Cognition adds deeper AI vulnerability scans and repair credits to Devin Security

Cognition upgraded Devin Security on October 26, adding deep vulnerability scans powered by Claude Mythos and other frontier cyber models. Enterprise customers can use those models through Devin without separate access. The release pairs scans with environment-specific risk assessments and repair workflows, alongside a pledge of hundreds of millions of dollars in Devin credits.

The new deep scans are designed to investigate complex attacks that chain weaknesses across large codebases. Cognition says a customer-specific threat model guides that investigation. The company describes Devin Security as model-neutral: it can select models from different labs rather than tie the managed product to a single provider.

This is an upgrade, not Devin’s first security release. Cognition’s July 1 Security Swarm announcement already described scans shaped by threat-model documents, runtime checks in isolated environments and proposed code repairs. The October announcement adds the new deep scans and details a broader workflow for assessing and responding to findings.

A risk map built with the customer

The threat model is a shared, evolving document built with security and engineering teams. It maps systems, services and hosts, their connections, and the network policies protecting them. It also records how code is deployed and which code is unused. Customers supply context Devin cannot establish from code alone, such as a service’s region or whether it is internal-only.

Business consequences enter the assessment, too. Devin asks what would happen if someone could read another user’s data, gain administrator rights or avoid paying. Cognition says those answers help it re-score findings by exploitability and potential damage in that particular environment, separating urgent repairs from work that can wait.

The workflow is not limited to Devin’s discoveries. It can import findings through APIs and integrations from existing scanners, bug bounties and advisories, remove duplicates, and use frontier models to check them again. Those findings are then assessed against the same threat model.

A response does not always mean a patch

Cognition describes several responses once Devin has assessed a finding. The choice depends on the evidence, the customer’s requirements and the access configured for the agent:

• Document a different risk assessment. Where requirements permit, Devin can assemble evidence that a finding is a false positive or warrants an adjustment because of access controls, reachability or other protections. It can also prepare records documenting acceptance of a risk.
• Reduce exposure temporarily. With configured access, Devin can apply a web application firewall rule, change a security group or remove a service’s public access. The underlying flaw remains open while a permanent repair is prepared.
• Repair the code. Cognition says Devin can run thousands of parallel sessions in independent virtual machines. Each can reproduce a vulnerability, write a fix, run the reproduction test and existing tests, then open a pull request—a proposed code change—with supporting evidence.

For recurring problems, Devin can also estimate and help implement broader code changes, such as centralizing authorization checks. Results sync back to existing security tools, and supporting records can be exported to compliance and risk-management tools.

Free scans, with repair credits for new customers

The credit commitment accompanies the product upgrade. Cognition is offering free frontier-model scans to current and future enterprise customers; new customers can also receive remediation credits for their most critical flaws. The company says its team will work alongside customers during investigation and repair. Enterprises interested in the product or credits are directed to contact Cognition’s team.