The company says enterprise teams can run deep vulnerability scans powered by Claude Mythos and other frontier cyber models through Devin, without holding separate model access.
Devin Security builds a threat model with a customer’s security and engineering teams, covering systems, services, hosts, network controls, deployment, unused code, and stated business-impact scenarios. It can ingest findings from scanners, bug bounties, and advisories, deduplicate and re-verify them, then assess exploitability and potential damage against that threat model.
For remediation, Cognition says Devin can document false positives or risk adjustments for human approval, apply configured infrastructure mitigations, and run thousands of independent VM sessions that reproduce a vulnerability, write and test a fix, and open a pull request with evidence. KEV-listed vulnerabilities are not eligible for relabeling. Cognition is also committing “hundreds of millions of dollars” in Devin credits, including free frontier-model scans for current and future enterprise customers and remediation credits for new customers.
The announcement does not specify pricing, customer eligibility criteria, credit allocation, model coverage, supported environments, or independently measured detection and remediation results.