TIBER-EU vs CBEST: which regulator-led test applies to you
The choice between TIBER-EU and CBEST is set by the jurisdiction and the regulator that supervises your firm. If your firm sits within a European jurisdiction that has adopted the ECB's framework, TIBER-EU is the scheme to plan around. If you are a UK firm or financial market infrastructure supervised by the Bank of England, the PRA and FCA, CBEST is the relevant scheme. Neither scheme produces a pass or fail result, so the useful question for your board is what the supervisor will do with the findings. The ECB's TIBER-EU page lists the framework as adopted in 21 countries as of October 2026, so confirm with your national authority that it applies to you before assuming it does.
CBEST is carried out when the regulator requests it as part of the supervisory cycle, using a list agreed by the PRA and FCA, when a firm requests one with the regulator's agreement, or when an incident leads the regulator to ask for one. A TIBER-EU test is initiated through the authorities in your jurisdiction under the ECB framework. Where your group operates across more than one jurisdiction, or where a DORA threat-led penetration test may also apply, whether one test can serve several requirements depends on what each authority accepts in writing. Ask your supervisor early whether a single test, shared scope or mutual recognition is acceptable, and obtain that answer in writing before threat intelligence work begins.
Whichever scheme applies, the test must be delivered by providers the scheme recognizes. CBEST threat intelligence and penetration testing providers must be CBEST accredited, and the Bank of England's CBEST implementation guide names CREST as the accreditation and certification body. Plan around the published phase lengths: CBEST indicates about 6, 10, 14 and 4 weeks for its four phases, while TIBER-EU indicates at least 12 weeks of active testing followed by mandatory purple teaming. Your first action is to ask your regulator which scheme and which list apply to you, then request accreditation evidence from any provider before procurement begins.
How TIBER-EU and CBEST differ on triggers, phases and accreditation
This table compares the two regulator-led schemes factor by factor, from who issues them to how results reach supervisors. Read each row as a question to put to your regulator or provider, since the framework documents set the binding detail. The main takeaway is that CBEST follows a supervisory cycle with a fixed UK reporting route, while TIBER-EU is a multi-country framework whose national implementation determines the exact rules you face.
| Factor | TIBER-EU | CBEST |
|---|---|---|
| Issuing authority and jurisdiction | European Central Bank framework, adopted by national authorities across 21 countries as of October 2026 | Bank of England, with the PRA and FCA, for UK firms and financial market infrastructures |
| Triggers | Set by the relevant national authority and entity selection; confirm the process in your jurisdiction | Regulator request within the supervisory cycle, firm request with regulator agreement, or a regulator request after an incident |
| Phases | Threat intelligence, red team test planning, active testing, and closure with replay and purple teaming | Initiation, Threat Intelligence, Penetration Testing and Closure |
| Indicative timelines | 4 to 6 weeks of threat intelligence, 2 to 3 weeks of planning, at least 12 weeks of active testing (ECB, January 2025) | About 6, 10, 14 and 4 weeks per phase, with projects averaging around 9 to 12 months (CBEST Implementation Guide, 2024) |
| Purple teaming | Mandatory as part of the closure phase | Not framed as a required phase; confirm the expectation with your supervisor |
| Provider accreditation | Confirm the accreditation requirements for threat intelligence and testing providers in the TIBER-EU framework and your national authority | Threat intelligence and penetration testing providers must be CBEST accredited; CREST is named as the accreditation and certification body |
| Pass or fail status | No pass or fail result, according to the ECB | Not a pass or fail test; the regulator reviews the firm's remediation plan |
| How results reach supervisors | Shared with the national authority under the framework; confirm the reporting and attestation route locally | Regulators compile an anonymised thematic report across CBESTs with input from the NCSC |
When a regulator requests a TIBER-EU or CBEST test
The most common route into a CBEST is the regulator's own supervisory cycle. The PRA and FCA maintain a list of firms agreed between them, and a firm on that list is asked to carry out a CBEST as part of supervision. The firm does not choose the moment, but it still has a say in scope, provider selection and the sequencing of its internal work. Firms should treat the request as the start of a multi-phase program rather than a single test.
- Selection source: Inclusion follows the list agreed by the PRA and FCA, so a firm should ask its supervisory contact how and when it was placed on that list.
- Initiation phase: Expect a scoping discussion with the regulator before any testing begins, covering the systems and functions in scope.
- Provider accreditation: Threat intelligence and penetration testing providers must be CBEST accredited, and CREST is named as the accreditation and certification body, so procurement should verify accreditation early.
- Remediation focus: The regulator reviews the firm's remediation plan after the test, so the plan should be ready to present at closure.
- Cost drivers: Provider fees, internal staff time and remediation work are the main cost components, and a quote should separate them.
Confirm with your supervisor the expected start window, the phase timetable and the points at which the firm must submit documents.
A firm can ask for a CBEST on its own initiative, but the test only proceeds when the regulator agrees. This route suits firms that want an intelligence-led view of their defenses before a supervisory request arrives, or that have made significant changes to their technology estate. The firm carries the initiative for timing and rationale, while the regulator keeps control of whether the exercise goes ahead and how results are used.
- Regulator agreement first: Prepare a written rationale for the request, including the business services and systems you want covered, before engaging providers.
- Scope negotiation: Expect the regulator to challenge scope, so define critical functions and their dependencies in advance.
- Provider lead time: Confirm that accredited providers have capacity, since a voluntary request may compete with supervisory tests for the same specialists.
- Results handling: A CBEST is not a pass or fail test, and the anonymised thematic report draws on CBESTs as a group, so the firm should agree how its own findings will be documented.
- Ongoing duration: The Implementation Guide indicates a typical project runs around 9 to 12 months, so budget internal time across that span.
Ask the regulator directly whether a voluntary request is accepted for your firm and what documents it expects at the outset.
A regulator may request a CBEST after an incident, when the event suggests that the firm's defenses or threat assessment need independent testing. The trigger is reactive, so the firm may have limited time to prepare and its incident response team may be busy with recovery. The firm should expect the regulator to focus the scope on the systems and attack paths linked to the incident.
- Incident context: Be ready to explain the root cause analysis and containment steps, since these shape the scope the regulator sets.
- Parallel workload: Recovery and testing may overlap, so assign separate owners for incident response and test coordination.
- Threat intelligence input: The threat intelligence phase draws on current threat actor information, which may already be informed by the incident.
- Information handling: Confirm how incident data will be shared with providers and what confidentiality terms apply.
- Remediation timing: Regulators may expect faster remediation for issues linked to the incident, so prioritize findings tied to it.
Confirm with the regulator whether an incident-driven request changes the phase timetable or the expected closure documentation.
TIBER-EU is a framework adopted across European jurisdictions, and the ECB lists it as adopted in 21 countries as of October 2026. The rules for when a firm must take part are set nationally by each authority, not by the ECB framework alone. Two firms in neighboring countries may face different triggers, different designation criteria and different expectations for supervisory involvement. The DORA threat-led testing requirement adds another layer for in-scope financial entities.
- National rules: Trigger criteria, designation lists and timing are set by each national authority, so confirm the local designation process.
- Authority role: Identify which authority leads the test and who the firm's supervisory contact will be.
- DORA interaction: Ask whether a TIBER-EU test will be recognized for DORA threat-led testing obligations in your jurisdiction.
- Provider requirements: Check the tester and provider requirements that the national authority applies, since they can differ from CBEST accreditation.
- Cross-border scope: Groups with entities in several countries should confirm which authority leads and whether systems in other jurisdictions are included.
Confirm your national authority, the designation criteria that apply to your entity and the start process with your supervisor before committing budget.
How the phases of a CBEST and a TIBER-EU test run
The sequence moves from scoping and authorization through threat intelligence and live testing to a closure that produces a remediation plan the regulator reviews. Both schemes share this shape, but the phase names, indicative durations and closure steps differ.
Confirm the trigger and scope the test
A CBEST starts when the regulator requests one through the supervisory cycle, when a firm asks for one with the regulator's agreement, or when an incident prompts the regulator to ask. A TIBER-EU test is set up through the national authority that coordinates it. In both cases the firm, the regulator and the test provider agree the scope, the critical functions in scope and the rules of engagement. The step closes when the scope and the named responsibilities are documented and agreed in writing. Ask the regulator which phase names and deliverables apply to your jurisdiction before you commit internal resources.
Build the threat intelligence picture
In CBEST, the Initiation phase sets up the engagement and the Threat Intelligence phase follows, with an indicative duration of about 10 weeks. In TIBER-EU, the preparation phase includes threat intelligence work that the ECB indicates takes 4 to 6 weeks. Accredited threat intelligence providers profile the threat actors likely to target the firm and produce scenarios tied to the firm's critical functions. The firm supplies internal information and reviews the scenarios. The step is complete when the scenarios are approved and the red team plan can be built from them. Confirm with your provider who is accountable for the intelligence report and how sensitive sources are handled.
Plan the red team test
In TIBER-EU, the ECB indicates 2 to 3 weeks of red team test planning, covering the attack scenarios, the control and white team arrangements and the safeguards that protect live systems. In CBEST, the red team plan is developed from the threat intelligence and agreed with the regulator before testing starts. The accredited provider drafts the plan, the firm approves it, and the regulator is kept informed. The step is complete when the plan, the escalation paths and the stop conditions are signed off. Ask how the provider keeps the plan secret from the staff who will defend against it.
Run the penetration or red team test
CBEST's Penetration Testing phase has an indicative duration of about 14 weeks. TIBER-EU indicates at least 12 weeks of active testing. Testers attempt to reach the agreed objectives against live production systems, using techniques that a real adversary could use, without notifying the defenders. A control team tracks activity and can step in if needed. The step ends when testing reaches its objectives or the agreed end point, and the provider produces a record of the attack paths and the defensive responses observed. Confirm how the control team handles the risk of unplanned impact on critical services.
Debrief and run the purple teaming
TIBER-EU requires purple teaming, where the red and blue teams work through the techniques used, technique by technique, to confirm which were detected and which were not. This is the joint review of the attack, not a score. Defenders review logs and alerts, and the team agrees the detection gaps and the fixes. The step is complete when each technique has a recorded detection outcome and an owner for each improvement. The ECB frames the outcome as a set of findings rather than a pass or fail result, so expect the exercise to produce a list of actions.
Replay the attack for closure
TIBER-EU's closure phase includes a replay, in which the key attack paths are re-run to confirm how the firm's controls and detections now respond. The replay checks the effect of fixes made during the exercise. CBEST's Closure phase, with an indicative duration of about 4 weeks, also concludes the exercise and documents the results. The step is complete when the replay outcomes are documented alongside the purple teaming records. Ask the provider which specific techniques will be replayed and how the results will be presented.
Agree the remediation plan with the regulator
The firm prepares a remediation plan that sets out how it will address the weaknesses found. In CBEST, the regulator reviews this plan, and the PRA and FCA later compile an anonymised thematic report across CBESTs with input from the NCSC. In TIBER-EU, the national authority and the ECB review the final report and the remediation actions as part of closure. The step is complete when the regulator has reviewed the plan and the firm has an owner and tracking process for each action. Confirm with your supervisor what evidence they expect at follow-up and how it will be stored.
What each scheme finds and what it misses
Both schemes produce intelligence-led evidence about how a firm's people, processes and technology hold up against a realistic attacker. Each card below names one thing the schemes surface well, one gap they leave open, and the condition under which that gap matters to the firm.
Threat intelligence-led scenario realism
Both schemes build the attack scenario from threat intelligence about actors that target the firm's sector, not from a generic checklist. The realism is only as good as the intelligence feeding it. Check who provides the threat intelligence, how current it is, and whether the scenarios reflect the firm's own critical services and business functions. A firm with a narrow, well-understood threat profile gains less from a broad scenario than from a sharply targeted one.
Detection and response coverage
A red team test shows which attacker actions the blue team detected, escalated or contained, and which went unnoticed. This is the core evidence both schemes gather about monitoring and response. It matters most when a firm has invested in a security operations centre but has never tested it against a live, objective-driven attack. Ask how detections are logged, who decides whether an action counts as detected, and whether the blue team knew a test was underway.
Purple teaming learning
Purple teaming takes the technique-by-technique findings and turns them into joint learning between attackers and defenders. Under TIBER-EU it is mandatory in the closure phase, so the learning is built into the process. Under CBEST the value depends on how the firm organizes its own follow-up. The learning is only durable if detection rules, logging gaps and response playbooks change after the exercise, and if someone owns those changes.
Remediation plan quality
Neither scheme is a pass or fail test. The regulator's main lever is the remediation plan the firm produces after the test, which sets out how it will fix weaknesses and by when. A vague plan with no owners, budgets or milestones gives the supervisor little to follow up. Before testing, ask who signs off the plan, how progress is tracked between supervisory reviews, and how the firm will prove that fixes work.
Limits of a fixed threat scenario
A scenario built around a chosen threat actor tests the paths that actor is expected to use. Attackers outside that profile, or paths the intelligence did not anticipate, may go untested. This gap matters most for firms whose exposure is shaped by third parties, suppliers or cloud configurations outside the scenario. Ask the provider which scenarios were considered and rejected, and which parts of the estate the test did not reach.
Regulator-led tests are not control audits
A regulator-led red team test samples attacker behavior at a point in time. It does not assess every control, policy or configuration, and it is not an audit report or certification. Treating a clean run as proof that controls are complete invites false confidence and weak evidence for other assurance needs. Confirm with your regulator and assessors which controls each test covers, and plan separate control testing for the rest.
How purple teaming and supervisor reporting work in each scheme
The main difference at closure is how each scheme turns attack findings into defensive change. TIBER-EU builds that step in: the closure phase includes a replay and mandatory purple teaming, where the red team and the defenders work through the techniques used during testing together, confirm which were detected, logged and contained, and agree the tuning that follows. The CBEST Implementation Guide (2024) centers closure on the firm's remediation plan, which the regulator reviews. Joint technical review may still happen in a CBEST, but the guidance does not place it at the center of closure as TIBER-EU does. Before scoping, ask your Bank of England supervisor whether they expect a replay or purple session, who must attend, and what record of it must be kept. Plan for the internal staff time this requires, because defenders' hours are a cost you carry directly.
Reporting to supervisors also differs. Under CBEST, the regulator reviews the firm's remediation plan, and the PRA and FCA compile an *anonymized* thematic report across CBESTs with input from the NCSC, so an individual firm's findings reach the regulators in aggregated form rather than as a published result. TIBER-EU runs through the national authority in each participating jurisdiction, with the ECB framework setting the phases and expectations, and the ECB states that these tests produce no pass or fail result. What the authority expects to receive, such as the final test report, the replay evidence, the remediation plan, the report format and the submission timing, varies by jurisdiction and should be confirmed in writing at the start. The TIBER-EU Framework (January 2025) is the natural starting point for the framework's expectations, but it does not replace the authority's own instructions.
Because neither scheme produces a pass or fail grade, the board paper and the supervisor submission should describe what was validated and what remains open, since no score is issued. Define what closed means before testing starts. For example, an illustrative definition might be an agreed remediation plan accepted by the authority, with detection of the tested techniques confirmed in a purple session. Ask the provider for its deliverables in writing, including who signs the final report, how purple teaming outcomes are recorded, and how long evidence is retained. For CBEST, confirm that threat intelligence and penetration testing providers hold CBEST accreditation through CREST, as the guide requires. Your quote should itemize provider days, purple teaming sessions, remediation support and any replay, because each recurs differently across the schedule and drives the total up or down with scope.
How much does a CBEST or TIBER-EU test cost and how long does it take?
What drives the cost of a CBEST or TIBER-EU test?
The cost is set by the written scope, not by a published rate, so the main drivers are how many systems and business services are in scope, how deep the threat intelligence work goes, how many testing scenarios the red team runs, and what the regulator's process requires of the firm. Accredited providers price threat intelligence and penetration testing as separate work, so ask each for its own line items. Ask your regulator which steps it expects you to fund, because supervisory time and the remediation review are not paid to providers. Request a quote that lists phases, deliverables, assumptions and exclusions.
Can our own security team run a CBEST or TIBER-EU test internally?
No. For CBEST, the Bank of England's implementation guide requires that threat intelligence and penetration testing providers be CBEST accredited, and it names CREST as the accreditation and certification body. Your internal team can prepare, coordinate, provide data, and own remediation, but it cannot be the accredited tester. Confirm the current accreditation status of any provider with the regulator and with CREST before signing, and check how TIBER-EU applies the same expectation in your jurisdiction.
How long does a CBEST test take from start to finish?
The Bank of England's CBEST Implementation Guide (2024) says the regulators find an average project lasts around 9 to 12 months. Its indicative phase durations are about 6 weeks for Initiation, 10 weeks for Threat Intelligence, 14 weeks for Penetration Testing and 4 weeks for Closure. These are indicative, so confirm the schedule for your firm with your regulator. For TIBER-EU, the ECB's January 2025 framework indicates 4 to 6 weeks of threat intelligence, 2 to 3 weeks of red team test planning and at least 12 weeks of active testing, followed by closure with a replay and mandatory purple teaming.
What does our firm need to provide for the engagement to run smoothly?
The work depends on decisions and access that only the firm can make. Expect to need:
- A named executive sponsor and a governance group that can approve scope and rules of engagement
- Access to data, documentation and staff who can explain critical services and their dependencies
- Named owners for remediation who can commit budget and change windows
- A point of contact for the regulator and for the provider, plus a process for handling sensitive findings
Delays usually come from slow decisions on scope or from remediation owners who are not identified until the report is issued.
Is a voluntary red team test enough instead of a CBEST or TIBER-EU exercise?
It depends on whether a regulator has asked for an intelligence-led test. A CBEST is carried out when the regulator requests it from its supervisory list, when a firm requests one with the regulator's agreement, or when an incident leads the regulator to request one. TIBER-EU is also framed as a regulator-supervised framework. If you are not in scope, a commercially scoped red team can still test your detection and response, but it will not carry the supervisory process, the accredited provider requirement or the regulator review of remediation. Agree this position with your regulator before you choose.
How do we ask for a quote from a written scope?
Start with a written scope that names the business services in scope, the systems and locations, exclusions, the threat intelligence questions, the rules of engagement, and the reporting and remediation expectations. Ask each provider to price each phase separately, state assumptions about access and data, list the people and days they expect to commit, and identify any recurring costs such as retesting or follow-up. Also ask how the provider handles accreditation evidence, regulator communications and the purple teaming step. Ask your regulator which parts of the process it requires and which costs it will not cover.
What drives the cost and duration of each scheme
Both schemes are run by accredited providers and overseen by a regulator, so cost and duration follow from a handful of decisions made early. The cards below cover who is paid for what, which parts are one-time and which recur, and what to ask for before signing.
Provider accreditation requirements
Under CBEST, threat intelligence and penetration testing providers must be CBEST accredited, and the Bank of England names CREST as the accreditation and certification body. Under TIBER-EU, the testing and threat intelligence providers are selected by the entity and must meet the requirements set out in the framework. Firms pay the accredited providers, so the number of qualified firms available and their day rates shape the quote. Ask each provider to show current accreditation status and named testers before scoping starts.
Threat intelligence scope
The threat intelligence phase sets the scenarios the red team later plays out, so its depth drives both cost and the credibility of the test. CBEST indicates about 10 weeks for this phase within a project that the regulators find lasts around 9 to 12 months. TIBER-EU indicates 4 to 6 weeks of threat intelligence. Confirm who produces the intelligence, which threat actors are covered, and whether the output is tailored to your sector or reused from a generic report.
Penetration test depth and systems in scope
The number and criticality of systems in scope, along with the depth of the attack chains allowed, largely determines how long the active testing runs. TIBER-EU requires at least 12 weeks of active testing, so the scope of live services and critical functions matters more than the headline duration. Scope creep is the usual source of extra cost. Agree in writing which production systems, third parties and data are covered, and what the testers may not touch.
Purple teaming effort
TIBER-EU requires mandatory purple teaming in the closure phase, where testers and defenders review detections technique by technique. This adds effort from the blue team, security operations and the provider, and it recurs as a joint workshop cost rather than a one-off. CBEST does not set the same requirement, so the defensive review effort varies more between the two. Ask the provider how many purple teaming sessions are included and who from your side must attend.
Remediation follow-up
CBEST is not a pass or fail test. The regulator reviews the firm's remediation plan, which means the firm pays for fixing findings, re-testing and reporting progress, often well after the test ends. These costs sit with the firm's own teams and any internal or external engineering support, and they recur until findings close. Ask for how re-testing is priced, whether it is included in the fixed scope, and how long the remediation plan is expected to remain open.
Regulator-driven timing
A CBEST is triggered by the supervisory cycle, a firm request agreed with the regulator, or an incident, so the start date is often outside the firm's control. TIBER-EU timing depends on the national authority and the entity's own planning. Regulator-led timing can clash with budget cycles and project calendars. Confirm early with the supervisor when the test will start, which contract vehicle covers it, and how much notice the firm will receive before work begins.
When a firm can combine CBEST, TIBER-EU and DORA testing
A single intelligence-led test can serve more than one regime only where each relevant authority agrees to it in writing. Neither CBEST nor TIBER-EU grants recognition automatically, and DORA's threat-led penetration testing obligation is applied through the competent authority. Before planning anything, confirm with each authority whether it will accept one test as meeting its requirement, which entities and jurisdictions the test covers, and which minimum scope, duration and tester rules it expects to see reflected in the final report.
The most practical overlap is the threat intelligence phase. Both the Bank of England's CBEST guide and the ECB's TIBER-EU framework put intelligence gathering at the front of the test, and a shared threat intelligence product, built to the scenarios each regulator will accept, can feed both regimes without being produced twice. Ask each authority whether its threat intelligence provider and format requirements allow a single provider to deliver the product, and check that the provider holds the accreditation each regime requires. Where a regime requires CREST accreditation, confirm that the provider's status covers the specific work being sold.
The main risk is building two separate test plans that drift apart. Two plans mean two scope documents, two sets of rules of engagement, two sets of target systems and two sets of reporting obligations, and any divergence can leave one regulator with evidence the other does not accept. Keep one controlled scope document, record every deviation with the authority that approved it, and agree early who receives the final report and in what form. Treat any combined approach as something to validate with each regulator before testing begins, not something to assume after the fact.
How DeployOpen scopes, delivers and supports security testing
DeployOpen is a Chainscore Labs company that plans and runs security testing inside the client's own infrastructure. For TIBER-EU vs CBEST work, we prepare the systems, controls and evidence that a regulated firm needs, while the accredited providers and the supervisor keep their own roles in the exercise.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- Written scope should state which regime applies, whether TIBER-EU or CBEST, and which supervisor has confirmed the test.
- Confirm in writing which work DeployOpen performs and which work must be carried out by an accredited external provider.
- Ask the supervisor and your own legal team to confirm the rules of engagement, data handling and authorization letters before any testing begins.
How we build
- We prepare target environments, logging and detection coverage so that purple teaming can compare defender telemetry with attacker activity.
- We document system inventories, network boundaries and control owners that the threat intelligence and testing phases will depend on.
- Build work runs in your cloud accounts, data centers or air-gapped networks, so sensitive test data stays under your control.
- Confirm with your provider which tools will run in your environment and who holds the credentials used during the active testing window.
How we hand over
- Deliverables are agreed in the written scope and typically include documentation of configurations, controls and test evidence.
- Handover packages separate findings for the remediation plan from evidence supplied to the supervisor, which the regulator reviews.
- We prepare control and evidence material for the assessment, but DeployOpen does not issue audit reports, attestations or certifications.
- Ask who receives the final report, in what format, and how long your firm must retain test artifacts under its own policy.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, separate from the initial fixed-scope engagement.
- Retainers can cover remediation follow-up, control re-validation after changes, and preparation for the next supervisory cycle.
- Ask for the support scope, response arrangements and upgrade process in writing before you compare quotes.
- Confirm with your supervisor when the next test is due, since the regime sets the cadence rather than the provider.
