Cognition has launched Devin Security 2.0, an AI security product that it says can investigate and help remediate vulnerabilities across large codebases. The company is also offering enterprise customers hundreds of millions of dollars in Devin credits for scans and remediation support, putting a substantial incentive behind the launch.
Cognition Watch analysis
What happened
Cognition says the upgraded product uses Claude Mythos and other frontier cyber models. Its described capabilities include mapping codebases, running parallel agent investigations, building threat models and validating findings at runtime. It can also generate pull requests and compliance documentation, according to the company.
The credits are intended to help enterprise customers scan repositories and address critical security flaws. Cognition’s launch announcement describes the offer and product features; it does not provide performance results showing how reliably the system finds or fixes vulnerabilities.
Why it matters
Security teams are being offered more than an automated code scan: the pitch is an end-to-end workflow, from understanding a codebase to proposing a fix. If it works well in practice, that could help teams tackle vulnerabilities that might otherwise sit in a queue.
The scale of the credits offer may also lower the barrier to trying the service. But a large credit pot is an invitation to test the product, not evidence that its findings are accurate or that its fixes are safe to merge. In security, “machine speed” is only a win if the human review does not become the new bottleneck.
Our read
This is a substantial product launch with a useful question attached: can an AI system make security work faster without making verification harder? Cognition’s feature list gives teams several concrete capabilities to evaluate, but the announcement supplies no benchmark or independent results. Treat the credits as a chance to run a measured trial, not a reason to hand over the keys.
What to watch
- Whether Cognition publishes benchmark results or detailed customer evaluations.
- How often Devin Security’s findings lead to confirmed vulnerabilities and accepted fixes.
- What safeguards and review steps apply to generated pull requests and remediation work.
Discussion spark: Would you let an AI security tool propose fixes directly in a codebase, or should it stop at findings and leave every change to a person?
Sources and evidence
- Introducing Devin Security (26 October 2026, 16:00 UTC)
not affiliated with or endorsed by Cognition