Application Security & Secure Development
We examine risk in application logic, authorisation, data flows, APIs and integrations.
Server-side authorisation · input validation · secrets · secure patterns
Independent assurance for OutSystems
Control across your entire OutSystems landscape.
Demonstrate to auditors, regulators, customers and executives how your OutSystems landscape operates under measurable control. Vulneras independently assesses the risks, evidence and improvements needed.
O11 and ODCSix assessment areasPublicly verifiable certificate
Sample reportExecutive risk overview
Review completedOverall view6.7 / 10
Needs attention01Application Security & Secure Development7.4
02Secure SDLC & Governance6.8
03Platform & Deployment Security7.1
04Monitoring, Compliance & Evidence5.9
05Incident Response & Resilience6.3
06Agentic AI Security & Governance4.8
Security Assessment
Six areas. One coherent opinion.
We review platform configuration, security architecture, selected applications, development and deployment processes, governance and operational evidence. Application review, including source code where needed, is part of the agreed scope.
Secure SDLC & Governance
We test whether security is demonstrably embedded in design, development, review and release.
Quality gates · code review · dependencies · exceptions
Platform & Deployment Security
We clarify responsibilities and configuration risks across O11, ODC and the selected deployment model.
Environments · privileged access · configuration · accountability
Monitoring, Compliance & Evidence
We assess whether the organisation can detect anomalies and provide convincing evidence of control.
Logging · monitoring · audit trails · compliance evidence
Incident Response & Resilience
We test whether teams can contain, recover from and escalate incidents effectively.
Detection · access revocation · recovery · exercises
Agentic AI Security & Governance
We assess what agents may see, decide and execute and how human oversight is organised.
Data · tools · guardrails · traceability · human control
OutSystems risk check · about 4 minutes
What can you demonstrably control today?
Twelve focused questions provide an initial indication per assessment area. The result is not certification or a technical opinion.
Application security
Is authorisation enforced for every server action and API independently of the user interface?
Scope-bound certification
Independently assessed. Publicly verifiable.
Following a positive Security or Governance Assessment, the lead assessor can issue the corresponding Vulneras certificate for the precisely defined scope.
Vulneras Security Certificate
For demonstrable technical and organisational control of a defined O11 or ODC landscape.
Vulneras Governance Certificate
For demonstrable control of policy, accountability, suppliers, evidence, resilience and agentic AI.
The certificate confirms demonstrable control within the assessed scope. It is not a guarantee that an incident can never occur.
Valid for 365 days by default. Material changes must be reported and may result in suspension and reassessment.
- ✓ Unique, publicly verifiable ID
- ✓ Linked to a signed assessment
- ✓ Current status: valid, suspended, expired, superseded or revoked
- ✓ No public disclosure of scope, scores or findings
VERIFIEDVulneras Security Certificateby Evergreen IT
EG-CERT-2026-A1B2C3D4VALID365 DAYS · SCOPE-BOUND
Verify a certificate
Check directly with Evergreen IT whether a certificate is valid, suspended, expired, superseded or revoked.
Issued independently by Evergreen IT. Not certified, approved or endorsed by OutSystems.
Remco DekkingaMethodology Lead & Lead Assessor · OutSystems MVP
Specialist review · clear accountability
Delivered as a team. Led by Remco.
As Methodology Lead & Lead Assessor, Remco develops the assessment criteria, leads the substantive review and signs the final certification decision.
The methodology builds on his Security-First Blueprint, presented at OutSystems ONE.
MVPRecognised by OutSystems
O11 & ODCPlatform context in scope
ExecutiveTechnology translated into decisions
IndependentFreedom to choose follow-up
Investment
Start focused. Scale where needed.
We agree scope, depth and investment in advance.
You pay for the independent assessment and reporting, not for an outcome. Only a complete assessment with a positive expert decision leads to certification.
No-obligation introduction
Intake and initial interpretation of reason and scope.
Mini Scan
Focused scan of key OutSystems risks; without certification.
Most popular
€5,000 to €15,000Vulneras Security Assessment
Six-area security review for one defined OutSystems landscape, including a certification decision.
✓ Certification decision includedVulneras Enterprise Governance Assessment
Organisation-wide assessment of leadership, processes, suppliers, evidence and regulatory readiness, including a Governance certification decision.
Combined engagement
Security and enterprise governance in one coordinated assurance engagement.
Implementation support
Hands-on support for improvements, separated from the certification decision.
Frequently asked questions
Clarity before you start.
Answers to common questions about our assessments and certification.
Which OutSystems platforms does the review cover?
We assess both OutSystems 11 (O11) and OutSystems Developer Cloud (ODC). An assessment typically covers one OutSystems landscape: Development, Test, Acceptance and Production environments under one governance model. We agree the actual environments, selected applications, integrations and any exceptions in advance.
What is the difference between a Mini Scan and a full assessment?
A Mini Scan is a focused quickscan of the main OutSystems risks, without certification. A Security Assessment examines six assessment areas within a defined landscape. An Enterprise Governance Assessment focuses on leadership, processes, suppliers and evidence. Both full assessments include a certification decision.
Are AI agents included in the review?
Agentic AI is one of our assessment areas. When defining the engagement, we agree which AI agents, data flows, access rights and responsibilities will be examined.
What do we receive after a full assessment?
You receive an executive summary, prioritised findings with evidence references and an improvement roadmap for the first 90 days. These come with a documented scope and a certification decision. Following a positive opinion, the corresponding digital certificate can be issued.
Do we automatically receive a certificate?
No. You pay for independent investigation and reporting. Only a full assessment with a positive expert decision leads to certification for the assessed scope. A Mini Scan does not qualify for a certificate.
How do we agree on scope and investment?
We start with a no-obligation intake about your O11/ODC context, reason for contact and required assurance. We then agree the scope, depth, required evidence and investment in advance.
When should I engage Vulneras?
For example, before an ODC migration, security audit, ISO27001 programme or NIS2 preparation; when a new CISO joins or platform ownership changes; or after a security incident, audit findings, a customer security questionnaire or governance concerns.
How much effort is required from our team?
Your team helps define the scope, provides existing documentation and evidence, and joins focused interviews and findings validation. We agree in advance which platform, development, security and governance owners are needed and what access they should arrange. The effort depends on the scope and evidence availability; we agree this during the intake.
Do you review applications and source code?
Yes. We review selected applications for authorisation, data flows, APIs, integrations and secure development patterns. This includes examining application logic and source code where needed to validate risks and controls. We agree the applications and review depth in advance. The assessment does not include full penetration testing or a complete source code review of every application as standard, and it is not ISO27001 certification.
What does Vulneras add to our tools and security partner?
Existing tools and partner assessments remain useful sources of evidence, including results from Architecture Dashboard, LifeTime, ODC Insights or security testing. Vulneras combines these with application review, platform configuration, processes, governance and operational evidence in one independent opinion on the agreed scope. You receive prioritised improvements and, for a full assessment, a certification decision.
30 minutes · no-obligation intake
Bring your OutSystems risks into focus.
We discuss your O11/ODC context, reason and required assurance. You will then know which scope and review format fit.