Assessment Strategy

Finding weaknesses is essential. Proving trust is a different mission.

A vulnerability assessment asks where a system may be exposed. A trust assessment asks what can be relied upon, why, under what boundary, and for how long.

Request Readiness Review Member Operations

The Difference

Dimension	Vulnerability Assessment	Trust Assessment
Primary question	What weaknesses or exposures exist?	What can be trusted, based on which evidence and boundary?
Focus	Known flaws, misconfigurations, missing patches, attack surface.	Evidence quality, control operation, identity, integrity, accountability, and decision governance.
Typical output	Findings, severity, exploitability, and remediation recommendations.	Trust decision, evidence record, exceptions, scope, validity, and verification status.
Time orientation	Point-in-time exposure snapshot.	Point-in-time decision with lifecycle, monitoring, renewal, and revocation.
Business use	Reduce technical risk and prioritize remediation.	Support assurance, procurement, customer confidence, governance, and defensible reliance.

Why Organizations Need Both

Vulnerability Assessment

Discovers conditions that may permit compromise. It is indispensable for technical risk reduction and attack-surface management.

Trust Assessment

Determines whether evidence supports a bounded trust claim and whether that claim should be approved, limited, monitored, or rejected.

Vulnerability assessment improves the system. Trust assessment governs reliance on the system. The strongest assurance program uses vulnerability findings as one evidence source inside a broader trust decision.

QILAHK Trust Assessment Flow

ScopeDefine the subject, boundary, stakeholders, and required trust claim.

CollectGather technical, operational, identity, and governance evidence.

AdjudicateEvaluate evidence, exceptions, freshness, and material uncertainty.

VerifyRecord the decision, publish eligible status, and govern lifecycle changes.