Devin Security Gets Deep Scans: What Cognition's Update Offers Security Teams
Cognition's Devin Security adds deep scans, a living threat model and finding intake. See what is new, what is free, and what remains unclear.
Devin Security, the vulnerability-management product from Cognition, got a significant update on 26 October 2026. It now offers deep scans for chained exploits, a threat model that ranks findings, and tools to take in results from other scanners. For security and engineering leads buried in alerts, the pitch is simple: fewer duplicate findings and faster fixes. Here is what the announcement actually says, and what it leaves out.
What is new
Based on Cognition's announcement:
- Deep scans. These look for complex, chained exploits across large codebases, using what Cognition calls Claude Mythos and other frontier cyber models. A chained exploit combines several small flaws, like using a series of unlocked doors rather than breaking down one.
- A living threat model. Built with your security and engineering teams, it maps systems, network policies and business impact. Devin uses it to rank findings by how exploitable they are and how much damage they could do, instead of by raw severity score alone.
- Findings intake. Results from existing scanners, bug bounties and advisories come in through APIs and integrations. Devin removes duplicates and re-verifies them.
- Several ways to remediate. It can relabel false positives or propose risk adjustments (human approval required, the original CVSS score stays visible, and the page says KEV-listed vulnerabilities are never relabelled). It can suggest infrastructure mitigations such as firewall rules, which reduce exposure without fixing the flaw. It can also open fixes in parallel sessions, each producing a pull request with test evidence, or propose broader refactors for a whole class of bugs.
- Integrations. Results sync to existing security tools and can be exported to POA&M and GRC records. Cognition describes the product as model-neutral.
Cost and access
Cognition says it is committing "hundreds of millions of dollars" in Devin credits. Current and future enterprise customers get free scans with frontier cyber models, and new customers can also receive remediation credits. Access goes through a contact form. The page gives no per-unit prices, credit amounts per customer, usage quotas or supported regions, so the real cost of scale is unknown.
Questions to ask before you adopt
- Accuracy. A separate AI newsletter noted that no independent accuracy comparison was provided. Ask for false-positive and false-negative rates on codebases like yours.
- Human approval. Risk relabelling needs sign-off, which is sensible. Check who in your team owns that sign-off.
- Temporary mitigations. Firewall changes lower exposure but do not remove the underlying bug, so track them as open items.
- Data handling. Deep scans read your source code. Review where it runs, what is retained and what the contract says.
- Free credits. Free scanning is attractive, but plan for what happens when credits end.
Why the timing matters
Frontier AI labs are now publicly claiming that models can chain vulnerabilities. Security vendors are racing to put similar capability in defenders' hands. Expect more offers like this one, and compare them on evidence, not announcements.
A sensible pilot plan
Start with one service that has a known backlog of findings and a clear owner. Feed in your existing scanner results and let the tool deduplicate and rank them. Compare its ranking with your team's own view of what matters, and note every case where it disagreed. Check that each proposed fix comes with test evidence you can reproduce, and that your normal code review still applies to the pull requests it opens. After a month, count time saved, fixes merged and any incorrect relabelling. That gives you evidence of your own, which matters more than any vendor claim.
Key takeaways
- Devin Security now offers deep scans, a threat-model-based ranking and intake from other scanners, with human approval for risk changes.
- Cognition promises free scans and remediation credits for enterprises, but publishes no pricing details or independent accuracy data.
- Pilot it on a bounded codebase and measure results before relying on it.
Sources
- [Cognition: Devin Security](https://cognition.com/blog/devin-security)
- [Sam on AI: AI Brief, October 27, 2026](https://samonai.substack.com/p/ai-brief-october-27-2026)
Tags: Devin Security Cognition AI security tools vulnerability management product update