Skip to main content
For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
Inspect performs structured discovery using a headless browser. It works against two surfaces: a vendor’s public and authenticated surface area, where it validates attestations and extracts evidence from trust centers; and your own application tenants, where it signs in and reads the live admin console to collect evidence for a chosen set of controls. Either way it captures screenshots and artifacts with full chain-of-custody metadata.

​
What it does

Trust center extraction

Parse vendor trust centers (Drata, Vanta, SafeBase, custom portals) to extract published controls, certifications, and evidence references.

Attestation validation

Convert claims into verified evidence by checking attestation pages, audit reports, and certificate registries directly.

Chain-of-custody capture

Record screenshots, source URLs, timestamps, and request metadata for every artifact so audit trails are defensible.

Authenticated discovery

Accept auth context (cookies, credentials, SSO tokens) where required so Inspect can reach evidence behind login walls.

​
Inspecting your own applications

The other half of Inspect points at the applications you run. Rather than asking a vendor whether MFA is enforced, Inspect signs in to the tenant and reads the answer off the admin console. An inspection is one request against one target, with one control set and one purpose. Inside it, each control gets its own control run, so one control failing to collect evidence never stops the rest.

Explore

Establish whether the evidence a control needs can be collected from this application at all. Run this first against an unfamiliar tenant.

Evaluate

Adjudicate the evidence against the control expectation and your scale. This is the run that produces a judgment.

Drift

Compare against a compatible earlier inspection, so a setting an administrator changed since the last run surfaces as a difference.
Control sets come from the Internal Controls Library: 21 templates spanning 362 controls, covering identity, privileged access, integrations and OAuth, data handling, PII, PHI, GDPR, AI features and agents, resilience, SLA conformance, audit logging, and licensing. Re-run on a cadence and Drift turns point-in-time evidence into continuous assurance: each comparison reports exact, changed, or an explicit reason it could not be compared, and a change is judged material, immaterial or inconclusive with a summary of what actually differs. A material change becomes a finding on the same queue as everything else. See Internal control monitoring for how that joins up with third-party risk.
Absent evidence is reported, never omitted. An observation that could not be obtained still exists and still says why: unsupported, authentication required, forbidden, inconclusive, or failed. An application that does not sell a capability is not marked down for lacking it.
Progress and outcome are separate facts. “5 of 5 controls finished” says nothing about whether any of them passed, so read the status rather than the count.

​
How to integrate

Inspect accepts inspection plans and returns structured findings suitable for ingestion into an assessment record.

Inspection plans

Specify target domains, evidence types, and auth context for each plan.

Structured findings

Results return as structured records that map directly to Coverbase evaluations, with citations and captured artifacts attached.

​
Common workflows

Eliminate manual vendor follow-up

Instead of emailing a vendor for proof of encryption at rest, Inspect pulls the relevant section from their SOC 2 in the trust center, captures it with chain-of-custody metadata, and attaches it to the evaluation.
On scheduled reassessment, Inspect re-runs against the vendor’s trust center surface. Changes in published evidence (updated SOC 2, expired certifications, new subprocessors) flow into delta detection automatically.
Run Inspect before sending a questionnaire. If the vendor’s trust center already answers 60% of your controls, the questionnaire can be scoped down to the gaps.
Inspect is currently available as part of the Coverbase platform. Programmatic plan submission via API is on the near-term roadmap. Talk to your account manager about early access.

Internal control monitoring

Running Inspect against your own applications, and how internal and third-party risk share one model.

Control Set library

The internal and vendor control sets Inspect evaluates against.