Cognition upgrades Devin Security to scan, triage and fix vulnerabilities

Archive entry: this covers an event from October 26, 2026, and we published it on November 8, 2026. The details come from sources dated at the time and may have changed since.

On October 26, 2026, Cognition announced a major upgrade to Devin Security, its product for scanning, triaging and fixing vulnerabilities, in a post by The Cognition Team. The company also committed “hundreds of millions of dollars” in Devin credits.

What the upgrade covers

• Threat model: a shared, evolving model built with security and engineering staff, covering systems, network policies, deployment practices and unused code.
• Deep scans: they look for multi-step attack chains in large codebases, running on Claude Mythos and other cyber-focused models, and findings are deduplicated and re-verified.
• Triage: findings from Devin's scans and third-party tools are re-scored by exploitability and potential damage, then sorted into fix immediately, schedule, or a written risk adjustment.
• Fixes: the post describes “thousands of parallel sessions,” each on its own VM, that reproduce a flaw, draft and verify a patch, and open a pull request with evidence.
• Mitigations and inputs: Devin can propose infrastructure mitigations such as a WAF rule or security group change, and humans approve relabeling, while “KEV-listed vulnerabilities are never relabeled.” Findings can come from existing scanners, bug bounty programs and advisories, and records can be exported to POA&M and GRC platforms.

What it means for teams building with AI

For enterprise teams, the upgrade pairs finding with ranking and fixing: an agent that scores vulnerabilities by exploitability and opens pull requests with evidence, rather than only listing issues. Because it can ingest findings from existing scanners, bug bounty programs and advisories, it can work on the sources a team already uses.

Availability and free scans

Cognition offered “free scans with frontier cyber models” to existing and future enterprise customers, and remediation credits to new customers. The post did not state whether the upgrade was generally available or in beta, and it listed no plan tiers or pricing.

Sources

• Devin Security: Find and fix your most dangerous vulnerabilities (Cognition, October 26, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.