On July 1, 2026, Cognition released Devin Security Swarm, handing the engineering muscle of its AI software engineer directly to security teams: automatically find vulnerabilities across an entire codebase, validate in an isolated sandbox whether they are genuinely exploitable, then open remediation pull requests for human review. The official positioning is blunt — this is not another scanner, but an agent product that lets security teams ship fixes themselves. It lands in the same week as Devin Fusion, Cognition’s push to cut the cost of frontier performance by 60%, extending the same cost war into vulnerability remediation.
The Root Problem in the Age of Scanner Overload
Cognition’s read of the market pain is unusually direct: some teams are seeing “10–100x more security findings,” and many are false positives. The weakness of existing scanners and general-purpose AI tools is that they cannot reason about business logic, chained attacks, or whole codebases — exactly where the most dangerous vulnerabilities live. Rules and pattern matching only manufacture more alerts that need manual triage, leaving security teams busier than before. Devin Security Swarm bets on closing that cross-file reasoning gap, and on replacing the output itself: not a long queue of alerts to classify, but a list of confirmed-exploitable vulnerabilities.
How the Swarm Works: Find, Validate, Patch
Under the hood, a swarm of parallel agents investigates segments of the codebase and reasons across files. Devin then combines individual findings into complete attack paths and reproduces each one in a sandbox to confirm it is actually exploitable. What the security team receives is a verified vulnerability with its attack path and reproduction steps attached; the agent then writes the patch and opens a remediation PR for human review and merge. The pipeline collapses three steps that traditionally sit with different teams — find, confirm, fix — into a single workflow, which is the essential difference from tools that report but never act.
How to Read the Benchmark Numbers
Cognition evaluated against 50 real-world vulnerabilities tied to published GitHub Security Advisories, across more than 14 languages. Devin Security recalled 72% at $90.23 per run; Claude Security recalled 68% at $131.87; Codex Security 48% at $118.20; Cursor Security 26% at $4.60. The more telling side is what was missed: only Devin found three critical vulnerabilities every other tool overlooked — a PHP template-injection sandbox bypass, an argument injection in metadata parsing, and an overly broad Spring Kafka deserialization surface. On that basis Cognition claims more verified vulnerabilities at 30% lower cost than the nearest comparable alternative. Vendor-run benchmarks deserve skepticism, but publishing recall and cost per run on a shared baseline is roughly the transparency this category needs.
Scan Profiles and the Enterprise Remediation Program
Adoption cost is kept deliberately low. Scan profiles can be generated from existing threat-model documents, with no per-repository configuration and no CI changes required; scans run daily, weekly, or on custom schedules, and later scans process only changed code so cost falls over time. The product is available starting now, and several major companies already run it for regular scans. For enterprises with deep backlogs, Cognition separately announced a six-week Security Vulnerability Remediation Program on July 2: forward-deployed engineers work alongside the customer team, using Devin to burn down existing CVE backlogs first, then standing up ongoing discovery and remediation. The program integrates with existing scanners such as Snyk, SonarQube, and Semgrep, so new and old tooling coexist rather than replace each other.
What It Means for Engineering and Security Teams
First, security remediation now runs on an “agent proposes, human approves” cadence — review and merge authority stays with engineers, the design choice that makes such tools organizationally acceptable. Second, verified exploitability becomes the new differentiator: false positives burn engineering time while misses carry real risk, and sandbox reproduction presses down on both, giving security reports an engineer-grade “reproducible” standard for the first time. Third, the pricing unit of this category is now cost per run multiplied by recall; when evaluating rival tools, teams can simply demand numbers on the same baseline instead of adjectives. As finding volumes grow at 10x speed, the default split for the coming year is clear — hand triage and first drafts to agents, keep judgment with people.
Sources
- Introducing Devin Security Swarm — Cognition
- Devin Security Vulnerability Remediation Program — Cognition
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.