First scan in week one.
Devin scans every repository with frontier cyber models. We tune scan profiles to your stack and triage the first results with you.
Devin Security, set up and running on your repos.
We connect Devin Security 2.0 to your code, build the threat model with your team, and turn critical findings into reviewed pull requests.
Why now
AI made exploits cheaper to build. The October Node.js and PHP disclosures went from advisory to working exploit in hours. Finding bugs is easy now. Fixing the right ones first is the work.
What we deliver
A threat model your auditors can read.
We map your services, trust boundaries and data flows with your team, so every finding gets a priority based on your environment. Original CVSS scores are kept next to Devin's contextual priority and its evidence.
Findings fixed as pull requests.
Devin reproduces each issue in its own sandbox, writes a targeted fix, runs your tests and opens a PR. Your engineers review and merge.
Bring your existing backlog
Import findings from Snyk, Wiz, bug bounty reports or a CSV. Devin re-checks each one against current code, removes duplicates, flags what is already mitigated, and documents why. Relabeled findings go to a human for approval and export to your POA&M or GRC system.
We run it on our own stack
- 5 production repos deep-scanned for PHP2Shell exposure.
- Node.js RCE patched across our services within 2 days of the October 21 release.
- Every fix shipped as a reviewed pull request.
How an engagement runs
- Week 1: Connect repos, first frontier scan, triage call.
- Week 2: Threat model workshop, backlog import, first remediation PRs.
- Week 3: Scheduled scans on new commits, Slack alerts, handoff runbook.
Model: fixed-scope setup, then optional monthly remediation support.
FAQ
Do we need separate access to frontier cyber models?
No. Devin Security runs managed scans with them for enterprise customers.
Does Devin merge code on its own?
No. Every fix is a pull request your team reviews.
Can this support FedRAMP or PCI DSS evidence?
Devin writes the reasoning behind each priority change (reachability, authentication, data, trust boundaries) and keeps the original score. A human approves before export. Devin does not relabel findings in CISA's KEV catalog.
Are there credits?
Cognition is offering enterprise customers free frontier-model scans and remediation credits for new customers. We can help you apply.