation phase, 8 to 16 hours a week during threat intelligence (4 to 6 weeks), 10 to 30 hours a week during red teaming (14 to 15 weeks), and 8 to 12 hours a week during the 18-week closure phase. Other control team members are expected to spend roughly half of the lead's hours. These are guidance ranges, not a budget. The actual figure depends on how many systems are in scope, how many flags the entity has agreed to defend, how many suppliers the test touches and how much replay and purple teaming the entity runs.
Treat the lead's hours as an internal cost even when the lead role is supported externally. An entity may bring in an outside control team lead or project support, but the entity still owns the control team and must make its own staff available for supervision, approvals, procurement decisions and evidence. Multiply the weekly ranges by the calendar length of each phase and by the number of people named in the control team, then add the hours of the blue team, operational staff and system owners who answer requests during testing. Ask the provider and the authority to confirm which tasks fall to the control team lead, and whether the entity's own budget should carry the time of staff who would otherwise do other work.
Use the ranges to ask two questions before any quote is signed. First, does the internal plan show named people with time reserved for each phase, including the weeks when red teaming peaks at the top of the range? Second, does the budget reflect a realistic share of the lead's time in the 24-week preparation phase, when procurement and scoping are slow and the framework expects the entity to anticipate resource and budget constraints. Hours that are not budgeted tend to be taken from the same staff who run live operations, so record the assumed hours in the business case and review them with the test manager at the end of scoping.
How scope and multi-party tests change the bill
A single entity test is the simplest structure: one tested entity, its own control team and blue team, and its own procurement of the threat intelligence provider and red team testers. The entity pays for every cost line directly, so the bill follows the scope it sets. Provider fees rise with the number of critical or important functions, flags and scenarios, and with the active testing period, which must be at least 12 weeks. Internal effort is concentrated in the control team, whose lead is expected to spend about 4 to 8 hours a week in the 24-week preparation phase and 10 to 30 hours a week during red teaming, according to the ECB's Control Team Guidance.
- Provider fees: The entity contracts and pays both providers, and the control team arranges procurement, so fees are not shared with anyone else.
- Shared costs: None. Every hour of control team, blue team and remediation work is charged to the one entity.
- Coordination effort: Limited to the entity, its authority and its providers.
- Remediation: Findings are fixed in the entity's own estate, which can require new systems or services.
- Scope lever: Narrowing scope lowers provider fees, but the framework does not allow scope to fall below its mandatory requirements.
Before approval, ask the provider to show how fees map to scenarios, flags and active testing weeks, so the entity can see what a scope change does to the quote.
A joint test covers several entities that share ICT systems or rely on an intra-group or shared provider, so one test serves more than one tested party. The TIBER-EU framework indicates that joint testing can reduce costs, because the threat intelligence and red team work is performed once against common infrastructure rather than repeated for each entity. The saving depends on how much of the attack surface is actually shared. Where each entity has its own systems, its own flags and its own control team, the savings shrink and the coordination burden grows.
- Provider fees: Typically negotiated once for the group, which can spread the fixed elements of the threat intelligence and red team work across entities. Ask whether the fee is per entity, per flag or per test.
- Shared costs: Threat intelligence reporting and the common scoping work can be reused, but each entity still needs its own attestation and remediation plan.
- Coordination effort: Rises with each added entity, since scope, flags, timelines and approvals must be agreed among all parties.
- Cost allocation: Agree in writing how fees and internal hours are split before procurement, including who pays if one entity changes scope.
- Control team: Each tested entity keeps its own control team and blue team, so internal hours do not fall in proportion to the fee savings.
Confirm the allocation method and who signs the contract before the group commits to a joint structure.
A cross-border test involves an entity whose home authority leads the test while another EU authority is the host. Under Article 16 of the TIBER-EU framework, a host TLPT authority has 20 working days after being informed to follow the test as an observer or to assign a test manager. The host choice affects coordination effort and the timeline more than the provider bill, but it still changes who must be consulted on scope, providers and reports. The framework also states that the tested entity bears the costs and risks in every case, and that authorities do not carry them.
- Provider fees: Usually unchanged in structure, but providers may need to meet the requirements of more than one authority, which can affect the scope of work and the reporting format.
- Authority involvement: An observer adds limited effort. A host test manager adds coordination meetings, document reviews and sign-offs.
- Timing: Build the 20 working day response window into the preparation plan, since scoping and procurement already take a long time.
- Language and documents: Translation and review of deliverables may add internal effort. Confirm which language each authority accepts.
- Joint testing: The framework prefers joint testing where entities share systems or an intra-group provider, so check whether a combined test is possible before running two separate ones.
Ask both authorities, in writing, how they will participate and what they expect the entity to fund internally.
Why procurement and budgeting start early
The control team arranges and budgets for procurement of the threat intelligence provider and the red team testers, so the entity carries the cost and the timing risk of hiring them. The ECB's SSM guide makes this a control team responsibility, and the test manager can refuse to let the control team contract a provider that does not meet Article 7(1) of the TLPT standards. Under the TIBER-EU Guidance for Service Provider Procurement, the minimum requirements include at least three references for the threat intelligence provider and at least five references for the red team provider, plus named team members with minimum years of experience. If a chosen provider fails that check, the entity must run procurement again, which adds time and fees to a schedule that is already long. Ask each shortlisted provider for written evidence of its references and team qualifications before you sign anything.
The framework strongly encourages the TIBER Cyber Team to contact the entity well before the written notification, because procurement and scoping take a long time. Treat that early contact as the start of your budget cycle, not the start of the test. Confirm with your authority which dates it expects for the initiation document and the scope specification document, and work backward from them to the point where a provider must be under contract. Procurement that starts after notification leaves the control team little room to recover from a refused provider.
The framework also says the entity needs to anticipate potential resource and budget constraints. Ask your finance and procurement teams to approve a budget envelope before notification, covering the threat intelligence provider, the red team provider, internal control team and blue team hours across the preparation, testing and closure phases, and a reserve for remediation work that may need new systems or services. Find out early whether your authority or national regulator charges any fee for oversight or attestation, because those amounts are set by the jurisdiction and can change the total. Ask providers to quote against a written scope and to state how a change in scope or a re-procurement would be priced.
What usually inflates the budget and how to avoid it
Most overruns on a TIBER-EU test come from decisions made late, not from the testing itself. The four pitfalls below share a cause: the entity meets a framework step with no budget, no defined scope or no plan for what comes after the findings arrive.
Late procurement forces rushed selection
The threat intelligence provider and red team testers must be procured before testing starts, and procurement is one of the slowest steps in the preparation phase. When the authority's written notification arrives with no market research done, the control team often accepts the first quotes it can get, which raises fees and weakens the choice of providers. The framework strongly encourages the TIBER Cyber Team to contact the entity well before written notification for this reason. Ask your authority early what it expects, and start the market search before the notification date.
Unclear scope expands during scoping
Scope drives nearly every line of the bill: the number of critical or important functions, the number of flags, the systems in the attack surface and the scenarios the threat intelligence provider must build. A scope that is still moving during scoping means more provider days, more control team hours and sometimes a second round of procurement. Fix the critical functions and flags in writing with the test manager before any quote is requested, and ask each provider to price against that written scope version only.
Remediation budget missing when findings arrive
Remediation is the cost category entities most often leave unfunded. Findings can require new systems, services or staff time, and the remediation plan is due within a fixed period after the authority's assessment. If no money is set aside before the test, the entity either delays fixes or pulls funds from other projects under deadline pressure. Set a remediation reserve during preparation, agree who approves spending on it, and map which findings would likely need new investment, so the board can decide on them quickly.
Treating closure work as optional
Closure is not a tidy-up step. It includes the red and blue team reports, replay, purple teaming, 360 degree feedback, the test summary report, the remediation plan and the attestation. Teams that plan only for active testing discover late that replay and purple teaming need the blue team and control team hours again, and that these run within a fixed window after testing ends. Put every closure deliverable and its internal hours into the budget at the start, and treat the attestation as a required output, not an optional extra.
Who pays, who does the work and who issues the attestation
The tested entity owns the test in every sense that matters for cost. It owns its controls, its budget, its internal staff and the remediation of whatever the test finds. The framework requires the entity to contract the threat intelligence provider and the red team testers, so those fees sit with the entity, and the Banco de Espana's TIBER-ES guide states that the costs and risks are borne in all cases by the tested entity and never by the authorities. Internal effort is also a real cost, because the control team and blue team must be staffed for the length of the test.
- Provider fees: The entity pays the threat intelligence provider and the red team provider under contracts it signs, after the control team has run procurement.
- Internal hours: The control team lead and members, and the operational staff involved in replay and purple teaming, spend recurring hours across each phase.
- Remediation investment: Fixing findings can require new systems or services, which often costs more than the test itself.
- Supplier contracts: Where shared providers are tested, the entity must line up supplier terms before the test starts.
- Ownership of outcomes: The entity writes the remediation plan and answers to the authority for it.
Before you accept any quote, confirm which of these lines it covers and which remain your budget.
An implementation partner such as DeployOpen works on the entity's side of the test. It can prepare the systems, evidence and documentation the control team relies on, and it can support the control team with project management and evidence collection. It does not replace the control team, does not decide scope, and does not select or supervise the independent providers. DeployOpen does not issue reports or attestations. Those come from the authority and the independent providers.
- Systems readiness: Preparing self-hosted platforms, logging and access records so the blue team has the evidence it needs during the test.
- Documentation: Keeping the control team's records, change logs and remediation tracking organized across the three phases.
- Evidence support: Collecting artifacts that the closure phase reviews, such as detection and response records.
- Remediation work: Implementing fixes in the entity's own environment under a fixed scope, where the entity has agreed to that scope.
- Fixed scope: Work is agreed in writing before it starts, so the fee follows from a defined deliverable list.
Ask any partner to state in writing which tasks it performs, which it does not, and that it will not sign the attestation or the test summary report.
The authority, usually through its TIBER Cyber Team and test manager, sets the requirements, reviews the procurement choices and oversees the test. The threat intelligence provider and red team testers do the attack work and produce the targeted threat intelligence report and the red team test report. The authority does not run the attacks, and it does not pass or fail the entity. At closure, the authority issues the attestation, which confirms that the test was carried out in line with the framework. The framework treats test results as a basis for improving cyber maturity, not as a pass or fail result.
- Requirements: The authority sets the mandatory framework steps and the provider minimums, such as the reference and experience thresholds in the procurement guidance.
- Test manager review: The test manager checks that providers meet the required standard before the control team contracts them.
- Independent providers: The threat intelligence provider and red team testers are paid by the entity, but they test independently of the control team's day-to-day choices.
- Attestation: The authority issues the attestation at closure. It is not a certificate of security.
- Fees: Some national authorities charge fees for oversight, so check the rules of the authority that will supervise your test.
Confirm with the authority which fees apply and which documents it will issue.
Common questions about TIBER-EU test costs
What share of the ICT budget does a threat-led penetration test cost?
The European Supervisory Authorities' estimate, cited in the Commission's 2020 impact assessment, puts threat-led penetration testing at between 0.1 % and 0.3 % of the total ICT budget of the firms concerned. That is an estimate for the sector as a whole, not a price for your test. Your actual share depends on how many critical functions are in scope, how many systems the red team targets, whether you buy threat intelligence and red teaming separately, and how much remediation the findings require. Check the source in the SWD(2020) 199 impact assessment summary and compare it against your own ICT budget before setting an internal figure.
Who pays the authority for a TIBER-EU test?
The tested entity bears the costs of the test, including the authority's work where a country charges for it. Banco de Espana's TIBER-ES guide states that the costs and risks are borne in all cases by the tested entity and never by the adopting authorities. Charging models differ by country. Sweden's Riksbank, for example, charges entities that Finansinspektionen has ordered to perform TLPT an annual fee from 1 January 2026, split 70% evenly between entities and 30% by balance sheet total, to cover oversight, coordination and attestation. Ask your national authority whether a fee applies and how it is calculated.
How many hours does the control team need during a test?
The ECB's Control Team Guidance indicates that the control team lead spends about 4 to 8 hours a week in the 24-week preparation phase, 8 to 16 hours a week during threat intelligence (4 to 6 weeks), 10 to 30 hours a week during red teaming (14 to 15 weeks) and 8 to 12 hours a week in the 18-week closure phase. Each other member spends roughly half that. These are guidance figures for the lead role, so your own planning should multiply them by the number of members and the weeks in each phase, then add time for replay, purple teaming and remediation. Internal staff time is a real cost even when no invoice is raised, so include it in your budget.
Can we run a TIBER-EU test without outside help?
No. The framework requires external providers for threat intelligence and red teaming, so an entity cannot complete a TIBER-EU test with only internal staff. The control team arranges and budgets for procurement of both providers and must not contract them if the test manager considers they do not meet the requirements of Article 7(1) of the TLPT standards. Those requirements include minimum team experience and reference counts, and rules on independence and conflicts of interest. Your own staff can still run the control and blue team roles, but they cannot act as the red team for the test. Confirm the exact rules with your authority and the TIBER-EU Guidance for Service Provider Procurement before you start.
How does a multi-party or joint test change the cost?
Joint testing can reduce cost when several entities share ICT systems or use an intra-group provider, because the threat intelligence and red team work covers shared infrastructure once rather than several times. Article 16 of DORA lets host authorities follow a cross-border test or assign a test manager within 20 working days of being informed, and the framework prefers joint testing where it cuts costs. Expect the bill to rise with the number of scenarios, the number of tested entities, and the coordination needed between authorities and parties. Ask each participant to agree in writing how the provider fees, control team hours and remediation costs are shared.
What should we ask a provider to include in a quote?
Ask for a written quote tied to a defined scope, so you can compare providers on the same basis. Request a breakdown into threat intelligence, red team testing, reporting, replay and purple teaming support, and any travel or tooling charges. Confirm the team members named, their experience against the minimums in the procurement guidance, and the number of references offered. Ask which deliverables are included, such as the targeted threat intelligence report and red team test report, and what triggers extra charges, such as scope changes or a longer active testing period. Clarify who owns the findings and how the provider handles data during and after the test. DeployOpen does not publish a price list. A quote follows from the written scope, which is agreed before work starts.
What to ask for in a provider quote
Ask every provider for a written quote that states scope and flags covered, the number of active testing weeks, and the team that will do the work. The framework requires a minimum of 12 weeks of active testing so the red team can run all attack phases and try to reach the flags, and each scenario must complete its in, through and out phases. A quote that prices fewer weeks, or that does not say which scenarios and flags are included, cannot be compared with another. Ask whether scenarios run in parallel or in sequence, because that choice changes the calendar and the number of testers needed at any moment. For the red team, the reference minimums are at least five references, a test manager with at least five years of penetration and red team testing experience, and at least two testers with at least two years each. For the threat intelligence provider, the minimums are at least three references and a manager with at least five years of threat intelligence experience, plus at least one more member with at least two years. Ask for named people against each role and check them against these minimums before you compare prices.
Ask for deliverables by phase, with a named item for each: the targeted threat intelligence report, the red team test plan, the red team test report, the blue team test report, and the inputs needed for replay and purple teaming. Replay and purple teaming draw on your control and blue teams, so the quote should state the provider's effort for those sessions separately from the effort your staff will spend. Ask how many sessions are included and who facilitates them. Also ask what the provider needs from you during the closure phase, because the closure phase has its own timelines under the framework. Ask how change requests are handled. Scope often grows when a scenario uncovers a new system or a supplier, so the quote should state the day rate or fixed fee for changes, who approves a change (the control team and test manager, not the provider alone), and whether the price moves when the active testing period is extended. Ask for a written statement of what happens if the test manager does not accept the provider under the framework's rules, and who bears the cost of replacing the provider.
DeployOpen quotes follow from a written scope. DeployOpen does not publish a price list, so a quote is only meaningful once the scope, deliverables and timeline are agreed in writing. When you ask DeployOpen for a quote for the implementation, testing, evidence or readiness work that supports a threat-led test, expect the scope to name the systems, the phases covered and the roles DeployOpen will and will not perform. DeployOpen can prepare systems, controls and evidence, but it does not issue attestations, and the test manager and authority remain responsible for the test itself. Compare every quote on the same basis, and ask any provider to confirm in writing which items are fixed and which are priced as change requests.
How DeployOpen scopes and prepares a TIBER-EU engagement
DeployOpen does not set TIBER-EU budgets or issue test results. Our part is preparing the systems, environments and evidence that a threat-led test depends on, and documenting that work in a written scope before any work starts. The budget conversation begins once the scope is agreed.
How we scope
- Written scope defines which systems, environments and deliverables we cover for the TIBER-EU cost estimate.
- Engagements are fixed-scope, so scope, deliverables and timelines are agreed in writing before work begins.
- We list which costs sit with the tested entity, the authority and the independent providers, so the quote is easy to compare.
How we build
- We prepare the test-ready environment, logging and backups that affect how much control team and blue team time a test needs.
- We document the systems and suppliers in scope so remediation and provider costs can be estimated against real architecture.
- We keep testing outside the threat-led engagement itself, so the entity's internal effort is planned and not left to chance.
How we hand over
- We deliver the documentation, evidence and cost drivers in a form the control team and procurement can reuse.
- We hand over remediation options with the effort and systems each one needs, so budget owners can decide on them.
- We confirm with the test manager and the entity which costs are one-time and which recur in later test cycles.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, agreed separately from the initial scope.
- A retainer can keep remediation, environment changes and evidence current between test cycles, which spreads cost over time.
- Questions on provider selection, internal team hours or authority fees are answered against the written scope, with the independent parties confirmed.
