Cognition CISO: Alex Stamos

What the company sells

Cognition sells Devin, an agent that plans, writes, tests and ships production code on its own, working inside a customer's codebase and the tools its team already uses. Cognition builds tools for software creation, stating that software shapes nearly every aspect of modern life. Cognition describes engineers operating more like architects, strategizing, designing systems and focusing on problem solving, while agents handle the repetitive engineering work. Cognition's services generate or return code, suggestions, completions, responses, results and actions based on the input that customers and their authorized users provide. Cognition's platform terms govern use of the Cognition Platform and other software offerings. FrontierCode is a Cognition benchmark that measures whether a model writes code that a maintainer would actually merge. FrontierCode combines custom rubrics, verifiers and tests to check for correctness, test quality, scope discipline, style and adherence to codebase standards.

Devin Security Swarm is a Cognition offering to find, validate and remediate code vulnerabilities autonomously. Security Swarm is powered by an approach Cognition calls Agentic MapReduce, and Security Swarm reasons across an entire codebase. Devin validates that vulnerabilities are exploitable at runtime and ships remediation PRs. Devin Security Swarm runs parallel agents that reason across an entire codebase, tracing data flows, validating what is exploitable at runtime and shipping reviewed remediation PRs. Devin works end to end, from a clearinghouse advisory to a shipped, reviewed fix.

The White House's Gold Eagle Initiative and CISA's BOD 26-04 have turned vulnerability remediation into a binding order to find, prove and fix vulnerabilities on a 72-hour clock. Cognition states that federal agencies must now close a backlog that scanners and manual triage were never built to address. Cognition has a federal team.

Cognition applies a regional availability policy to the Devin Security features that use cyber-capable models or third-party models restricted by region. The regional policy for Devin Security does not apply to Devin Security as a whole, and other Devin features are not affected by it. The providers of those models make them available only in certain countries and regions, and Cognition applies the same list to the Devin Security features that use them. For the region-restricted Devin Security features, territories and dependencies of a listed country are supported, for example Puerto Rico as a territory of the United States. The region-restricted Devin Security features are available to enterprise customers only, and availability is confirmed as part of contracting. Cognition may block access to the region-restricted Devin Security features when end users of qualifying customers attempt to reach them from unsupported regions. All use of Cognition products and services remains subject to the Acceptable Use Policy, the applicable terms of service and applicable export control and sanctions laws.

Cognition's services are delivered as a software-as-a-service offering. For certain services, the data plane can be deployed either in the customer's own cloud service provider account or in an account controlled by Cognition. A Master Services Agreement, together with any applicable Order Form, governs the relationship between Cognition AI, Inc. and the customer. Some customers may have licensed Cognition's services from Exafunction, Inc., unless they have received notice that the license was assigned to Cognition AI, Inc. Under the Master Services Agreement, each customer is responsible for evaluating whether output is appropriate for its use case, including where human review is appropriate, before using or sharing it.

Cognition maintains a documented security program based on security frameworks such as SOC 2 Type II and ISO 27001. Cognition has implemented a formal information security management system. Privileged access to Cognition's software services is reviewed at least quarterly and removed promptly upon termination of employment. Cognition runs a third party risk management program that assesses the security compliance of vendors, contractors and subprocessors. Monitoring and logging technology is used to help detect and prevent unauthorized access attempts to Cognition's network and equipment. Cognition's cloud service datacenters and on-premise datacenters are reviewed regularly for compliance with ISO 27001 and SOC 2, as applicable. Network-level isolation and other network security controls separate Cognition's development and production environments.

Cognition's service level agreement covers service availability and support when it is expressly included in an Order Form or referenced in a signed agreement with Cognition. Under its service level agreement, Cognition commits to System Availability of at least 99% during each calendar month of the term. Cognition's headquarters are in San Francisco, with a growing global presence across New York, Austin, Washington D.C., London, Singapore and Japan. Cognition states that it has raised over $3.5B from Founders Fund, Lux Capital, 8VC, Bain Capital Ventures and other investors.^{[1][2][3][4][5][7][8][9]}

Categories

• Vulnerability management (primary category)
• Compare Cognition with companies in the same categoryside by side

Headquarters

Not established from our sources

Founded

Not established from our sources

Ownership

Privately held^[6][13][14]

CISO on record

Alex Stamos, Chief Information Security Officer (appointment announced in the week of September 28, 2026)

Website

cognition.com

Products and services

Product names as the company writes them; what each does, in our words, from the company's own product pages. Never how well it does it.

• Devin^{[1][2][4][5][6][11][12]}

  Devin plans, writes, tests and ships production code on its own.

  Devin plans, writes, tests and ships production code on its own, working inside a customer's codebase and the tools its team already uses. Devin validates that vulnerabilities are exploitable at runtime and ships remediation PRs.

• Devin Security^{[1][4][5][6][12]}

  A set of Devin features, some of which use cyber-capable models or third-party models restricted by region.

  Cognition applies a regional availability policy to the Devin Security features that use cyber-capable models or third-party models restricted by region. The regional policy does not apply to Devin Security as a whole, and other Devin features are not affected by it. The region-restricted Devin Security features are available to enterprise customers only, and availability is confirmed as part of contracting.

• Devin Security Swarm^[4][5]

  Devin Security Swarm finds, validates and remediates code vulnerabilities autonomously.

  Devin Security Swarm is a Cognition offering to find, validate and remediate code vulnerabilities autonomously. Security Swarm is powered by an approach Cognition calls Agentic MapReduce, and Security Swarm reasons across an entire codebase. Devin Security Swarm runs parallel agents that trace data flows, validate what is exploitable at runtime and ship reviewed remediation PRs.

Competitors and alternatives

The other companies on our record filed under the same categories, category by category: first those that lead with that category and share more of Cognition's categories, then alphabetical. A list from the record, never a ranking.

• On vulnerability management, Cognition competes with ConnectSecure, Dynatrace, Intruder, Nucleus Security, Qualys, Rapid7, Tenable, Anchore, Astra Security, Attaxion and 43 more.

What review platforms show

The headline rating and review count each platform showed in public search results on the day we looked, with the link. We do not read or reproduce the reviews, and a rating is the platform's, not ours.

• G2 · no rating shown · 17 reviews^[13]seen November 12, 2026
• Gartner Peer Insights · no rating shown · 80 reviews^[14]seen November 12, 2026

Recent news

Dated company events from the last twelve months, each in one sentence of ours with its source. Newest first.

• October 28, 2026

  Corridor is joining Cognition, with plans to take Devin Security further. Cognition^[12]

• September 23, 2026

  Cognizant and Cognition announced production results from autonomous AI engineering at Odyssey Logistics and a set of joint offerings built on Cognition's Devin. PR Newswire^[11]

References

Every fact above cites one of these by number. Tier A is the company itself, a regulator or a filing; tier B is trade or business press.

1. [1]cognition.comCognition · cognition.com · undated page, accessed November 11, 2026 · Tier A: the company, a regulator or a filing
2. [2]CognitionCognition · undated page, accessed November 12, 2026 · Tier A: the company, a regulator or a filing
3. [3]Platform Terms of Service | CognitionCognition · undated page, accessed November 12, 2026 · Tier A: the company, a regulator or a filing
4. [4]Devin Security Swarm Launch | CognitionCognition · undated page, accessed November 12, 2026 · Tier A: the company, a regulator or a filing
5. [5]Gold Eagle Ready: Closing Federal Vulnerabilities within 72 Hours with Devin Security Swarm | CognitionCognition · undated page, accessed November 12, 2026 · Tier A: the company, a regulator or a filing
6. [6]Devin Security Supported Regions | CognitionCognition · undated page, accessed November 12, 2026 · Tier A: the company, a regulator or a filing
7. [7]Cognition Security | CognitionCognition · undated page, accessed November 12, 2026 · Tier A: the company, a regulator or a filing
8. [8]Master Services Agreement | CognitionCognition · undated page, accessed November 12, 2026 · Tier A: the company, a regulator or a filing
9. [9]Service Level Agreement | CognitionCognition · undated page, accessed November 12, 2026 · Tier A: the company, a regulator or a filing
10. [10]About | CognitionCognition · undated page, accessed November 12, 2026 · Tier A: the company, a regulator or a filing
11. [11]Cognizant and Cognition put autonomous AI engineering into production at Odyssey Logistics, with a 37 percent net cost savingPR Newswire · published September 23, 2026 · Tier A: the company, a regulator or a filing
12. [12]Blog | CognitionCognition · published October 28, 2026 · Tier A: the company, a regulator or a filing
13. [13]Deep Cognition Reviews 2026: Details, Pricing, & FeaturesG2 · undated page, accessed November 12, 2026 · Tier C
14. [14]Cognition Reviews, Ratings & Features 2026Gartner Peer Insights · undated page, accessed November 12, 2026 · Tier C

Last verified November 11, 2026. Our code found the quoted passage behind each fact on its source page when the fact was recorded, and re-checks every record against its sources each month.

Recorded November 11, 2026, expanded November 12, 2026 from the references above.

Work for Cognition? Suggest a correction to a fact on this page (with a source on your own domain), or claim this entry by publishing a small file on your domain.