As Cogent Security(opens in a new window) sees enterprises facing more security risks than ever, it has found that the hardest part is not finding vulnerabilities, but fixing them. Remediation work is complex and spans multiple teams. It requires contextual understanding of a company’s environment: how could an attacker exploit a vulnerability, which business systems are at stake, and what changes can be made safely.
Cogent builds Cyber Defense Factories for enterprises to autonomously find and eliminate those risks. The factories are designed to help defenders move at machine speed, in response to the acceleration in vulnerability discovery and exploitation.
The company’s AI agents combine GPT‑6.1 Sol and GPT‑5.6 with its enterprise context and controls to handle investigation through verified remediation. The agents assess exposures, execute permitted changes, and confirm the risk has been eliminated. Cogent also conducts internal research with Cyber and Daybreak, exploring attack paths and defensive capabilities.
“The ability of OpenAI models to sustain long-running tasks unlocks a new level of autonomy in enterprise defense: AI agents can now carry work from investigation through verified remediation.”
—Geng Sng, Co-founder and CTO, Cogent
Giving agents context and permission to act
For each customer, Cogent’s Context Engine maintains an enterprise knowledge graph of assets, vulnerabilities, identities, ownership, and dependencies. Specialized background agents continuously reconcile information across security tools and systems, giving investigation and remediation agents a shared understanding of the environment.
GPT‑6 Astra handles upfront planning and complex reasoning for that work. This enables what Geng Sng, Co-founder and CTO of Cogent, describes as a “memory harness for the enterprise.” He says, “We don’t have to relearn what the world looks like every time a new task happens.” Reusing context reduces latency, inference costs, and inconsistent results.
Cogent’s Agent Policies define each enterprise’s permitted changes and approval requirements, and its policy-enforcement engine, TRACE, checks tool calls against the policies before execution. The checks are deterministic and require no separate model inference.
An Agent Gateway independently checks authorization, and higher-risk work can run in isolated sandboxes. Customers can delegate investigation, require approval for changes, or permit bounded autonomous remediation.
From vulnerability disclosure to verified fixes
When critical security flaws known as PHP2Shell were disclosed in PHP, a programming language used to run websites, customers turned to the Cyber Defense Factories that Cogent had already deployed in their environments.
GPT‑6.1 Sol and GPT‑6 Astra provided the deep reasoning for investigation and remediation planning. Using Cogent’s context layer, agents identified affected systems, assessed exposure, and developed plans that accounted for application dependencies and operational constraints. Then they orchestrated fixes using customer-defined approval and execution workflows and verified the resolution.
Cogent reports that customers are using its Cyber Defense Factories to resolve vulnerabilities faster and expand investigation capacity. With Cogent, a Fortune 1000 automotive customer reduced its mean time to remediate critical vulnerabilities by 75%, and a Fortune 500 IT services customer achieved 5× vulnerability-triage throughput.
Trading platform MarketAxess says Cogent helps it decide which exposures to fix first: “Cogent sees our environment the way an attacker would. It traces the route from the internet to a vulnerable system and checks controls on the way. Our remediation work now focuses on the greatest risks and the paths an adversary could use to break in,” says Vijay Bala, Global CISO at MarketAxess.
Why Cogent builds with OpenAI models and Codex
Cogent continuously evaluates closed-source and open-source alternatives and reports stronger reasoning on long-running security tasks, higher fidelity, fewer hallucinations on technical codebases, and more reliable execution with OpenAI models. The models can chain tool calls sequentially and in parallel while retaining context across remediation workflows.
Cogent prioritizes reasoning quality for complex investigations and cost for more straightforward work. It uses GPT‑6.1 Sol for general execution and GPT‑5.6 for routine vulnerability-management tasks where advanced reasoning is less critical.
“OpenAI models are more cost-efficient relative to the other providers. That’s a big plus for us, especially if we’re running these huge agent swarms.”
—Geng Sng, Co-founder and CTO, Cogent
Using OpenAI models has also reduced the supporting software Cogent needs to build for remediation and patching. “A lot of the work that we had to do at the harness level is no longer required,” Geng says. He also shared that OpenAI APIs have “streamlined request routing and agent orchestration, significantly reducing internal engineering overhead and accelerating our time-to-market for complex security workflows.”
Most of Cogent’s engineers also choose Codex for development. Geng says they’re more productive pairing Codex with OpenAI models vs. using the same models in an open-source coding environment. “Codex just comes with tools that we don’t have to build ourselves,” says Geng.
Expanding autonomous cyber defense
Through Trusted Access for Cyber and Daybreak, Cogent receives technical support for its internal red-teaming and attack-path research. Daybreak Red, an access tier within Daybreak, provides the team with specialized OpenAI models for authorized offensive and vulnerability research. “Good defense requires good offense,” Geng says.
“Through Trusted Access for Cyber and Daybreak, we can explore how vulnerabilities could be chained across identities, resources, and network controls. We use that research to understand what our agents can do and which defensive capabilities to build next.”
—Geng Sng, Co-founder and CTO, Cogent
Cogent plans to expand its capabilities as the key partner for enterprises to build their own Cyber Defense Factories. Its roadmap includes increasingly autonomous remediation, broadening the range and complexity of fixes agents can execute, from straightforward configuration changes to multi-step workflows spanning different enterprise systems.
The company is also developing autonomous discovery and validation. Its goal is a closed-loop system that finds and eliminates risk while continuously learning from every vulnerability to improve future investigations and fixes.
