Agents read supplier documents and evaluate the evidence against your requirements. Your team reviews the exceptions, with the source material close at hand.
Applied AI
Coverbase is an AI system built for third-party management. Its AI harness brings together your vendor data, the context around each relationship, the information suppliers submit, and custom-built research, then synthesizes them into decisions your team can check. On TPM-Bench, Coverbase consistently scores higher than frontier AI models.
What we’re building for
Intake, monitoring, inspection, and contracts share supplier context. A new signal can inform the next assessment instead of getting lost in another system.
Apply the controls your program uses, then incorporate your reviewers' decisions into future assessments. The system works around how your team evaluates risk.
Intelligence, in motion.Coverbase Applied AI
Evidence into decisionsConceptual visualization. Select a focus area to reshape it.
How Coverbase compares to frontier models.
A frontier model can read a document. A supplier decision needs more: the vendor’s data, the context around the relationship, what the supplier submitted, research built for the question, and your controls. Coverbase’s AI harness brings those together and synthesizes them into a decision your team can check. TPM-Bench measures what that adds.
- Data and context together
- The harness brings vendor data, the context around each relationship, supplier-submitted information, and custom-built research into one place, so each answer draws on all of it.
- Evidence you can trace
- We connect a conclusion to the clause, report, or system record that supports it. You can check the source before you make the call.
- Your controls, applied
- We read a supplier's evidence against your requirements and give an answer grounded in them, not a generic one that sounds convincing.
- Authority you can audit
- Every write the agent makes is checked against who may approve what, and anything that needs attention goes to a reviewer. Violations are counted in the benchmark and never averaged away.
Coverbase consistently scores higher than frontier AI models.
TPM-Bench gives an AI agent 331 realistic third-party management cases, set inside a fictional insurer. We ran Coverbase and six frontier models on every case, under the same instructions. Coverbase scored 0.84 out of 1. The strongest model on its own, Claude Opus 5.5, scored 0.73.
TPM-Bench v2 · 331 cases · 6 frontier models
+0.11Coverbase ahead of Claude Opus 5.5, the top frontier model on its own0.84 against 0.73, 95% interval +0.07 to +0.15, n = 331
41 of 46Cases without third-party submitted info where Coverbase did better, none worseAgainst Claude Opus 5.5
+0.15Coverbase ahead on cases with third-party submitted info113 cases, 95% interval +0.08 to +0.21; against Claude Opus 5.5
92%Cases where Coverbase passed every blockerClaude Opus 5.5 on its own: 85%
Coverbase and each model got the same instructions and the same company documents. The difference is Coverbase’s AI harness. Method
Coverbase0.84Blocker pass 92%
Claude Opus 5.50.73Blocker pass 85%
Claude Opus 50.69Blocker pass 79%
Claude Sonnet 5.50.68Blocker pass 81%
Claude Haiku 5.50.55Blocker pass 68%
Claude Sonnet 50.53Blocker pass 67%
Claude Sonnet 4.60.51Blocker pass 65%
Mean score over 331 cases, from 0 to 1, for Coverbase and for each model on its own with the same instructions and company documents. Blocker pass is the share of cases where no blocker failed. Method
Data
| System | Score | 95% interval | Blocker pass |
|---|---|---|---|
| Coverbase | 0.84 | 0.81 to 0.87 | 92% |
| Claude Opus 5.5 | 0.73 | 0.69 to 0.77 | 85% |
| Claude Opus 5 | 0.69 | 0.64 to 0.73 | 79% |
| Claude Sonnet 5.5 | 0.68 | 0.64 to 0.73 | 81% |
| Claude Haiku 5.5 | 0.55 | 0.50 to 0.60 | 68% |
| Claude Sonnet 5 | 0.53 | 0.48 to 0.58 | 67% |
| Claude Sonnet 4.6 | 0.51 | 0.47 to 0.56 | 65% |
How Coverbase stacks up.
Across all 331 cases, Coverbase scores 0.84, Claude Opus 5.5 scores 0.73, and Claude Sonnet 5.5 scores 0.68. Coverbase also leads on the 46 cases without third-party submitted info and on the 113 cases with it.
Mean case score from 0 to 1. The gray bars are Claude Opus 5.5 and Claude Sonnet 5.5 on their own, with the same instructions and company documents. The last two groups split cases by whether the answer uses information submitted by the third party. Method
Data
| Cases | Coverbase | Claude Opus 5.5 | Claude Sonnet 5.5 |
|---|---|---|---|
| All cases (n = 331) | 0.84 | 0.73 | 0.68 |
| Without third-party submitted info (n = 46) | 0.81 | 0.29 | 0.26 |
| With third-party submitted info (n = 113) | 0.75 | 0.61 | 0.52 |
Scores for every model.
Score is the mean over 331 cases with a 95% bootstrap interval. Cost is model API spend per case.
Scores by suite.
Mean score per suite, Coverbase and Claude Opus 5.5 on its own, ordered by the gap. Darker is higher. Method
Data
| Suite | n | Coverbase | Claude Opus 5.5 | Gap |
|---|---|---|---|---|
| REPORT | 11 | 0.93 | 0.45 | +0.47 |
| DRES | 9 | 0.90 | 0.56 | +0.34 |
| FORECAST | 8 | 0.90 | 0.57 | +0.34 |
| PORTFOLIO | 17 | 0.75 | 0.44 | +0.31 |
| DCOMP | 17 | 0.89 | 0.60 | +0.29 |
| MONITOR | 16 | 0.79 | 0.51 | +0.28 |
| DAI | 9 | 0.93 | 0.73 | +0.20 |
| MASTER | 10 | 0.85 | 0.67 | +0.18 |
| ASSESS | 13 | 0.84 | 0.68 | +0.15 |
| QUANT | 9 | 0.97 | 0.82 | +0.15 |
| INTAKE | 11 | 0.90 | 0.77 | +0.13 |
| INCIDENT | 11 | 0.76 | 0.67 | +0.09 |
| DSEC | 14 | 0.93 | 0.85 | +0.08 |
| RELATE | 8 | 0.89 | 0.81 | +0.08 |
| GOVERN | 10 | 0.91 | 0.85 | +0.06 |
| HANDOFF | 11 | 0.86 | 0.81 | +0.05 |
| SOURCE | 7 | 0.97 | 0.92 | +0.04 |
| REVIEW | 11 | 0.82 | 0.79 | +0.02 |
| CONTRACT | 20 | 0.68 | 0.66 | +0.02 |
| CHANGE | 8 | 0.94 | 0.92 | +0.02 |
| COMMS | 6 | 0.93 | 0.93 | 0.00 |
| ONBOARD | 8 | 0.91 | 0.91 | 0.00 |
| PERF | 9 | 0.74 | 0.74 | 0.00 |
Coverbase is ahead on most suites. It leads by the widest margin on suites that ask what the program knows: REPORT (0.93 against 0.45), DRES (0.90 against 0.56), FORECAST (0.90 against 0.57), PORTFOLIO (0.75 against 0.44), DCOMP (0.89 against 0.60), and MONITOR (0.79 against 0.51).
What each suite coversExample benchmark test cases
A new sole shareholder and an overnight sanctions hit on a translator whose founder is still the contact.
- Coverbase
- 1.00
- Claude Opus 5.5
- 0.00
A bank-detail change request that checks out on every point except its source.
- Coverbase
- 0.96
- Claude Opus 5.5
- 0.93
Where one model is shown on its own, it is Claude Opus 5.5.
- The lead comes from data and context.
- The 46 cases without third-party submitted info need a renewal date, a finding's owner, a sanctions change, a board risk-appetite statement, or a fourth-party concentration entry. Coverbase's harness holds those facts, keeps them current, and gives them to the agent with the authority rules attached. A harness built in-house has to do the same. The prompt is the small part.
- Coverbase scores higher than every frontier model in TPM-Bench.
- Coverbase scores 0.84. On their own, Claude Opus 5.5 scores 0.73, Claude Opus 5 scores 0.69, Claude Sonnet 5.5 scores 0.68, Claude Haiku 5.5 scores 0.55, Claude Sonnet 5 scores 0.53, and Claude Sonnet 4.6 scores 0.51. Coverbase passes every blocker on 92% of cases, against 85% for the strongest model.
- The harness is Coverbase's own.
- Coverbase's AI harness gives the agent your vendor data, the context around each relationship, the information suppliers submit, and research built for the question, then synthesizes them into a decision your team can check. A model on its own starts from the documents in front of it.
- Coverbase includes the benchmark.
- 331 cases, 32 suites, a blocker gate, typed grading, an action-trace grader, and an owner per suite. A team that builds its own harness also has to build the thing that tells it whether the harness works.What is in TPM-Bench
Benchmark grading methodology
Method
- 01
Coverbase and each model on its own run every case with the same instructions and documents.
- 02
A case scores 0 if any blocker fails: the decision, forbidden claims or forbidden actions. Otherwise it scores the weighted mean of its quality criteria.
- 03
Code compares typed values: dates, percents, counts, sets, enums, and probabilities. Probabilities get a Brier score against a hidden outcome.
- 04
The action trace is graded for required and forbidden actions, authority limits, the irreversible budget, and segregation of duties. Violations are counted, not averaged.
- 05
One judge model grades prose criteria with one rubric for every system. A missing verdict fails in the unsafe direction.
- 06
Intervals are 95% bootstrap intervals over cases. Lift is paired, with a sign test. A win or loss is a move of more than 0.05.
01
Detect the change
MONITOR, INCIDENT
02
Find the relationship
MASTER, RELATE
03
Judge materiality
PORTFOLIO, QUANT, DCOMP, DRES, ASSESS
04
Propose the next step
HANDOFF, GOVERN, COMMS
05
Measure the work
The action-trace grader
Research we have published.
Reports and analysis on vendor dependencies, evidence, and the incidents that change a third-party decision.
Benchmark
TPM-Bench v2: how Coverbase compares to frontier models
Coverbase against six frontier models on 331 third-party management cases.
Read about TPM-BenchResearch Report
Twelve weeks: from acquisition to attack
Two threat actors, two vulnerability classes, one target: what the Abbott incidents reveal about the security gap between acquired and integrated systems.
Read the researchResearch Report
The platform beneath your vendors
One poisoned VS Code extension, one GitHub employee laptop, and 3,800 internal repositories listed for sale. This report reconstructs the TeamPCP breach chain and shows why nth-party exposure now lives below the vendor surface.
Read the researchArticle
What the Delve allegations show about SOC 2 audits
The Delve allegations expose SOC 2 audit problems: reports treated as proof instead of evidence, with 494 filings examined and 493 nearly identical.
Read the researchArticle
NIST SP 800-18 Revision 2: what you need to know
NIST SP 800-18 Revision 2 adds a system-level C-SCRM plan with supplier inventories and continuous monitoring. See what TPRM teams should do next.
Read the researchMonthly briefings
Third-party incidents that matter
Each month we pick the three or four third-party incidents that matter across security, privacy, compliance, and risk.
Read the briefingsProblems we’re working on.
When documents disagree
A SOC 2 and a security questionnaire can describe the same control differently. We are working on how to surface the disagreement with both sources attached, rather than smoothing it away.
When to ask a person
A missing detail should not become a confident answer. We want the agent to show what it knows, explain what is missing, and hand the question to a reviewer.
When the vendor changes
A vendor record can outlive the facts that went into it. We are working on how to refresh what matters while preserving the evidence and decisions that came before.
When a change matters
A new SOC 2 may contain a changed date or a material exception. The work is telling those apart against your controls and the service you use.
When evidence contains instructions
A supplier document is evidence, not an instruction to our agents. We are testing how to keep that boundary intact while the agent reads the document.
Test Coverbase on your own cases.
Bring a vendor, a document, and the question your team would ask. We run it through Coverbase and a frontier model on its own, and show you each step.