For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
Inspect performs structured discovery using a headless browser. It works against two surfaces: a vendor’s public and authenticated surface area, where it validates attestations and extracts evidence from trust centers; and your own application tenants, where it signs in and reads the live admin console to collect evidence for a chosen set of controls. Either way it captures screenshots and artifacts with full chain-of-custody metadata.
What it does
Trust center extraction
Parse vendor trust centers (Drata, Vanta, SafeBase, custom portals) to extract published controls, certifications, and evidence references.
Attestation validation
Convert claims into verified evidence by retrieving the vendor’s published attestation pages and audit reports directly.
Chain-of-custody capture
Record screenshots, source URLs, timestamps, and request metadata for every artifact so audit trails are defensible.
Authenticated discovery
Sign in through Okta or Microsoft Entra SSO, a Google account, or a username and password, answering one-time codes and passkey prompts, so Inspect can reach evidence behind a login. For a gated vendor trust center, the agent fills in the access request form.
Inspecting your own applications
The other half of Inspect points at the applications you run. Rather than asking a vendor whether MFA is enforced, Inspect signs in to the tenant and reads the answer off the admin console. An inspection is one request against one target, with one control set and one purpose. Inside it, each control gets its own control run, so one control failing to collect evidence never stops the rest.Explore
Establish whether the evidence a control needs can be collected from this application at all. Run this first against an unfamiliar tenant.
Evaluate
Adjudicate the evidence against the control expectation and your scale. This is the run that produces a judgment.
Drift
Compare against a compatible earlier inspection, so a setting an administrator changed since the last run surfaces as a difference.
exact, changed, or an explicit reason it could not be compared, and a change is judged material, immaterial or inconclusive with a summary of what differs. A material change sends an alert to whoever requested the inspection, and an issue an Evaluate run raises becomes a finding, on the same Findings page as everything else, when you create one from it. See Internal control monitoring for how that joins up with third-party risk.
Absent evidence is reported, never omitted. An observation that could not be obtained still exists and still says why: unsupported, authentication required, forbidden, inconclusive, or failed. An application that does not sell a capability is not marked down for lacking it.
The AI Agents tab
Every application a company runs now ships its own AI agents, copilots and bots, and each one is an autonomous principal with authority inside that tenant. The AI Agents tab in Inspect is the one place a security team sees all of them, across every application, with what each may do and whether the application checks its actions at the moment they run.Applications
One row per connected application, with four posture cells read from its latest AI Agents, Copilots & Autonomous Actions inspection: Inventory, Authority, Attribution and Runtime authorization, each reading Met, a count of issues, or Not inspected. An application that was never inspected for agents stays in the list, because an unseen agent population is the finding.
Agents
One row per agent the inspection found: its name and the application’s own id, owner, status, the identity it runs as, the actions it may take as the admin console lists them, who can reach it, and when an inspection last saw it. Opening a row shows the evidence and the five runtime authorization checks for that application, with Create finding on each one that failed.
Vendors
The vendors whose agents act on your data: those assessed with the AI Agent Runtime Authorization template, scored on delegation, runtime authorization, credentials, and audit and stop, and those whose applications hold agents but have not been assessed yet.
How to integrate
Inspect accepts inspection plans and returns structured findings suitable for ingestion into an assessment record.Inspection plans
Specify target domains, evidence types, and auth context for each plan.
Structured findings
Results return as structured records that map directly to Coverbase evaluations, with citations and captured artifacts attached.
Common workflows
Eliminate manual vendor follow-up
Eliminate manual vendor follow-up
Instead of emailing a vendor for proof of encryption at rest, Inspect pulls the relevant section from their SOC 2 in the trust center, captures it with chain-of-custody metadata, and attaches it to the evaluation.
Reassessment refresh
Reassessment refresh
When a reassessment collects documents automatically, the agent retrieves the vendor’s trust center documents again, so an updated SOC 2 or a lapsed certification is what the new evaluation reads.
Pre-intake screening
Pre-intake screening
Retrieve the vendor’s trust center documents before sending a questionnaire. Controls the documents already answer are evaluated from them, and follow-up questions go to the vendor only for the gaps.
Related
Internal control monitoring
Running Inspect against your own applications, and how internal and third-party risk share one model.
Control Set library
The internal and vendor control sets Inspect evaluates against.