Skip to main content
For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
Supplier Radar watches threat intelligence feeds, public disclosures, sanctions and watchlists, breach databases, regulatory actions, and other external sources for events that touch your vendors. Every event your organization is exposed to becomes a signal, with a status, a severity, and a summary written for your portfolio, which you triage into a case, a finding, or a reassessment.

​
What it does

Multi-source ingestion

Combine threat intel, breach databases, sanctions and watchlists, regulatory actions, and public disclosures into one event stream. See the source library for every built-in source.

Vendor context enrichment

Normalize raw events and enrich them with the vendor’s risk tier, services in scope, contract status, and owner so triage decisions have context.

Workflow orchestration

Route signals into downstream actions: notify a vendor owner, open a finding, trigger a reassessment, or escalate to incident response.

​
Key concepts

Four terms, in the order you meet them.

​
Signal statuses

Signals move through statuses as you work them. Dismiss one, acknowledge it, or open a case, a finding, or a reassessment from it, and the status follows. The Needs attention view shows signals that are in alert. Triaged shows what has already been acted on or dismissed.

​
Titles and summaries

Radar writes each signal’s title and summary specifically for your organization, based on the event. The summary says what happened, when it occurred and when you were alerted, and which of your vendors are affected and how. It is regenerated when the detectors that fired change. You can edit either by hand. Regenerate summary rewrites both from what the detectors currently report and replaces any hand edit. Custom AI instructions on the summary card apply to every generated summary in your organization: lead with regulatory exposure, name the contract owner, keep to two sentences.

​
Exposure beyond the vendors named

An event names the vendors it is about. Radar also links the vendors that depend on them, through fourth-party relationships extracted from SOC 2 reports, subprocessor lists, and bills of materials. A breach at an identity provider becomes a Tracked signal for every vendor of yours that runs on it, before any detector has fired. The Vendors card on a signal page lists the vendors of yours linked to it.

​
Risk propagation

A signal arriving changes nothing on a vendor. Radar moves residual risk only when you act on the signal, and only for detectors you have told to. What moves it. Four actions: acknowledging the signal, creating a finding from it, starting a reassessment from it, and closing a case as Resolved or Won’t fix. Acknowledging is for the exposure that needs no case or finding but should still count against the vendor. Dismissing a signal, or closing a case as False positive, leaves risk where it was. How far it moves. Each detector carries a risk impact setting, off by default, with a minimum and maximum number of points out of 100 (1 to 10 unless you change them). When you act on one of its verdicts, Radar judges how severe the event is for that particular vendor and picks a value inside the range. The points land on the vendor’s overall residual risk and on each risk domain the detector maps to. Inherent risk never moves. A verdict counts once, however many actions follow it. You see it before you are done. After the action, Review vendor risk profile updates shows each affected vendor’s residual risk, overall and per domain, as it now stands. Adjust any score or level and add a note, then Save and continue, or Continue to accept. Vendors on a case whose detectors do not update risk are called out and left unchanged. Organizations that do not track residual risk skip this step. Where you see it. The vendor’s risk profile shows the new residual score, and its risk history records the change and the detector behind it. Vendors reached through a fourth-party relationship are treated the same way: act on their part of the signal and their residual risk moves too.

​
How to integrate

Radar API

Create radar events, and list, retrieve, and dismiss radar alerts programmatically. Signals are not addressable through the API yet.

Reassessments API

Turn a radar event or alert into a batch of vendor reassessments: curate, confirm, and run, without opening a case.

Webhooks

Subscribe to RadarEvent.*, RadarDetectorResult.*, and Reassessment.* events and react in real time.

MCP Server

Query radar alerts conversationally. “Any new radar alerts on tier-1 vendors in the past 24 hours?” or “Show me every vendor affected by the Northwind outage.”

Export API

Pull radar events and findings into your SIEM, incident response platform, or executive dashboards.

​
Common workflows

Third-party breach response

When a vendor is implicated in a breach disclosure, Radar surfaces every customer-side service that depends on that vendor, calculates blast radius, and routes incident notifications to the right owners automatically. No waiting for vendor self-disclosure.
Track regulatory actions, fines, and consent orders against vendors. Trigger reassessment workflows or contract review when a vendor’s regulatory standing changes materially.
During industry-wide events (a major cloud outage, a widespread CVE, a sanctions enforcement action), Radar identifies every vendor in your portfolio with exposure and routes coordinated response across owners.
Detectors, sources, and default reviewers are configured in the dashboard under Configuration → Radar. Browse the built-in source library and detector library to see what ships out of the box.

Work Radar signals

The analyst walkthrough: the Needs attention view, reading a signal, and turning it into a case, finding, or reassessment.

Configure Radar

The admin walkthrough: sources, detectors, and the tuning that keeps the queue quiet.

Detector library

Every out-of-the-box detector template, by segment, with its default severity.

Radar API

Events and alerts over REST, and how they map to what the dashboard shows.