Mythos Hardening Control · MRIS 2.0 · Applies to ISO/IEC 27001 and IT-Grundschutz

MHC-12 Threat-led penetration testing with Mythos scenarios

Validates the entire defense chain against realistic, AI-driven attack scenarios – revealing whether detection and response work in practice rather than only on paper.

At a glance

Operational benefit: tests whether the protective measures actually work against realistic, AI-typical attack scenarios — not merely whether they are documented — and thereby exposes false-positive security assumptions.
Policy affected: policy on security testing and independent review.
Dependencies: no precondition; tests the effectiveness of the other controls (including MHC-05 and MHC-11) under realistic conditions.
Effort drivers: depends strongly on the format chosen (a full TLPT with an external red team versus lower-cost purple team and simulation formats). The actual effort depends on the organization's resources.
Primary metric: share of identified vulnerabilities remediated within the agreed time window (closure rate).
Standards touched (no claim of fulfilment): ISO/IEC 27002 A.5.35/A.8.29; DORA Art. 26/27 with the TLPT RTS; TIBER-EU; C5:2026 OPS-22; NIS2 IR No. 3.5.5.

Control statement

The effectiveness of the protective measures is tested regularly through threat-led penetration testing that reproduces realistic attack scenarios tailored to the current situation — including AI-typical approaches. Between the cycles, joint exercises of attack and defence (purple team) take place.

Purpose and threat relevance

Documented protective measures are not the same as effective protective measures. Under AI-supported attacks — which demonstrably find and exploit vulnerabilities autonomously today — only a realistic test shows whether the defence actually takes hold. Classic penetration tests with a fixed standard scope often do not reflect the new approaches. The protective objective is to test, with realistic threat-led scenarios, whether the protective measures work against real attack patterns, and thereby to expose false-positive security assumptions.

Effect across frameworks

These are the controls and requirements the MHC acts on. The classification shows how much each control loses its effect under AI-enabled attacks.

Effect across frameworks
Number	Title	Classification / Level
ISO/IEC 27001:2022, Annex A 2 controls
A.5.35	Independent review of information security	partially degraded
A.8.29	Security testing in development and acceptance	robust
IT-Grundschutz, MRIS.bd 1 requirements
MRIS.bd.1.A11	Conducting Threat-Led Penetration Tests with AI Scenarios	elevated protection needs

All 93 controls in the analysis matrix · All 23 requirements of the module family

Maturity path

Initial: annual penetration tests with a standard scope.
Defined: threat-led tests with Mythos scenarios; purple team exercises between the cycles.
Managed: continuous attack simulation, a simulation platform in production; timely remediation of the findings (closure rate 90% or above within the agreed time window).

Measurement and audit evidence

Metric: closure rate — share of identified vulnerabilities remediated within the agreed time window (guide value: 90% or above); supplementary, the frequency and realism of the tests.
Evidence: test reports with scenarios and findings, remediation evidence, ATT&CK mapping of the purple team exercises.
Evidence logic (following ISO/IEC 27001, Clause 9): documented? — testing policy, test reports; responsible? — security leadership; frequency? — at least annually for critical functions, purple team in between; tolerance? — no open critical findings beyond the agreed time window.

Typical mistakes

Testing takes place, but always with the same standard scope; realistic, new attack patterns remain outside.
Findings are reported but not remediated on time; the test merely confirms what was already known, without improving the situation.
The test examines only the technology, not detection and response; whether an attack would be noticed remains open.
The format is over-dimensioned (an expensive TLPT where a purple team format would suffice) or under-dimensioned (a superficial scan where realistic scenarios would be needed).

Delimitation and residual risk

Delimitation: concerns the verification of effectiveness; automated testing during development is dealt with by MHC-09, and ongoing detection by MHC-05.
Residual risk: a test is a snapshot of a chosen scenario; paths not tested remain open, and the situation changes continuously — hence the regular repetition and the purple team exercises in between.
Format delimitation: MHC-12 requires the testing of realistic attack chains, not necessarily a DORA TLPT in the narrow regulatory sense. For those DORA-regulated financial entities identified for TLPT under Art. 26(8), the regulatory DORA TLPT requirements (RTS (EU) 2025/1190) apply bindingly; all others achieve the objective equally through threat-led penetration tests, purple team exercises, attack simulations or scenario-based control tests.
ISO/IEC 27002:2022: A.5.35 Independent review of information security; A.8.29 Security testing in development and acceptance.
Framework: DORA Art. 26/27 with the TLPT RTS (Delegated Regulation (EU) 2025/1190, applicable since July 2025); the ECB's TIBER-EU framework (aligned to DORA since February 2025); C5:2026 OPS-22; NIS2 IR No. 3.5.5; attack simulation with, among others, Caldera, Atomic Red Team, AttackIQ, SafeBreach, Picus.

Implementation in detail

Organizational and technical implementation, implementation examples and the prioritization within the overall programme are described in the Implementation Guide.

Implementation Guide (PDF)Back to the MHC catalog