Cogent and OpenAI build cyber defense factories for enterprises

In an OpenAI case study, security startup Cogent describes what it calls Cyber Defense Factories: agents built on OpenAI models that investigate exposures, carry out permitted changes and verify that the risk is gone. Cogent says a Fortune 1000 automotive customer cut its mean time to remediate critical vulnerabilities by 75%, and a Fortune 500 IT services customer reached five times its prior triage throughput.

The shift is from AI that flags problems to AI that changes production systems. Cogent's argument is that finding vulnerabilities is no longer the bottleneck; fixing them across many teams is. If attackers are speeding up, defenders need to as well.

We're sympathetic to the core pitch. Most organizations don't lack vulnerability reports; they drown in them. The slow part is figuring out which ones an attacker can actually reach, who owns the system, and what can be changed without breaking something. A system that keeps a living map of assets, identities and dependencies and uses it to plan fixes is aimed squarely at the real pain.

What earns our cautious respect is the control layer. Cogent says each customer defines permitted changes and approval rules, a policy engine called TRACE checks tool calls against those rules deterministically before execution, a separate gateway checks authorization, and riskier work can run in isolated sandboxes. Customers can limit agents to investigation, require approval or allow bounded autonomous fixes. That's the right shape. Model judgment proposes; fixed rules decide what is allowed.

Still, an agent with permission to change production systems is a high-value target. If it's tricked, misconfigured or simply wrong, it fails at machine speed, the same speed the product is sold on. We'd want to see how Cogent handles bad fixes, rollbacks and attempts to manipulate the agents through the very systems they inspect. The case study doesn't say.

The offensive side deserves a clear-eyed note too. Through OpenAI's Trusted Access for Cyber and a tier called Daybreak Red, Cogent gets specialized models for authorized offensive and vulnerability research. The CTO's line is that good defense requires good offense. True enough, and it's also why access controls on these models matter so much.

Where this leads if it scales: remediation becomes a continuously running, mostly automated loop, which is what defenders have wanted for years. It also concentrates trust in a few agent platforms and model providers. The 75% figure is customer-reported through a vendor story; we'd like independent evidence before calling it typical.

The example Cogent highlights is its response to critical PHP flaws it calls PHP2Shell, where agents identified affected systems, planned fixes around dependencies and verified resolution. Cogent uses different OpenAI models for planning, general execution and routine tasks to balance reasoning quality and cost.