Purpose
Give boards, audit and platform owners an independent, demonstrable view of risk, control and priorities.
Vulneras Methodology v1.0
A verifiable method for a complex OutSystems landscape.
Vulneras connects technical research, governance and evidence in one scope-bound expert assessment. The public methodology explains what is assessed and how a decision is reached without exposing internal control questions or decision rules.
Public foundation
Vulneras Methodology v1.0
Audience
Organisations with business-critical O11 or ODC landscapes, including those deploying or preparing agentic AI.
Evidence
Conclusions are tied to verifiable evidence references. Verbal statements provide context but are not independent evidence of control.
Expert decision
The lead assessor weighs scope, domain reviews, findings and evidence. Only a complete, positive and signed expert decision can lead to certification.
Validity
A certificate is valid for 365 days by default. Material changes may result in suspension and targeted reassessment.
Assessment principles
Verifiable without exposing internal decision logic.
Scope before score
The environments, applications, integrations and exclusions are recorded before the assessment starts.
Evidence before assumption
Every conclusion points to evidence and makes missing evidence visible.
Connected control
Technology, process, accountability and operational behaviour are assessed as one system.
Expert decision
Scores support the decision but never replace the lead assessor’s reasoned judgement.
Vulneras Security Profile
Technical and organisational control of one defined O11 or ODC landscape.
Application Security & Secure Development
Authorisation, data flows, APIs, integrations, input validation and secure patterns.
Secure SDLC & Governance
Design decisions, reviews, quality gates, dependencies and managed exceptions.
Platform & Deployment Security
Configuration, privileged access, environments and the responsibility model.
Monitoring, Compliance & Evidence
Logging, detection, audit trails and convincing evidence of control.
Incident Response & Resilience
Preparation, containment, recovery, exercises and executive escalation.
Agentic AI Security & Governance
Data and tool access, guardrails, human oversight and traceability.
Vulneras Governance Profile
Executive control of accountability, policy, evidence, suppliers and resilience.
Leadership and accountability
Mandate, risk decisions, responsibilities and executive reporting.
Policy and secure delivery
Workable frameworks, exceptions, quality assurance and decision making.
Suppliers and supply chain control
Agreements, access, evidence, oversight and supply chain accountability.
Monitoring and audit readiness
Verifiable evidence, compliance requests, reporting and follow-up.
Incident response and continuity
Escalation, crisis decisions, recovery capability and lessons learned.
Agentic AI policy and oversight
Inventory, approval, authority, logging and responsible use.
Assessment process
From trigger to a reasoned decision.
01 Intake
Establish the trigger, platform context and decision makers.
02 Scope
Record the landscape, evidence sources, exclusions and responsibilities.
03 Research
Perform technical and organisational controls and register evidence.
04 Validation
Validate facts, context and findings with accountable stakeholders.
05 Decision
Record the expert decision, report, roadmap and any certificate.
v1.0, active baseline
Six security domains, six governance domains, scope-bound certification and 365-day validity.
The methodology is managed internally by Evergreen IT and led by Remco Dekkinga. v1.0 is not externally validated or approved by OutSystems.