Anchore vs Cognition

About Cognition

Cognition sells Devin, an agent that plans, writes, tests and ships production code on its own, working inside a customer's codebase and the tools its team already uses. Cognition builds tools for software creation, stating that software shapes nearly every aspect of modern life. Cognition describes engineers operating more like architects, strategizing, designing systems and focusing on problem solving, while agents handle the repetitive engineering work. Cognition's services generate or return code, suggestions, completions, responses, results and actions based on the input that customers and their authorized users provide. Cognition's platform terms govern use of the Cognition Platform and other software offerings. FrontierCode is a Cognition benchmark that measures whether a model writes code that a maintainer would actually merge. FrontierCode combines custom rubrics, verifiers and tests to check for correctness, test quality, scope discipline, style and adherence to codebase standards.^[1][2][3]

Devin Security Swarm is a Cognition offering to find, validate and remediate code vulnerabilities autonomously. Security Swarm is powered by an approach Cognition calls Agentic MapReduce, and Security Swarm reasons across an entire codebase. Devin validates that vulnerabilities are exploitable at runtime and ships remediation PRs. Devin Security Swarm runs parallel agents that reason across an entire codebase, tracing data flows, validating what is exploitable at runtime and shipping reviewed remediation PRs. Devin works end to end, from a clearinghouse advisory to a shipped, reviewed fix.^[4][5]

The White House's Gold Eagle Initiative and CISA's BOD 26-04 have turned vulnerability remediation into a binding order to find, prove and fix vulnerabilities on a 72-hour clock. Cognition states that federal agencies must now close a backlog that scanners and manual triage were never built to address. Cognition has a federal team.^[5]

Cognition applies a regional availability policy to the Devin Security features that use cyber-capable models or third-party models restricted by region. The regional policy for Devin Security does not apply to Devin Security as a whole, and other Devin features are not affected by it. The providers of those models make them available only in certain countries and regions, and Cognition applies the same list to the Devin Security features that use them. For the region-restricted Devin Security features, territories and dependencies of a listed country are supported, for example Puerto Rico as a territory of the United States. The region-restricted Devin Security features are available to enterprise customers only, and availability is confirmed as part of contracting. Cognition may block access to the region-restricted Devin Security features when end users of qualifying customers attempt to reach them from unsupported regions. All use of Cognition products and services remains subject to the Acceptable Use Policy, the applicable terms of service and applicable export control and sanctions laws.

Cognition's services are delivered as a software-as-a-service offering. For certain services, the data plane can be deployed either in the customer's own cloud service provider account or in an account controlled by Cognition. A Master Services Agreement, together with any applicable Order Form, governs the relationship between Cognition AI, Inc. and the customer. Some customers may have licensed Cognition's services from Exafunction, Inc., unless they have received notice that the license was assigned to Cognition AI, Inc. Under the Master Services Agreement, each customer is responsible for evaluating whether output is appropriate for its use case, including where human review is appropriate, before using or sharing it.^[3][7][8]

Cognition maintains a documented security program based on security frameworks such as SOC 2 Type II and ISO 27001. Cognition has implemented a formal information security management system. Privileged access to Cognition's software services is reviewed at least quarterly and removed promptly upon termination of employment. Cognition runs a third party risk management program that assesses the security compliance of vendors, contractors and subprocessors. Monitoring and logging technology is used to help detect and prevent unauthorized access attempts to Cognition's network and equipment. Cognition's cloud service datacenters and on-premise datacenters are reviewed regularly for compliance with ISO 27001 and SOC 2, as applicable. Network-level isolation and other network security controls separate Cognition's development and production environments.^[7]

Cognition's service level agreement covers service availability and support when it is expressly included in an Order Form or referenced in a signed agreement with Cognition. Under its service level agreement, Cognition commits to System Availability of at least 99% during each calendar month of the term. Cognition's headquarters are in San Francisco, with a growing global presence across New York, Austin, Washington D.C., London, Singapore and Japan. Cognition states that it has raised over $3.5B from Founders Fund, Lux Capital, 8VC, Bain Capital Ventures and other investors.^[1][3][8][9]