Skip to main content
For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
Inspect performs structured discovery using a headless browser. It works against two surfaces: a vendor’s public and authenticated surface area, where it validates attestations and extracts evidence from trust centers; and your own application tenants, where it signs in and reads the live admin console to collect evidence for a chosen set of controls. Either way it captures screenshots and artifacts with full chain-of-custody metadata.

​
What it does

Trust center extraction

Parse vendor trust centers (Drata, Vanta, SafeBase, custom portals) to extract published controls, certifications, and evidence references.

Attestation validation

Convert claims into verified evidence by retrieving the vendor’s published attestation pages and audit reports directly.

Chain-of-custody capture

Record screenshots, source URLs, timestamps, and request metadata for every artifact so audit trails are defensible.

Authenticated discovery

Sign in through Okta or Microsoft Entra SSO, a Google account, or a username and password, answering one-time codes and passkey prompts, so Inspect can reach evidence behind a login. For a gated vendor trust center, the agent fills in the access request form.

​
Inspecting your own applications

The other half of Inspect points at the applications you run. Rather than asking a vendor whether MFA is enforced, Inspect signs in to the tenant and reads the answer off the admin console. An inspection is one request against one target, with one control set and one purpose. Inside it, each control gets its own control run, so one control failing to collect evidence never stops the rest.

Explore

Establish whether the evidence a control needs can be collected from this application at all. Run this first against an unfamiliar tenant.

Evaluate

Adjudicate the evidence against the control expectation and your scale. This is the run that produces a judgment.

Drift

Compare against a compatible earlier inspection, so a setting an administrator changed since the last run surfaces as a difference.
Control sets come from the Internal Controls Library: 22 templates spanning 392 controls, covering identity, privileged access, integrations and OAuth, data handling, PII, PHI, GDPR, AI features and agents, resilience, SLA conformance, audit logging, and licensing, plus a CIS Controls v8.1 SaaS baseline. Re-run on a cadence and Drift turns point-in-time evidence into continuous assurance: each comparison reports exact, changed, or an explicit reason it could not be compared, and a change is judged material, immaterial or inconclusive with a summary of what differs. A material change sends an alert to whoever requested the inspection, and an issue an Evaluate run raises becomes a finding, on the same Findings page as everything else, when you create one from it. See Internal control monitoring for how that joins up with third-party risk.
Absent evidence is reported, never omitted. An observation that could not be obtained still exists and still says why: unsupported, authentication required, forbidden, inconclusive, or failed. An application that does not sell a capability is not marked down for lacking it.
Progress and outcome are separate facts. “5 of 5 controls finished” says nothing about whether any of them passed, so read the status rather than the count.

​
How to integrate

Inspect accepts inspection plans and returns structured findings suitable for ingestion into an assessment record.

Inspection plans

Specify target domains, evidence types, and auth context for each plan.

Structured findings

Results return as structured records that map directly to Coverbase evaluations, with citations and captured artifacts attached.

​
Common workflows

Eliminate manual vendor follow-up

Instead of emailing a vendor for proof of encryption at rest, Inspect pulls the relevant section from their SOC 2 in the trust center, captures it with chain-of-custody metadata, and attaches it to the evaluation.
When a reassessment collects documents automatically, the agent retrieves the vendor’s trust center documents again, so an updated SOC 2 or a lapsed certification is what the new evaluation reads.
Retrieve the vendor’s trust center documents before sending a questionnaire. Controls the documents already answer are evaluated from them, and follow-up questions go to the vendor only for the gaps.

Internal control monitoring

Running Inspect against your own applications, and how internal and third-party risk share one model.

Control Set library

The internal and vendor control sets Inspect evaluates against.