Cogent and OpenAI Build Cyber Defense Factories for Enterprises
Cogent Security has built enterprise “Cyber Defense Factories” that use OpenAI models — GPT‑6.1 Sol, GPT‑5.6, and GPT‑6 Astra — to investigate vulnerabilities, plan remediation, execute permitted changes, and verify that risk has been eliminated. The announcement matters because it shows AI agents moving beyond vulnerability discovery into governed, long-running remediation work inside enterprise environments, with Cogent reporting a 75% reduction in mean time to remediate critical vulnerabilities for a Fortune 1000 automotive customer.
The core problem: finding vulnerabilities is not the bottleneck
Cogent’s central claim is that enterprises face more security risks than ever, but the hardest part is not finding vulnerabilities — it is fixing them. Remediation is complex and spans multiple teams. It requires contextual understanding of a company’s environment: how an attacker could exploit a vulnerability, which business systems are at stake, and what changes can be made safely.
Cogent builds Cyber Defense Factories for enterprises to autonomously find and eliminate those risks. The factories are designed to help defenders move at machine speed in response to the acceleration in vulnerability discovery and exploitation.
Cogent’s AI agents combine GPT‑6.1 Sol and GPT‑5.6 with its enterprise context and controls to handle investigation through verified remediation. The agents assess exposures, execute permitted changes, and confirm the risk has been eliminated. Cogent also conducts internal research with Cyber and Daybreak, exploring attack paths and defensive capabilities.
“The ability of OpenAI models to sustain long-running tasks unlocks a new level of autonomy in enterprise defense: AI agents can now carry work from investigation through verified remediation.”
—Geng Sng, Co-founder and CTO, Cogent
Giving agents context and permission to act
Cogent’s Context Engine maintains an enterprise knowledge graph of assets, vulnerabilities, identities, ownership, and dependencies for each customer. Specialized background agents continuously reconcile information across security tools and systems, giving investigation and remediation agents a shared understanding of the environment.
GPT‑6 Astra handles upfront planning and complex reasoning for that work. Geng Sng describes the result as a “memory harness for the enterprise.” He says, “We don’t have to relearn what the world looks like every time a new task happens.” Reusing context reduces latency, inference costs, and inconsistent results.
Cogent’s Agent Policies define each enterprise’s permitted changes and approval requirements. Its policy-enforcement engine, TRACE, checks tool calls against those policies before execution. The checks are deterministic and require no separate model inference.
An Agent Gateway independently checks authorization, and higher-risk work can run in isolated sandboxes. Customers can delegate investigation, require approval for changes, or permit bounded autonomous remediation.
From vulnerability disclosure to verified fixes
When critical security flaws known as PHP2Shell were disclosed in PHP, a programming language used to run websites, customers turned to the Cyber Defense Factories that Cogent had already deployed in their environments.
GPT‑6.1 Sol and GPT‑6 Astra provided the deep reasoning for investigation and remediation planning. Using Cogent’s context layer, agents identified affected systems, assessed exposure, and developed plans that accounted for application dependencies and operational constraints. The agents then orchestrated fixes using customer-defined approval and execution workflows and verified the resolution.
Cogent reports that customers are using its Cyber Defense Factories to resolve vulnerabilities faster and expand investigation capacity. According to Cogent, a Fortune 1000 automotive customer reduced its mean time to remediate critical vulnerabilities by 75%, and a Fortune 500 IT services customer achieved 5× vulnerability-triage throughput.
Trading platform MarketAxess says Cogent helps it decide which exposures to fix first.
“Cogent sees our environment the way an attacker would. It traces the route from the internet to a vulnerable system and checks controls on the way. Our remediation work now focuses on the greatest risks and the paths an adversary could use to break in.”
—Vijay Bala, Global CISO at MarketAxess
Why Cogent builds with OpenAI models and Codex
Cogent continuously evaluates closed-source and open-source alternatives. It reports stronger reasoning on long-running security tasks, higher fidelity, fewer hallucinations on technical codebases, and more reliable execution with OpenAI models. The models can chain tool calls sequentially and in parallel while retaining context across remediation workflows.
Cogent prioritizes reasoning quality for complex investigations and cost for more straightforward work. It uses GPT‑6.1 Sol for general execution and GPT‑5.6 for routine vulnerability-management tasks where advanced reasoning is less critical.
“OpenAI models are more cost-efficient relative to the other providers. That’s a big plus for us, especially if we’re running these huge agent swarms.”
—Geng Sng, Co-founder and CTO, Cogent
Using OpenAI models has also reduced the supporting software Cogent needs to build for remediation and patching. “A lot of the work that we had to do at the harness level is no longer required,” Geng says. He also shared that OpenAI APIs have “streamlined request routing and agent orchestration, significantly reducing internal engineering overhead and accelerating our time-to-market for complex security workflows.”
Most of Cogent’s engineers also choose Codex for development. Geng says they are more productive pairing Codex with OpenAI models than using the same models in an open-source coding environment. “Codex just comes with tools that we don’t have to build ourselves,” he says.
Expanding autonomous cyber defense
Through Trusted Access for Cyber and Daybreak, Cogent receives technical support for its internal red-teaming and attack-path research. Daybreak Red, an access tier within Daybreak, provides the team with specialized OpenAI models for authorized offensive and vulnerability research.
“Good defense requires good offense.”
—Geng Sng, Co-founder and CTO, Cogent
“Through Trusted Access for Cyber and Daybreak, we can explore how vulnerabilities could be chained across identities, resources, and network controls. We use that research to understand what our agents can do and which defensive capabilities to build next.”
—Geng Sng, Co-founder and CTO, Cogent
Cogent plans to expand its capabilities as the key partner for enterprises to build their own Cyber Defense Factories. Its roadmap includes increasingly autonomous remediation and broadening the range and complexity of fixes agents can execute, from straightforward configuration changes to multi-step workflows spanning different enterprise systems.
The company is also developing autonomous discovery and validation. Its goal is a closed-loop system that finds and eliminates risk while continuously learning from every vulnerability to improve future investigations and fixes.