Cogent agents powered by GPT-6.1 Sol cut vulnerability remediation time by 75%

Anyone who has worked in security knows that finding a vulnerability is only half the job. Scanners flag hundreds of findings every day, and then the tedious work begins: figuring out who owns the service, what depends on it, whether a library can be updated without downtime and who needs to approve it. According to Cogent, this is where everything gets stuck. The startup builds “cyber defense factories” for large companies: teams of AI agents that take work from investigation through to a verified fix.

Context first, agents second

At the core of the system is Context Engine. It maintains a knowledge graph for each customer, covering assets, vulnerabilities, accounts, owners and dependencies. Background agents continually reconcile data across security tools so that investigating and remediating agents work from a shared view of the environment. CTO Geng Sng calls it a “memory harness for the enterprise”: there is no need to rediscover how the infrastructure works with every new task. The side effects are lower latency, lower inference costs and more consistent responses.

Take a simple example: critical PHP2Shell vulnerabilities are disclosed in PHP. Instead of manually searching for every place the company runs PHP, agents traverse the graph: they identify affected systems, assess their exposure to attackers and build a plan that accounts for application dependencies and operational constraints. They then apply fixes through a process agreed with the customer and verify that the vulnerability has actually been closed. Cogent uses GPT-6.1 Sol and GPT-6 Astra for investigation and planning.

Permission to act gets its own layer

For engineers, the most interesting part is how Cogent addresses the question: “What if the agent breaks everything?” Permitted changes and approval requirements are defined in Agent Policies. The TRACE engine checks every tool call against these rules before execution, using deterministic checks that require no separate model call. Above that sits Agent Gateway, which independently verifies authorization, while risky tasks run in isolated sandboxes. Customers choose their own operating mode: investigation only, changes with human approval or limited autonomous remediation.

The principle is worth remembering: agent safety should not depend on whether the model interpreted an instruction correctly. The rules belong in code, not in a prompt.

Economics: different models for different tasks

Cogent allocates work by complexity. GPT-6.1 Sol handles general execution and demanding investigations, while GPT-5.6 handles routine vulnerability management tasks that do not require deep reasoning. When you run “swarms” of agents, token costs quickly become the largest expense, turning this kind of routing from an optimization into a necessity.

Cogent also says OpenAI's API has reduced the amount of supporting code it needs to write: the platform handles much of the request routing and agent orchestration. Most of its engineers write code in Codex because the tools they need are already available there. For its own research, the team uses the Trusted Access for Cyber and Daybreak programs, including the Daybreak Red tier with specialized models for authorized offensive analysis. The goal is to understand how vulnerabilities can be chained across accounts, resources and network restrictions.

Which claims deserve a closer look

This is a customer case study on OpenAI's blog, not independent research. The figures—a 75% reduction in mean time to remediate critical vulnerabilities at a Fortune 1000 automaker and a 5-fold increase in triage throughput at a Fortune 500 IT integrator—come from Cogent itself, with no methodology or baseline figures provided. The customers are unnamed except for MarketAxess, which discusses risk prioritization rather than metrics. Claims of fewer hallucinations and better costs than other providers also come without benchmarks. Fully autonomous remediation remains on the roadmap, progressing from simple configuration changes to multistep workflows spanning multiple systems.

What to put into practice

If you build agents for infrastructure, DevOps or security, there are three lessons to take from this case. First, invest in the context layer: a graph of assets, owners and dependencies gives agents more than switching models does. Second, implement policies and authorization as deterministic code outside the model, and isolate risky actions. Third, plan for model routing from the outset, or your agent bill may come as an unpleasant surprise. Until the efficiency figures are independently verified, treat them as marketing.