# DORA resilience testing: why most insurers will fail their first drill.

DORA's threat-led penetration testing requirements are unlike anything the insurance sector has had to operationalise before.

Source: https://nearsoft.pt/news/dora-resilience-insurers-first-drill

---

Compliance · February 2026 · 4 min read

*S. Pereira · Compliance Lead*

Insurers are used to control frameworks that read well on paper. DORA asks a different question: can you demonstrate recovery under adversarial assumptions, with evidence that does not depend on a hero engineer?

## The first-drill failure mode

Teams optimise for pass/fail narratives. The real failure is fragmented ownership: cloud landing zones, legacy policy admin, and third-party SaaS each have different incident contracts — and the drill exposes the gaps between them.

## What changes when it works

A single resilience narrative ties technical recovery to customer-facing continuity. Playbooks are executable, not decorative: roles, comms templates, and evidence capture are rehearsed until they feel boring — which is the point.