Greenbone Supports DORA Compliance with Vulnerability Detection, Data Sovereignty and Reporting

The global financial sector has been slammed with high-profile cyber incidents, placing trust in financial systems in jeopardy. These cyber attacks are extremely costly and widespread. Large corporations are not the only losers in this battle. Citizens also suffer directly when data protection and the integrity of financial transactions are compromised.

Some of the most impactful breaches of financial entities in the EU and globally include:

• Equifax (2017): Breached via an unpatched vulnerability in Apache Struts, leading to the theft of Social Security Numbers (SSN), birthdates, addresses and driver’s licenses of 147 million people.
• UniCredit (2018): Italy’s second-largest bank exposed the Personally Identifiable Information (PII) of 778,000 clients; the Italian DPA finally issued a €2.8 million fine for the breach in 2024.
• Capital One (2019): A misconfigured firewall was used to breach Capital One to steal the PII of 106 million individuals.
• Finastra (2023): The UK-based fintech provider servicing global banks, was breached via its secure file-transfer system, resulting in the theft of over 400 GB of sensitive financial data from major banking clients.
• UBS and Pictet (2025): A third-party cyberattack on Chain IQ exposed the PII of over 130,000 employees, including contact information for top executives.
• Bybit (2025): North Korean hackers stole $1.5 billion worth of Ethereum from Bybit’s cold wallet, marking the biggest crypto exchange hack ever recorded.

These incidents emphasize the strategic importance of securing financial technology providers. Cyber attacks against banks include fraudulent wire transfers, ATM hacking, POS malware and data theft. Arguably, the impact of sensitive PII being stolen is even worse than simply stealing money. Stolen identities: names, SSNs, addresses and other PII are later sold on darknet marketplaces and used by attackers to commit identity theft, open fraudulent bank accounts or lines of credit and to conduct social engineering against individuals directly. Geopolitical tensions further place data theft victims at risk; hostile nation states and legally ambiguous intelligence brokers collect intelligence on individuals for surveillance, intimidation campaigns or worse.

In response to elevating threats, the Digital Operational Resilience Act, (aka “DORA”) exists to strengthen the EU financial sector’s cybersecurity posture with greater safeguards. This new legal framework is a pivotal piece of legislation within the EU’s financial regulatory framework, to stabilize consumer trust and bolster business confidence.

How OPENVAS SECURITY INTELLIGENCE by Greenbone Supports DORA Compliance:

• Vulnerability management is a fundamental IT security activity with a well-established benefit to operational resilience. OPENVAS SCAN by Greenbone is an industry leading vulnerability scanner with a proven track record.
• Our OPENVAS ENTERPRISE FEED has industry leading coverage for CVE detection as well as other network and endpoint vulnerability detection.
• OPENVAS SCAN can identify the encryption protocols allowed by network services to ensure data-in-transit is compliant with data security best practices.
• Our compliance scans can attest security hardened configuration for a wide range of operating systems (OS) and applications. This includes certified CIS Benchmarks for Apache HTTPD, Microsoft IIS, NGINX, MongoDB, Oracle, PostgreSQL, Google Chrome, Windows 11 Enterprise, Linux, and more [1][2].
• All OPENVAS SECURITY INTELLIGENCE components are designed for absolute data sovereignty; your organization’s data never needs to leave the organization.
• Our core product line is open source, time tested and open to external review by customers and community members alike. This visibility helps streamline third-party ICT service providers auditing.
• OPENVAS REPORT by Greenbone is specially tailored to support evidence gathering and data retention for compliance reporting.
• As an active ISO/IEC 27001:2022 and ISO 9001:2015 certified organization, Greenbone is dedicated to the most stringent quality standards for Information Security. Our ISO:14001 certification for Environmental Management Systems shows our continued commitment to things that matter.

The EU’s Digital Operational Resilience Act (DORA)

DORA is an EU regulation published in the Official Journal of the European Union on January 16, 2023, which came into force on January 17, 2025. DORA is part of the EU’s broader Digital Finance Strategy, and its goal is to standardize cybersecurity governance and risk management requirements, strengthening the operational resilience of financial entities in the EU. The act applies to 20 different types of financial entities including banks, insurance companies, investment firms and Information and Communication Technology (ICT) third-party service providers (TPP).

But aren’t financial entities subject to NIS 2 regulation as Essential Entities (EEs)?

Yes, but under Article 4 of NIS 2, financial services firms covered by DORA—such as banks, investment firms, insurance institutions, and financial market infrastructures—must fully adhere to DORA’s requirements when it comes to cybersecurity risk management and incident reporting. Also, any other sector-specific equivalent EU mandates that apply to risk management or incident reporting must take precedence over the corresponding provisions in NIS 2.

Who are the European Supervisory Authorities (ESAs)?

There are three formally designated ESAs responsible for issuing Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS) which clarify DORA’s requirements. The ESA entities are:

• The European Banking Authority (EBA) [1]
• The European Insurance and Occupational Pensions Authority (EIOPA) [2]
• The European Securities and Markets Authority (ESMA) [3]

What are Regulatory Technical Standards (RTS)?

As the name implies, RTS define the required technical standards that entities covered by DORA must adhere to. RTS documents provide detailed guidance to ensure consistent application of DORA across the EU financial sector [4].

The final draft Regulatory Technical Standards are:

• ICT risk management framework and simplified ICT risk management framework [5]
• Criteria for the classification of ICT-related incidents [6]
• Policy on ICT services supporting critical or important functions provided by TPPs [7]

What are Implementing Technical Standards (ITS)?

ITS are detailed rules that specify how financial entities must comply with obligations. They translate DORA’s general provisions into precise operational, procedural, and reporting standards. ITS address incident reporting, tracking of ICT TPP relationships and assessments, threat-led penetration testing (TLPT), and cyber threat information sharing.

• The final draft ITS of templates for the register of information [8]

The Scope of DORA’s Impact on IT Security

Here are the fundamental IT security principles that DORA impacts:

1. Risk Management: DORA mandates that financial entities implement robust IT Risk Management Frameworks (RMF) to reduce their operational risks.
2. Incident Reporting: Fully regulated entities must report major cybersecurity incidents to their national authorities within 24 hours following a standardized format. However, small, non-interconnected, and exempt entities are eligible for reduced reporting requirements.
3. Third-Party Risk: DORA establishes stricter oversight and accountability for how financial entities manage their relationships with third-party ICT service providers.
4. Security Testing: Financial entities must conduct regular security assessments of their digital systems to improve resilience against cyber threats.
5. Information Sharing: For improved information sharing between financial institutions and relevant authorities, entities are encouraged to report emerging threats if they may be relevant to others.

Summary

High-profile cyberattacks have exposed cracks in the financial sector’s deep digital weaknesses, prompting the EU to enact, and as January 17th, 2025, enforce the Digital Operational Resilience Act (DORA). Greenbone is an ally to support DORA compliance for covered entities with our established and trusted suite of enterprise vulnerability management products and compliance reporting tools. Our products support resilient data sovereignty, and detailed security assessment reporting.

True cyber risk mitigation is not simply about meeting compliance checkboxes. Defenders must be proactive in detecting emerging risks as early as possible to strengthen operational resilience. Greenbone enables early awareness of security vulnerabilities allowing the IT defenders of Europe’s financial entities to fix them before cyber breaches occur.