OpenAI and Cogent sell a Cyber Defense Factory for enterprises: Reveneau

Why it mattersThe backlog of unpatched flaws is where most breaches start. A working factory of agents would reach deeper into a company than any single tool a security team runs today.

Cogent Security and OpenAI said on Monday that they are selling a new product to large companies: a team of agents that chases down software flaws, writes patches, tests them and asks a person to approve. Cogent calls it a Cyber Defense Factory.

What the two companies actually say

Each Factory runs on OpenAI's newest models. Cogent names them as GPT-6.1 Sol, GPT-5.6 and GPT-6 Astra. Cogent wraps them in its own Context Engine. That engine holds the customer's software and policies. A separate policy enforcement layer called TRACE sits beside it.

Cogent says a Fortune 1000 automotive customer cut its mean time to remediate critical vulnerabilities by 75 percent. A Fortune 500 IT services customer, it says, triaged five times as many vulnerabilities as before. Cogent does not name either customer. OpenAI does not state a number of its own.

A policy chooses what the agents do next. A security team can tell the Factory to flag and stop. It can let the Factory patch with approval. Or it can let the Factory act on its own, with risky work held in a sandbox.

Why this matters now

The hard problem in corporate security is not detection. A large company already buys a scanner that reports many thousands of flaws a month. The hard problem is the queue of fixes behind them. A patch has to be written. It has to pass the company's test suite. It has to roll out without breaking a production system.

An agent that writes and tests a patch end to end pushes work through that queue without hiring. That is the point OpenAI made at DevDay in September, when it showed an internal tool called Codex Security Cloud. Codex Security Cloud was OpenAI's own factory, running inside OpenAI. Cogent is the first outside customer to run the same idea as a product.

What the announcement does not say

Neither company names a price. Neither company names a date at which the service is generally available. Neither company gives the sample size behind its two numbers. One customer each is not a sample.

Fortune 500 security teams already have expensive scanners. A Factory sits on top of them. A buyer should ask how the agents and the existing tools divide the work. They should also ask what happens when both demand the same engineer's time. Cogent's own blog noted that the mean time to exploit a public flaw is already measured in negative days. A patch that takes one hour instead of one week still arrives after the first exploit.

Source

This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.