A 2025/2026 regulatory framework in the EU that mandates rigorous, threat-led DDoS testing for financial institutions.