New regulatory or audit pressure
When boards and audit need demonstrable insight into ownership and operation.
Enterprise Governance Assessment
From written agreements to demonstrable executive control.
We assess whether leadership, policy, suppliers, evidence, incident response and agentic AI operate as one governance system.
Audience
Boards, CIOs, CISOs, internal audit, risk management and platform owners.
Duration
Typically six to ten weeks, depending on organisational scope and involved parties.
Certification
Following a positive expert decision, a complete assessment may lead to the Vulneras Governance Certificate.
01
When this fits
Fragmented accountability
When teams, suppliers and platform roles do not operate from one control model.
Enterprise scaling
When OutSystems has become business-critical and informal agreements no longer suffice.
02
What we assess
Leadership and accountability
Mandate, risk decisions, responsibilities and executive reporting.
Policy and secure delivery
Workable frameworks, exceptions, quality assurance and decision making.
Suppliers and supply chain control
Agreements, access, evidence, oversight and supply chain accountability.
Monitoring and audit readiness
Verifiable evidence, compliance requests, reporting and follow-up.
Incident response and continuity
Escalation, crisis decisions, recovery capability and lessons learned.
Agentic AI policy and oversight
Inventory, approval, authority, logging and responsible use.
03
What you receive
Maturity assessment
A substantiated view of governance maturity by domain.
Gap analysis
Concrete differences between policy, accountability, evidence and actual operation.
Governance roadmap
Priorities for decisions, ownership and demonstrable improvement.
Objective comparison
Choose the engagement based on the question, not the certificate.
The comparison below makes scope, result and certification eligibility clear in advance.
| Mini Scan | Security Assessment | Governance Assessment | Combined engagement | |
|---|---|---|---|---|
| Primary question | Initial risk view | Technical and organisational security | Executive control | Complete enterprise view |
| Six domains | Selected | Security profile | Governance profile | Both profiles |
| Evidence references | Limited | Complete | Complete | Complete |
| Client report | Concise | Complete | Complete | Combined |
| Certification decision | No | Included | Included | Two separate decisions |
| Indicative investment | €2,500 to €4,000 | €12,500 to €20,000 | €15,000 to €25,000 | Custom |
You pay for independent research and reporting, never for a predetermined outcome.