MFA settings in view
Compare available enforcement settings with the answer in the supplier assessment.
ReportThe 2026 State of TPRMThe 2026 State of TPRM: where programs break and what risk leaders want insteadDownload
Inspect supplier security firsthand.
A vendor says MFA is enforced, but the connected application shows an account without it. We compare available settings, access and exposure with your controls and send the exception to review.
CoverbaseApplication inspection
Application inspection
Go beyond the questionnaire.
Application access
Current settings
Security controls
Agent work
01Inspect access
02Identify drift
03Link the finding
Configuration in context
A reviewer can confirm what changed.
Check the setting, not only the answer.
Inspect checks MFA, access sprawl, public exposure, and connected apps. Your reviewer sees the observed setting and the risk it creates.
- 01
Agree on access
We connect with read-only access to the application in scope, using your SSO provider, OAuth, or a read-only credential from your password vault. We show your team what can be checked.
- 02
Inspect security settings
We check available MFA configuration, permissions, public exposure, and connected applications.
- 03
Bring the exception to review
We record observed gaps beside the vendor profile and the control your team uses to evaluate them.
- 04
Return after a change
We repeat appropriate checks when access or configuration changes so the review does not end with the first inspection.
A checkbox is not a configuration.
An MFA answer tells you what the vendor intended. A read-only inspection of available settings tells you what the connected application shows, and gives a reviewer something concrete to investigate.
Go from a setting to supplier risk.
Coverbase Inspect captures the evidence; Fourth-Party Monitoring adds provider and software dependencies.
The application check has a source and an owner.
Access sprawl surfaced
Look for permissions and connected accounts that exceed what the role requires.
Public exposure examined
Bring exposed settings into the vendor risk review with the observed evidence.
Read-only inspection
Inspect with read-only access, without changing the vendor's configuration.
How do application checks work?
What the read-only connection can show.
Does this replace a questionnaire?
No. We add observed application evidence. Your questionnaire still covers controls we cannot check directly.
What access do you need?
Read-only access to the application in scope, through your SSO provider, OAuth, or a read-only credential from your password vault. We agree on the checks with you.
Who decides whether a setting matters?
Your risk team compares the observation with its controls and decides how to respond.
Can you check settings behind a login?
Yes, when read-only access to the application is in place. Settings we cannot reach stay in the questionnaire.
See what a read-only inspection can reveal.
See what Coverbase can take on, starting with one supplier or one open question.