Cognition upgrades Devin Security with Claude Mythos deep scans and big credit pledge

Deep scans and a living threat model

According to Cognition, Devin Security now offers deep scans designed to uncover complex chained exploits across large codebases. The scans are powered by Claude Mythos and other frontier cyber models. Enterprise security teams can use them through Devin without needing separate access to the models.

The scans are guided by a threat model that Devin builds together with a customer's security and engineering teams. Cognition describes it as a shared, living document that maps systems, services and hosts, how they communicate, and the network policies and security groups that protect them. It also records how code is deployed and which code is unused.

Teams add context that Devin cannot establish from code alone, such as which region a service runs in or whether it is internal-only. Devin also asks about business impact, for example what would happen if one user could read another's data, gain administrator access, or use the product without paying. The model is refined as systems change.

Cognition says Devin Security is model-neutral. The company is building one managed product that can use the best cyber-capable models across labs and pick the most suitable ones as models improve.

Prioritizing findings and choosing the right fix

Cognition argues that security teams already have more findings than they can fix, and that many tools assign severity ratings without understanding the codebase, its deployment or existing defenses. Such ratings can overstate some risks and understate others, yet still trigger compliance or policy deadlines.

Devin ingests findings from its own scans and, via API and integrations, from existing scanners, bug bounties and advisories. It removes duplicates and re-verifies findings with frontier models. It then re-scores them against the threat model based on exploitability and potential damage in the customer's environment, showing which flaws need fixing now, which can be scheduled, and which warrant a documented risk adjustment.

According to the company, resolving a finding does not always require a pull request. Devin supports four responses:

• Relabel with evidence. Devin documents false positives or proposes risk adjustments based on reachability, access controls and other mitigating factors, and can prepare risk-acceptance records. Each proposal requires human approval, the original CVSS score stays alongside any adjustment, and KEV-listed vulnerabilities are never relabeled.
• Mitigate in infrastructure. With configured access, Devin can apply a WAF rule, change a security group or remove public access to a service. These steps reduce exposure while a permanent fix is prepared, but the underlying flaw stays open.
• Fix the flaw. Devin can run thousands of parallel sessions in independent virtual machines, each reproducing a vulnerability, writing a fix, running the reproduction test and existing tests, and opening a PR with evidence.
• Refactor out the vulnerability class. For recurring flaws, Devin can estimate and help implement a broader change, such as centralizing authorization checks or parameterizing queries across the application.

Results sync back to existing security tools, and supporting records can be exported to POA&M and GRC tools.

Cloud agents and the credits commitment

Cognition says the product rests on Devin's cloud-native design. For more than two years, Devin has carried out large-scale engineering work in parallel, with each session running in its own virtual machine to reproduce a problem, make changes and test the result independently. The company says this lets it run thousands of scans and fixes at once, and validate fixes on real VMs running real services.

Alongside the product, Cognition is committing hundreds of millions of dollars in Devin credits. Current and future enterprise customers can receive free scans with frontier cyber models to find complex vulnerabilities. New customers can also get remediation credits to help fix their most critical flaws before attackers can exploit them. Cognition says its team will work alongside customers through investigation and remediation.

What it means for security teams

Cognition frames the launch as a response to attackers using AI to carry out sophisticated attacks more easily, leaving defenders less time to respond. For enterprise security teams, the offer is access to frontier cyber models without a separate arrangement, plus a way to separate urgent risks from noisy findings and spend limited engineering capacity on the flaws that matter.

The source gives no pricing or details on credit eligibility. Interested enterprises are asked to contact Cognition's team to get started with Devin Security and the credits.