Cogent Security is deploying systems that combine OpenAI models with enterprise-specific context to automate the investigation and remediation of software vulnerabilities. The company says the primary difficulty today is not finding flaws, but safely and quickly fixing them across multiple teams and systems.
What the Cyber Defense Factory does
Cogent’s Cyber Defense Factories operate with coordinated AI agents. These agents use GPT‑6.1 Sol and GPT‑5.6 together with the customer’s environment and controls to move from investigation to verified remediation: they assess exposures, perform permitted changes, and confirm that risks have been eliminated. Cogent also undertakes internal research with Cyber and Daybreak to map attack paths and defensive capabilities.
Enterprise context and continuous reconciliation
For each customer, Cogent’s Context Engine maintains an enterprise knowledge graph containing assets, vulnerabilities, identities, ownership and dependencies. Specialized background agents continuously reconcile data across security tools and systems so investigation and remediation agents share an up-to-date understanding of the environment.
Planning, policy enforcement and execution
GPT‑6 Astra performs the upfront planning and complex reasoning that supports remediation. Cogent co-founder and CTO Geng Sng describes this as a “memory harness for the enterprise”: reusing context avoids relearning the environment for each task, which reduces latency, inference costs and inconsistent outcomes.
Cogent’s Agent Policies specify permitted changes and approval requirements for each enterprise. TRACE, the company’s policy-enforcement engine, deterministically checks agent tool calls against those policies before execution, without requiring additional model inference. An Agent Gateway conducts independent authorization checks, and higher-risk work can run in isolated sandboxes. Customers may delegate investigations, require approvals for changes, or allow bounded autonomous remediation.
Real-world use: PHP2Shell response
When serious PHP vulnerabilities known as PHP2Shell were disclosed, Cogent’s customers used already-deployed Cyber Defense Factories in their environments. GPT‑6.1 Sol and GPT‑6 Astra provided deep reasoning for investigation and remediation planning; using Cogent’s context layer, agents identified affected systems, assessed exposure, accounted for application dependencies and operational constraints, then orchestrated fixes through customer-defined approval and execution workflows and verified the resolutions.
Reported customer outcomes
Cogent reports customers are resolving vulnerabilities faster and increasing investigation capacity. A Fortune 1000 automotive customer reduced mean time to remediate critical vulnerabilities by 75%, while a Fortune 500 IT services customer achieved a fivefold increase in vulnerability-triage throughput.
Trading platform MarketAxess says Cogent helps it prioritize which exposures to fix first. Vijay Bala, Global CISO at MarketAxess, said: “Cogent sees our environment the way an attacker would. It traces the route from the internet to a vulnerable system and checks controls on the way. Our remediation work now focuses on the greatest risks and the paths an adversary could use to break in.”
Model selection, tooling and engineering impact
Cogent continuously evaluates closed-source and open-source alternatives and reports that OpenAI models deliver stronger reasoning on long-running security tasks, fewer hallucinations on technical codebases and more reliable execution. The models can chain tool calls sequentially and in parallel while retaining context across remediation workflows.
Cogent prioritizes reasoning quality for complex investigations and cost-efficiency for simpler tasks: it uses GPT‑6.1 Sol for general execution and GPT‑5.6 for routine vulnerability-management tasks.
Adopting OpenAI models has also reduced the amount of supporting software Cogent needs to build for remediation and patching. According to Geng Sng, many harness-level components they previously had to develop are no longer necessary, and OpenAI APIs have streamlined request routing and agent orchestration, lowering internal engineering overhead and accelerating time-to-market for complex security workflows.
Most Cogent engineers prefer Codex for development; Geng says they are more productive pairing Codex with OpenAI models than using the same models in an open-source coding environment because Codex provides built-in tools they would otherwise have to implement themselves.
Offensive research and future roadmap
Through Trusted Access for Cyber and Daybreak, Cogent receives technical support for internal red‑teaming and attack-path research. Daybreak Red, an access tier within Daybreak, supplies specialized OpenAI models for authorized offensive and vulnerability research. As Geng Sng put it, “Good defense requires good offense.”
Cogent intends to expand its capabilities as a partner for enterprises building their own Cyber Defense Factories. Its roadmap includes increasingly autonomous remediation and a broader range of fixes agents can execute — from simple configuration changes to multi-step workflows spanning different enterprise systems. The company is also developing autonomous discovery and validation with the goal of a closed-loop system that finds and eliminates risk while continuously learning from every vulnerability to improve future investigations and fixes.
