Cognition launches Devin Security to automate vulnerability fixes

• Devin Security 2.0 adds deep scans powered by Claude Mythos and other frontier cyber models, according to Cognition’s announcement.
• Remediation includes reproducing vulnerabilities and testing patches in cloud VMs before submitting fixes, as Cognition’s workflow thread describes.
• Cognition pledged hundreds of millions of dollars in Devin credits for enterprise scanning and remediation, detailed in the shared launch excerpt.

Enterprise teams can run Mythos scans without separate model access, and Devin will not relabel vulnerabilities in CISA’s KEV catalog. A finding stays open until its PR merges and Devin rechecks the attack path, a welcome definition of “fixed.”

The October 26 upgrade follows July’s Security Swarm, which already scanned repositories, validated exploitability, and generated remediation PRs.

Cognition describes four stages in its launch thread:

1. Build a threat model with the customer’s security and engineering teams.
2. Run deep scans using frontier cyber models.
3. Prioritize findings by exploitability and potential damage in that environment.
4. Reproduce vulnerabilities, patch them, and test fixes in parallel.

The shared threat model records services, hosts, network policies, security groups, and how code is deployed, including unused code. Teams supply context Devin cannot establish from source alone, such as deployment region, internal-only access, and the business consequences of an authorization failure.

Repository scans follow an Agentic MapReduce pipeline:

1. Map the attack surface. Identify routes, authorization boundaries, data-access patterns, and other security-relevant code against the threat model.
2. Investigate in parallel. Batch selected code into groups for independent investigations.
3. Reduce the findings. Check candidates, remove duplicates, and connect separate findings into more serious attack paths.
4. Validate at runtime. Test higher-priority findings in a sandbox against a running application.

Cognition describes the harness as model-agnostic, allowing different models to handle different investigations rather than binding the product to Mythos.

Devin’s ingestion workflow extends investigation and remediation to findings produced outside its own scans:

• Import through APIs, integrations, report files, and exports.
• Preserve original finding identifiers and source links.
• Recheck current code, deduplicate reports, and identify vulnerabilities already mitigated.
• Group findings that share a fix before launching remediation sessions.
• Sync dismissal and reopening decisions back to supported source tools.

Customers can choose frontier-model re-triage for older reports, including findings generated by weaker AI models.

Cognition’s remediation design supports four responses:

• Relabel with evidence. Document false positives, propose contextual risk adjustments, or prepare risk-acceptance records where requirements permit. Human approval is required, and the original CVSS score remains visible.
• Mitigate in infrastructure. With configured access, apply a WAF rule, change a security group, or remove public access. The underlying flaw stays open while a permanent fix is prepared.
• Patch the flaw. An independent VM session reproduces the issue, implements a fix, runs the reproduction test and existing tests, then opens a PR with supporting evidence.
• Refactor the vulnerability class. Estimate and implement broader changes, such as centralized authorization or parameterized queries, across recurring instances.

Cognition says independent VMs let Devin run thousands of sessions concurrently. Separately, a Device Hub demo showed cloud agents using real macOS machines for iPhone development and TestFlight deployment.

The security product also exports supporting records to POA&M and GRC tools, preserving the reasoning behind risk decisions.

The published performance figures come from Cognition’s July results, before the Mythos deep-scan announcement. These are cross-tool comparisons, not measurements of improvement from July to October:

• Recall, Claude Security → Devin: 68% → 72%, +4 percentage points.
• Recall, Codex Security → Devin: 48% → 72%, +24 percentage points.
• Average cost per scan, Claude Security → Devin: $131.87 → $90.23, -$41.64, or 31.6% lower.

The vendor-run evaluation covered 50 real vulnerabilities across 14 languages. Each repository was checked out at the parent of its fixing commit, and every tool ran against the same vulnerable revision without benchmark-specific tuning.

Cognition selected advisories published after the tested models’ training cutoffs and reviewed trajectories for attempts to look up CVEs. The vulnerable source itself could still predate those cutoffs.

• False positives were excluded from scoring. The July grading scheme measures whether a scan finds the single labeled vulnerability. An agent judges semantic matches to the target root cause and location; unrelated findings do not affect recall.
• Repository selection favors smaller projects. Cognition explicitly favored small-to-medium repositories over sprawling monorepos in that dataset.
• Runtime checks can be inconclusive. With runtime validation enabled, Devin tests selected findings against a running build and records what it attempted and observed, including unresolved outcomes.
• The new scanning tier has no published performance delta. Cognition supplies no updated Mythos-specific recall, precision, or patch-success results in its October release.

The credits offer provides free frontier-model scans to current and prospective enterprise customers. New customers can also receive remediation credits, with Cognition’s team working alongside them through investigation and remediation.

The announcement does not specify per-customer allocations, expiration dates, or the unit cost of a deep scan.