Cogent Builds Defense Factories with OpenAI Models

The publisher is establishing "factories" of agents capable of investigating and correcting vulnerabilities according to verified execution policies. Clients report gains in speed and capacity, while the company aims for increasingly autonomous remediation, leading to a closed-loop system.

Towards More Autonomous Remediation and Tooled Offensive Research

Cogent plans to increase the autonomy of its agents, with a roadmap that expands the range and complexity of corrections, from simple configuration changes to multi-step workflows covering multiple enterprise systems. The company is also developing autonomous discovery and validation, aiming for a closed-loop system capable of detecting and eliminating risks while learning from each vulnerability to improve future investigations and corrections. Cogent benefits from technical support through Trusted Access for Cyber and Daybreak for its internal research on penetration testing and attack paths. Daybreak Red provides the team with specialized OpenAI models for offensive research and authorized vulnerability detection. According to Geng Sng, these programs allow exploration of how vulnerabilities can chain across identities, resources, and network controls, guiding the next defensive capabilities to develop.

Reported Results from Fortune 1000 and 500 Clients

According to Cogent, its clients are using its cybersecurity defense factories to accelerate the remediation of vulnerabilities and enhance their investigative capabilities. An automotive industry player listed in the Fortune 1000 has reduced the average time required for remediating critical vulnerabilities by 75%. A client in the IT services sector ranked in the Fortune 500 has quintupled its vulnerability triage rate. The trading platform MarketAxess indicates that Cogent helps it prioritize exposures to remediate by tracing the path from the Internet to a vulnerable system and verifying existing controls. Its global CISO, Vijay Bala, specifies that remediation is now focused on the highest risks and exploitable trajectories by an adversary.

Authorization Frameworks and Controlled Execution of Agents

The modifications that agents can make are framed by Agent Policies specific to each company, which define the authorized changes and approval requirements. The TRACE application engine verifies tool calls before execution according to deterministic rules, without resorting to a separate model inference. An Agent Gateway performs independent validation of permissions, and high-risk operations can be conducted in isolated environments. Clients have the option to delegate investigation, require prior validation for changes, or allow limited autonomous remediation.

Context Architecture and Employed Models

For each client, Cogent's Context Engine maintains a knowledge graph covering assets, vulnerabilities, identities, properties, and dependencies, continuously fed by specialized agents that reconcile information from security tools and systems. GPT-6 Astra supports initial planning and complex reasoning, an approach that Geng Sng describes as a memory harness for the enterprise, allowing for reduced latency, inference costs, and inconsistencies. Cogent's AI agents combine GPT-6.1 Sol and GPT-5.6 with context and internal controls to assess exposures, apply authorized changes, and verify risk elimination. Cogent indicates a preference for reasoning quality for complex investigations and cost for simpler tasks, using GPT-6.1 Sol for general execution and GPT-5.6 for routine vulnerability management.

Choice of OpenAI and Development Tooling with Codex

Cogent states that it has evaluated various proprietary and open-source solutions and observes, with OpenAI models, a superior reasoning capability for long-duration security tasks, greater fidelity, a reduction in hallucinations on technical codebases, and execution deemed more reliable. These models allow for chaining tool calls, whether sequentially or in parallel, while maintaining context throughout remediation workflows. Geng Sng also highlights a cost advantage compared to other providers, considered important for operating large swarms of agents. According to Geng Sng, the use of OpenAI APIs has reduced the support software needed for remediation and patching, streamlined request routing and agent orchestration, decreased internal engineering load, and accelerated time-to-market for complex security workflows. Most Cogent engineers choose Codex for development, with Geng Sng estimating that they are more productive by pairing Codex with OpenAI models, as Codex integrates tools that the team does not have to build.

A Case Study: Response to PHP2Shell

During the disclosure of critical vulnerabilities PHP2Shell in PHP, clients utilized the cybersecurity defense factories already deployed by Cogent. GPT-6.1 Sol and GPT-6 Astra supported the deep reasoning necessary for investigation and remediation planning. Thanks to the context layer developed by Cogent, agents were able to identify affected systems, analyze exposure, organize planning considering application dependencies and operational constraints, coordinate corrections according to workflows defined by clients, and then verify resolution. Geng Sng emphasizes that the capability of OpenAI models to support long-duration tasks allows AI agents to carry the investigation through to verified remediation. This approach aims to enable defenders to act at machine speed in response to the acceleration of vulnerability discovery and exploitation, in line with Cogent's goal of enabling companies to autonomously identify and eliminate risks.