LTM to Roll Out Cognition's Devin to 260 Clients, Aiming to Clear 80% of CVE Backlogs

LTM and Cognition have announced a partnership: the AI engineer Devin will be deployed across LTM's global client base, which includes more than 260 companies, 26 of the Fortune 500 and the five largest banks in the world. The first joint product is BlueVerse RightLogic, an outcome-based managed service that works through accumulated vulnerabilities. The stated goal is to close 80% of a client's CVE backlog, whereas LTM's previous approach reached 60%. The two companies confirm the improvement jointly.

The release paints a stark picture of the context. According to Cognition, AI-powered attacks have tripled, and cheap mass probes test every possible hole. Security teams, meanwhile, receive 10–100 times more findings than before, and a significant share of them are false positives. Conventional scanners provide coverage but stop at detection. They miss exploit chains that require reasoning about business logic, and they leave validation and remediation to humans.

How RightLogic works

Under the hood is Devin Security Swarm, a Cognition product. According to the company, it finds critical vulnerabilities across an entire codebase, verifies their exploitability at runtime and submits a pull request with a fix. Cognition claims that large customers already find more verified vulnerabilities with it and pay 30% less than with the closest comparable alternative. These are the vendor's own figures; the announcement includes no independent comparisons.

LTM turns these capabilities into a managed service built on three pillars:

• Managed remediation. RightLogic pulls findings from the scanners the client already runs and ranks them by business criticality and regulatory exposure. High-confidence fixes go to Devin for end-to-end handling, while LTM engineers take the complex tasks. A human reviews every fix before it is merged.
• Scale and governance. Devin provides autonomous capacity for tens of thousands of findings. LTM adds its own remediation playbooks, compliance rules, coding standards and industry expertise. Its engineers are already trained to work with Devin.
• Accumulated experience. Each project refines LTM's playbooks and captures the specific client's requirements, so fixes should get faster and need less human involvement.

Key parameters:

• Client base: 260+ companies, 26 of the Fortune 500, the top 5 global banks
• Backlog target: 80% of CVEs versus the previous 60%
• Economics (per Cognition): 30% cheaper than the closest alternative
• Oversight: human review before every merge
• Status: the first of five joint products

Why start with banks

RightLogic launches in banking, financial services and insurance. According to the companies, Devin has already performed well there, and LTM has deep industry expertise. The service and the rest of the joint offerings will later extend to other industries. The announced portfolio includes application modernization and software development lifecycle (SDLC) transformation.

The logic is clear. Banks have huge codebases, strict regulators and vulnerability queues that hiring cannot clear. Gardner Johnson of Cognition puts it this way: security has become a volume problem that a human team cannot solve through headcount. Harsh Naidu of LTM adds that the financial sector must strengthen its defenses and speed up AI adoption at the same time.

What to check when evaluating

For CISOs and engineering leaders, the announcement is useful as a reference point, but the numbers are worth verifying against your own data. The first question is how exactly the "80% of the backlog" is counted: by number of CVEs, by severity, or by vulnerabilities that are actually exploitable in your environment. The second is what the false-positive rate is after runtime validation, and who is responsible for regressions if a fix passes review but breaks system behavior.

It is worth finding out in advance what permissions the agent will get in repositories and test environments, how audit logs are kept and how the setup fits your regulator's requirements. A sensible start is a pilot on one product with a known backlog: measure the share of accepted PRs, the time from finding to merge and the load on reviewers. If human review becomes the bottleneck, the promised 80% will remain only on paper.