About AISLE
AISLE sells a platform that finds, fixes, and verifies vulnerabilities in source code. AISLE continuously finds, verifies, and fixes vulnerabilities in code, and it can run in any deployment environment with the AI of the customer's choice. Cohere has formally acquired AISLE, and customers are served as Cohere Cyber.[5]
AISLE uses thousands of agents that reason in parallel across a codebase, its dependencies, and its architecture. AISLE connects to GitHub, GitLab, Bitbucket, and Azure DevOps, then reads the branch the customer nominates, maps the stack and the build system, and identifies the dependencies. AISLE analyzes source code, dependencies and licenses, secrets, and IaC configs. AISLE reasons through code, looking at how data moves through it, what is reachable, and what an attacker could exploit. AISLE combines static reasoning with dynamic analysis via AI-guided fuzzing. AI-native analysis in AISLE covers Python, JavaScript, TypeScript, Java, C#, C, C++, Rust, Go, PHP, Kotlin, Swift, Ruby, and more.[5][6]
For dependencies, AISLE finds vulnerabilities, assesses whether the dependencies actually get used and exposed, and flags dependencies that violate license policies. AISLE analyzes credentials, keys, and tokens in repositories. AISLE reviews Terraform, CloudFormation, Kubernetes, and Dockerfile configs to find misconfigurations and propose fixes before deployment. Customers describe their trust boundaries, intent, and policies in plain English.[6]
AISLE ranks every issue by exploitability, reachability, and impact, not just CVSS. AISLE checks every finding with multiple, independent agents to verify exploitability. AISLE assesses findings based on a customer's threat model and the feedback the customer gives it. Customers can chat with the platform to inspect the evidence for each prioritization decision. A customer who disagrees with a triage decision can explain why and send the issue back through triage, and AISLE re-assesses it and applies that reasoning to future prioritization across the repository. AISLE ingests and prioritizes issues from third-party scanners in the same workflow as AISLE findings. Customers tell the platform what to do with low, medium, high, and critical severity findings.[7]
AISLE builds the repository in an isolated container, applies the patch, and runs the tests against it. AISLE uses both CI and agent-generated sandboxed tests to verify each fix it generates. AISLE does not merge fixes on its own, and it opens the pull request and waits for human approval. AISLE fixes code and dependency findings, and it provides remediation guidance for secrets, license policy, and infrastructure-as-code findings. AISLE bumps a dependency to the fixed version and edits code to adapt to any API changes. AISLE explains each change in natural language and delivers its fixes as pull requests. AISLE resolves findings with a round of confirmation analysis that runs automatically after a fix is merged. Customers decide how far AISLE goes on its own, per severity and per repository.[8]
AISLE does not train on customer code. AISLE builds context at the repository, product, or codebase level, updates it with every run, and reads it before analyzing new findings. Customers can dismiss a finding and explain why in natural language, and AISLE turns the reasons into guidance. Everything AISLE learns about a repository is visible, editable, and dated. Customers can accept a risk for a given amount of time, and AISLE resurfaces it when the time is up.[9]
AISLE can run the infrastructure while the customer connects its repositories, for teams whose code classification allows external processing by frontier LLMs. AISLE can run inside a customer's cloud account using the customer's choice of frontier and custom LLMs, with deployment artifacts delivered in push or pull mode into a local registry. AISLE can run on the customer's GPUs, using custom models recommended by AISLE, plus optional threat and dependency intel pulled from AISLE servers. AISLE can run disconnected using fine-tuned security models, with no network path in or out. AISLE provides single-tenant cloud deployments in the region of the customer's choice. AISLE maintains a zero data-retention policy with every model provider, and none of a customer's data is used for training. AISLE is not bound to a single model vendor or a fixed list of languages.[5][6]
The OpenSSL Foundation has AISLE analyze every pull request. The curl project, maintained by a full-time team of one, has found and fixed 35 CVEs and 160 bugs with AISLE. An enterprise ran a one-time AI-native security audit, AISLE Snapshot. A global network infra enterprise could not send its source code to an AI security vendor.[1][3][5][9][10]
AISLE on the record