Before or after a major go-live
Before a major go-live or ODC migration, or after a security incident: independently establish which risks need to be controlled.
Vulneras Security Assessment
Technical depth translated into an actionable risk picture.
We examine how applications, platform choices, deployment, monitoring, resilience and agentic AI are controlled in practice.
Audience
CISOs, security teams, auditors, CIOs and OutSystems platform owners.
Duration
Typically four to eight weeks, depending on scope and available evidence.
Certification
Following a positive expert decision, a complete assessment may lead to the Vulneras Security Certificate.
01
When this fits
For audit or compliance requests
For a security audit, ISO27001 programme, NIS2 preparation, audit findings or a customer security questionnaire.
After growth or platform change
When a new CISO joins, platform ownership changes, governance concerns arise or O11, ODC, integrations and teams grow.
02
What we assess
Platform configuration, security architecture, selected applications, development, deployment, governance and operational evidence come together in six assessment areas.
Application security and secure development
Review of selected applications: authorisation, data flows, APIs, integrations, input validation and secure development patterns, including application logic and source code where needed.
Secure SDLC and governance
Design decisions, reviews, quality gates, dependencies and managed exceptions.
Platform and deployment security
Configuration, privileged access, environments and the responsibility model.
Monitoring, compliance and evidence
Logging, detection, audit trails and convincing evidence of control.
Incident response and resilience
Preparation, containment, recovery, exercises and executive escalation.
Agentic AI security and governance
Data and tool access, guardrails, human oversight and traceability.
03
What you receive
Scope and certification decision
The documented scope and an independent certification decision. The corresponding certificate can only be issued following a positive expert decision.
Executive summary
A decision-ready picture of risk, control and priorities.
Scorecard and evidence
Six domain conclusions with evidence references and concrete findings.
90-day roadmap
Prioritised actions with ownership and realistic timelines.
04
Scope and application review
An assessment typically covers one OutSystems landscape: Development, Test, Acceptance and Production environments under one governance model. We agree the actual environments, selected applications, integrations and any exceptions in advance.
Applications are reviewed
Yes. We review selected applications for authorisation, data flows, APIs, integrations and secure development patterns. This includes examining application logic and source code where needed to validate risks and controls. We agree the applications and review depth in advance. The assessment does not include full penetration testing or a complete source code review of every application as standard, and it is not ISO27001 certification.
05
What we need from your team
Preparation, interviews and validation
Your team helps define the scope, provides existing documentation and evidence, and joins focused interviews and findings validation. We agree in advance which platform, development, security and governance owners are needed and what access they should arrange. The effort depends on the scope and evidence availability; we agree this during the intake.
06
Alongside your tools and partners
One independent opinion
Existing tools and partner assessments remain useful sources of evidence, including results from Architecture Dashboard, LifeTime, ODC Insights or security testing. Vulneras combines these with application review, platform configuration, processes, governance and operational evidence in one independent opinion on the agreed scope. You receive prioritised improvements and, for a full assessment, a certification decision.
Objective comparison
Choose the engagement based on the question, not the certificate.
The comparison below makes scope, result and certification eligibility clear in advance.
| Mini Scan | Security Assessment | Governance Assessment | Combined engagement | |
|---|---|---|---|---|
| Primary question | Initial risk view | Technical and organisational security | Executive control | Complete enterprise view |
| Six domains | Selected | Security profile | Governance profile | Both profiles |
| Evidence references | Limited | Complete | Complete | Complete |
| Client report | Concise | Complete | Complete | Combined |
| Certification decision | No | Included | Included | Two separate decisions |
| Indicative investment | €2,500 to €4,000 | €12,500 to €20,000 | €15,000 to €25,000 | Custom |
You pay for independent research and reporting, never for a predetermined outcome.