Cogent and OpenAI target enterprise cyber defense with AI agents
Cogent Security is building Cyber Defense Factories that use OpenAI models and enterprise context to investigate vulnerabilities, carry out permitted changes and verify that risks have been eliminated. The companies say the approach is designed to help enterprise security teams respond at machine speed as vulnerability discovery and exploitation accelerate.
- Cogent combines GPT-6.1 Sol, GPT-5.6 and GPT-6 Astra with enterprise security context.
- Cyber Defense Factories investigate exposures, execute permitted changes and verify remediation.
- TRACE checks agent tool calls against customer-defined policies before execution.
- Cogent reports a 75% remediation-time reduction for one Fortune 1000 customer.
- The company plans broader autonomous remediation, discovery and validation.
AI agents connect investigation to remediation
Cogent says the difficult part of vulnerability management is often remediation rather than finding security flaws. Fixing a vulnerability can require several teams to understand how an attacker could exploit it, which business systems are exposed and which changes can be made safely.
Its Cyber Defense Factories combine GPT-6.1 Sol and GPT-5.6 with enterprise context and controls. The agents investigate exposures, assess affected systems, execute permitted changes and confirm that the risk has been addressed. Cogent also uses GPT-6 Astra for upfront planning and complex reasoning.
“The ability of OpenAI models to sustain long-running tasks unlocks a new level of autonomy in enterprise defense: AI agents can now carry work from investigation through verified remediation,” Geng Sng, Cogent’s co-founder and CTO, said in the OpenAI announcement.
Context and permissions constrain agent actions
For each customer, Cogent’s Context Engine maintains a knowledge graph covering assets, vulnerabilities, identities, ownership and dependencies. Background agents reconcile information across security tools and systems, giving investigation and remediation agents a shared view of the enterprise environment.
Cogent’s Agent Policies specify permitted changes and approval requirements. Its TRACE policy-enforcement engine checks tool calls against those policies before execution, with deterministic checks that require no separate model inference. An Agent Gateway independently checks authorization, while higher-risk work can run in isolated sandboxes.
Customers can delegate investigation, require approval before changes or allow bounded autonomous remediation. Sng describes the context system as a “memory harness for the enterprise,” saying, “We don’t have to relearn what the world looks like every time a new task happens.”
Reported customer results and future plans
When critical PHP2Shell vulnerabilities were disclosed in PHP, Cogent says customers used already deployed Cyber Defense Factories to identify affected systems, assess exposure, account for dependencies and operational constraints, orchestrate approved fixes and verify the results.
According to Cogent, a Fortune 1000 automotive customer reduced its mean time to remediate critical vulnerabilities by 75%, while a Fortune 500 IT services customer achieved 5× vulnerability-triage throughput. MarketAxess Global CISO Vijay Bala said Cogent helps the trading platform prioritize exposures by tracing routes from the internet to vulnerable systems and checking controls along the way.
Cogent says it plans to expand autonomous remediation from straightforward configuration changes to multi-step workflows across enterprise systems. It is also developing autonomous discovery and validation, with a goal of creating a closed-loop system that finds and eliminates risk while learning from each vulnerability. Through Trusted Access for Cyber and Daybreak, the company is also conducting authorized offensive and vulnerability research with specialized OpenAI models.
