GDPR Article 32 requires regular testing of security measures; pentesters must handle personal data as data processors - NIS2 expands security requirements across essential and important entities in the EU - DORA mandates threat-led penetration testing (TLPT) for significant financial entities using