Source library

Coverbase assembles a vendor’s risk picture from three layers of intelligence: point-in-time due-diligence blocks queried during onboarding and periodic review, continuous-monitoring feeds (Supplier Radar) that surface emerging signals in real time, and partner integrations you can connect to deepen coverage. This page catalogs every source across all three layers. The library spans 90+ sources, grouped into three tiers by how you get access. Use the tabs below to filter by tier, or read the tier definitions first.

What the tiers mean

Tier	What it means	How you get it
Core	Live and included in the platform today, at no additional cost or setup.	Coverbase operates the connection for you: public and free-tier feeds, or Coverbase’s own keys. Nothing to configure.
Optional	Coverbase has a built API connection, but the feed runs on your subscription.	You contract with the provider directly and supply the API keys; Coverbase plugs them in.
Premium	Available through a Coverbase paid add-on or reseller / partner tier.	Access is arranged through Coverbase’s commercial relationship with the provider; no self-serve key required from you.

Sources are a starting point. You can add your own feeds, pages, or APIs alongside the built-in ones, and every source’s scope (and the detectors that read it) is configurable in the dashboard. See Supplier Radar for the continuous-monitoring product and Radar API for programmatic access.

Core
Optional
Premium

Live and included today. Every source below is operated by Coverbase using public, free-tier, or Coverbase-held credentials: there is nothing for you to buy or configure.

Cybersecurity news & advisories

Source	What it covers
BleepingComputer	Cybersecurity, technology, and ransomware news
CISA Cybersecurity Advisories	Official alerts and advisories from the U.S. Cybersecurity and Infrastructure Security Agency
Cybersecurity Dive	In-depth news and analysis on breaches, vulnerabilities, and threats
SecurityWeek	Cybersecurity news, insights, and expert analysis for security professionals
Dark Reading	Widely-read cybersecurity community covering news, vulnerabilities, and threats
Dark Web Informer	Dark-web and cybercrime aggregator tracking breaches, ransomware, and threat intelligence
Krebs on Security	Investigative reporting on cybercrime, data breaches, and online fraud
The Hacker in a Hoodie Index (SEC 8-K disclosures)	Curated ledger of SEC 8-K material cyber-incident disclosures: breaches, ransomware, and unauthorized access by public companies, each linked to its source EDGAR filing
The Hacker in a Hoodie Index (media-reported incidents)	Curated ledger of media-reported cyber incidents beyond SEC filings, with the reporting outlet and an attribution grade

Vulnerability, exploit & threat intelligence

Source	What it covers
NIST National Vulnerability Database (with KEV)	NIST’s CVE database enriched with CVSS scores and CPE mappings, filtered to CISA KEV-listed vulnerabilities
MITRE CVE Program	The foundational CVE dictionary; new CVE assignments and CNA disclosures ingested as early-warning signals
CISA KEV Catalog	CISA’s Known Exploited Vulnerabilities catalog: CVEs with confirmed active exploitation
FIRST EPSS (Exploit Prediction Scoring System)	Daily EPSS exploitation-probability scores for newly published CVEs
GitHub Security Advisories	GitHub Advisory Database of reviewed security advisories for open-source packages and ecosystems
Exploit-DB	Public exploit database cataloging proof-of-concept exploit code for disclosed CVEs
The Hacker News	Vulnerabilities, exploits, malware, and breaches
The Record	Threat-intelligence journalism on ransomware, nation-state activity, and breaches
Outside-In Threat Intelligence	Per-vendor outside-in intelligence: discovers CVEs for a vendor’s Bill of Materials and marketed products, fuses CISA KEV exploited-status and EPSS probability, and adds attack-surface signals
CISA Known Breach Disclosures	Breach notifications and significant cyber incidents reported to CISA under CIRCIA and related frameworks

Attack surface & exposure (outside-in)

Source	What it covers
Certificate Transparency (crt.sh)	Subdomain and certificate discovery from public CT logs
Qualys SSL Labs	TLS/SSL configuration grading for a vendor’s public endpoints
DNS & MX records (Cloudflare)	Domain and mail-exchange records for DNS and email-security posture (SPF, DKIM, DMARC)
Norton Safe Web	Site reputation and safety signals
GreyNoise	Internet background-noise context: distinguishes targeted activity from benign scanners
VirusTotal	File, URL, domain, and IP reputation aggregated across dozens of engines

Sanctions, watchlists & PEP screening

Source	What it covers
OFAC SDN List	U.S. Treasury Specially Designated Nationals and Blocked Persons list
OFAC Consolidated Sanctions List	SDN list plus additional OFAC programs (sectoral, country-specific)
UN Security Council Consolidated List	UN sanctions list of individuals, groups, and entities
EU Sanctions List	EU consolidated list of persons and entities under restrictive measures
HM Treasury UK Sanctions List	Post-Brexit UK sanctions regime maintained by HM Treasury

Regulatory & enforcement actions

Source	What it covers
SEC Stop Orders	Orders halting share sales under a materially misleading or deficient registration statement
SEC Litigation Releases	Civil actions brought by the SEC in federal court
SEC Administrative Proceedings	Litigated administrative proceedings adjudicated by the SEC
SEC Reports of Investigations	Investigative reports cautioning market participants on their federal securities-law obligations
CFPB Enforcement Actions	CFPB actions against providers for unfair, deceptive, or abusive financial practices
FCC Enforcement Actions	FCC actions enforcing the Communications Act and commission rules
FDIC Enforcement Actions	FDIC actions against insured depository institutions and affiliated parties
FinCEN Enforcement Actions	FinCEN actions for AML/BSA violations
HIPAA Journal Breach News	Healthcare data breaches, OCR enforcement, and HIPAA-related incident reporting

Breach notification registries & disclosures

Official registries where a breach becomes public because the law required someone to file it. These land days to weeks before press coverage and cover every filing, not only the companies a newsroom would write about. See the breach notification monitoring guide for how to use them.

Source	What it covers
California AG Data Breach Notifications	Every breach notice filed with the California Attorney General, with the reporting organization, the breach dates, and the notice sent to residents
Delaware AG Data Security Breach Database	Filings with the Delaware Attorney General, including Delaware residents affected
Washington AG Data Breach Notifications	Filings with the Washington Attorney General, with Washingtonians affected and the categories of information compromised
Vermont AG Security Breach Notices	Filings with the Vermont Attorney General, with the reporting organization’s sector, residents affected, and data categories
Oregon DOJ Data Breach Reports	Filings with the Oregon Department of Justice, with breach, discovery, and notification dates
Indiana AG Security Breach Reports	Indiana’s year-to-date registers, with dates and Indiana residents affected
Texas AG Data Security Breach Reports	Filings with the Texas Attorney General since September 2021, with the information affected and Texans notified
Hawaii OCP Security Breach Notices	Filings with Hawaii’s Office of Consumer Protection, with how the breach happened, Hawaii residents impacted, and the notification letter
Rhode Island AG Data Breach Notifications	Filings with the Rhode Island Attorney General, required of any breach touching more than 500 Rhode Islanders
Maryland AG Security Breach Notices	Filings with the Maryland Attorney General, with Marylanders affected, what information was breached, and how
Iowa AG Security Breach Notifications	Filings with the Iowa Attorney General, with the business, its industry, and the notice sent to Iowans
Massachusetts AG Data Breach Notification Reports	Filings with the Massachusetts Attorney General, with residents affected and whether the data was encrypted
New Hampshire DOJ Security Breach Notifications	Filings with the New Hampshire Department of Justice, published as the notice letters themselves
HHS OCR HIPAA breach portal	Every HIPAA breach of 500 or more records reported to the Office for Civil Rights, in all fifty states
FTC enforcement	Federal Trade Commission actions, including Health Breach Notification Rule enforcement
SEC EDGAR Form 8-K Item 1.05	Material cybersecurity incidents disclosed by public companies on the item created for them
SEC EDGAR 10-K / 10-Q cyber disclosures	Annual and quarterly reports discussing a material cybersecurity incident

Not every state publishes what it receives. New York, and most states, take filings through a portal and publish nothing back, so there is nothing to monitor. Maine took its public database offline in June 2026 after fake filings were submitted against real companies. Wisconsin never collects the data at all: its law requires notice to affected individuals only, not to any state agency. Montana’s breach page no longer exists. For every other state, coverage comes from the national sources above: HHS OCR spans all fifty states for healthcare, SEC EDGAR for public companies, and the FTC for federal enforcement.

Corporate & legal registration

Source	What it covers
SEC EDGAR	Official registration and filing data for U.S. public companies (10-K, 10-Q, 8-K, proxies)
GLEIF	Global LEI Foundation: Legal Entity Identifier, legal name, entity status, jurisdiction, and addresses
OpenCorporates	Company registrations aggregated from official registries across 140+ jurisdictions
Companies House (UK)	UK government registry: officer appointments, filing history, and accounts
State-Level Business Registries (US)	Secretary of State filings across the 50 U.S. states for entity verification and good-standing status

Company & financial intelligence

Source	What it covers
PitchBook	Private and public company intelligence: funding rounds, investors, valuations, and M&A history
Crunchbase	Startup and growth-stage profiles: funding history, investor network, and acquisitions
Polygon.io	Public-markets data: ticker, market cap, list date, and stock financials
Perplexity	LLM-assisted resolution of private-company deal data, status, and public tickers
Tavily	Web-search enrichment powering a vendor’s generated “scanned facts”
SafeBase	Vendor trust-center documents and published security posture
TheOrg	Org-chart and leadership enrichment

Financial news & markets

Source	What it covers
Bloomberg - Markets	Market data, equities, bonds, and finance news
Bloomberg - Economics	Economic news, central banks, and macro analysis
Bloomberg - Technology	Technology news, startups, and innovation
SeekingAlpha	Crowdsourced financial market news, analysis, and stock-market insight

News & reputational

Source	What it covers
CNN	Global breaking news
AP News	Fast, objective global newswire coverage
Reuters	International news across business, finance, politics, and technology
Bloomberg - Politics	Political news and policy coverage with financial and regulatory implications
Google News Alerts	Real-time, vendor-specific news alert subscriptions
Google News Feed	Broad news aggregation for ongoing reputational monitoring

Legal

Source	What it covers
Law.com - Corporate Legal	Legal news and analysis for corporate legal departments and in-house counsel

Coverbase has a built API connection for each source below, but it runs on your subscription: you contract with the provider and supply the API keys, and Coverbase plugs them into your Vendor Intelligence and monitoring.

Business identity & financial health

Source	What it covers
Dun & Bradstreet - Identity Resolution	Matches vendors to a D-U-N-S number and establishes a canonical, deduplicated identity
Dun & Bradstreet - Company Information	Firmographics: industry classification, employee count, revenue, founding date, and geography
Dun & Bradstreet - Hierarchy & Connections	Parent, subsidiary, and branch linkage: concentration risk and beneficial-ownership chains
Dun & Bradstreet - Payment Insights	PAYDEX® score and tradeline-based payment-behavior indicators
Dun & Bradstreet - Financial Strength Insights	Composite stability view: D&B Rating, Credit Recommendation, Delinquency Score, and Failure Score
Dun & Bradstreet - Higher-Tier Blocks	Deeper entitlements: Payment/Financial Strength Levels 2-3 and Global Failure Score, added to your D&B connection

Attack surface & exposure (subscription)

Source	What it covers
Shodan	Internet-exposed services, open ports, and banners across a vendor’s attack surface
Censys	Internet-wide host and certificate scanning for exposure discovery
Have I Been Pwned	Vendor domain and credential exposure across known breach corpora

Available through a Coverbase paid add-on or reseller / partner tier. Coverbase arranges access through its relationship with the provider: you don’t supply your own key.

Business identity, credit & verification

Source	What it covers
Equifax - Business Verification (KYB)	Real-time Know Your Business verification with a fraud-potential index, OFAC screening, and adverse events
Equifax - Business Credit Reports & Risk Scores	Commercial credit intelligence, OneScore for Commercial, and business-failure/delinquency risk scores
Equifax - Commercial Financial Network (CFN)	Shared commercial data exchange combining payment performance with identity and firmographics
Equifax - Commercial Merchant Data	Near-real-time business activity from millions of merchant records to confirm a vendor is active and operating
Equifax - Identity Proofing / Kount 360	Orchestrated identity and fraud platform for verifying vendor principals and beneficial owners

Sanctions, PEP & adverse media screening

Source	What it covers
Equifax - Watchlist & Adverse Media Screening	150+ sanctions and watchlists plus 30,000+ adverse-media sources via the Intelligent Match Engine
Equifax - AML Connect	Cloud-hosted AML screening across global watchlists, PEPs, and adverse media with ongoing monitoring
LexisNexis WorldCompliance	PEP, sanctions, adverse-media, and regulatory watchlist screening for BSA/AML programs
Refinitiv World-Check (LSEG)	Global KYC/AML due-diligence database covering PEPs, sanctions, state-owned enterprises, and adverse media

Financial health ratings

Source	What it covers
Rapid Ratings	Financial Health Rating (FHR) scores and underlying performance metrics, distinct from credit ratings

Breach & leak intelligence

Source	What it covers
IntelligenceX	Aggregated leaked datasets, breached databases, and dark-web intelligence for early exposure detection

Security ratings & outside-in monitoring

Source	What it covers
BitSight	Continuous outside-in security ratings based on observed internet-facing behavior
SecurityScorecard	Continuous security-posture scoring across network, DNS, patching, and endpoint categories
Black Kite	Technical, financial, and compliance cyber-risk ratings for third parties
RiskRecon (Mastercard)	Automated third-party cyber-risk monitoring with asset discovery and remediation tracking
UpGuard	Outside-in monitoring for data-leak detection, typosquatting, and attack-surface management
Recorded Future	Real-time threat intelligence across the open, deep, and dark web
Mandiant	Threat intelligence and breach analytics from frontline incident response
Panorays	Automated third-party attack-surface assessment and security ratings
CyberGRX (ProcessUnity)	Exchange-based third-party cyber-risk assessments and analytics
Axio	Cyber-risk quantification and posture benchmarking
IONIX	Attack-surface discovery and exposure management across a vendor’s connected assets

ESG & sustainability ratings

Source	What it covers
EcoVadis	Sustainability ratings across environment, labor, ethics, and sustainable procurement
Sustainalytics	ESG risk ratings measuring exposure to material sustainability risks
ISS ESG	Corporate ESG ratings, controversy screening, and governance signals
CyberVadis	Third-party cybersecurity ratings built on a standardized assessment methodology

Legal (subscription)

Source	What it covers
Law360	Subscription legal news and analysis across practice areas and litigation

Detector library

The companion library of built-in detector templates that read these sources and flag matching events.

Integration directory

The full catalog of external systems Coverbase connects with, including GRC, procurement, and contract platforms.

Supplier Radar

The product overview: signal ingestion, enrichment, triage, and workflow orchestration.

Radar API

Create radar events, and list, retrieve, and dismiss radar alerts programmatically.

Overview

Intake and assessment

Vendor intelligence

Monitoring

Contracts and documents

Sourcing and internal controls

Control Set library

What the tiers mean

Cybersecurity news & advisories

Vulnerability, exploit & threat intelligence

Attack surface & exposure (outside-in)

Sanctions, watchlists & PEP screening

Regulatory & enforcement actions

Breach notification registries & disclosures

Corporate & legal registration

Company & financial intelligence

Financial news & markets

News & reputational

Legal

Business identity & financial health

Attack surface & exposure (subscription)

Business identity, credit & verification

Sanctions, PEP & adverse media screening

Financial health ratings

Breach & leak intelligence

Security ratings & outside-in monitoring

ESG & sustainability ratings

Legal (subscription)

Detector library

Integration directory

Supplier Radar

Radar API

​What the tiers mean

​Cybersecurity news & advisories

​Vulnerability, exploit & threat intelligence

​Attack surface & exposure (outside-in)

​Sanctions, watchlists & PEP screening

​Regulatory & enforcement actions

​Breach notification registries & disclosures

​Corporate & legal registration

​Company & financial intelligence

​Financial news & markets

​News & reputational

​Legal

​Business identity & financial health

​Attack surface & exposure (subscription)

​Business identity, credit & verification

​Sanctions, PEP & adverse media screening

​Financial health ratings

​Breach & leak intelligence

​Security ratings & outside-in monitoring

​ESG & sustainability ratings

​Legal (subscription)

​Related

Detector library

Integration directory

Supplier Radar

Radar API

What the tiers mean

Cybersecurity news & advisories

Vulnerability, exploit & threat intelligence

Attack surface & exposure (outside-in)

Sanctions, watchlists & PEP screening

Regulatory & enforcement actions

Breach notification registries & disclosures

Corporate & legal registration

Company & financial intelligence

Financial news & markets

News & reputational

Legal

Business identity & financial health

Attack surface & exposure (subscription)

Business identity, credit & verification

Sanctions, PEP & adverse media screening

Financial health ratings

Breach & leak intelligence

Security ratings & outside-in monitoring

ESG & sustainability ratings

Legal (subscription)

Related