Cogent pairs OpenAI models with enterprise context to build cyber defense factories

OpenAI published a customer case study on Cogent, a security company that builds Cyber Defense Factories for enterprises by combining OpenAI models with a customer's own environment context so AI agents can investigate and remediate vulnerabilities.

The post frames the problem bluntly: the hardest part of enterprise security is no longer finding vulnerabilities but fixing them. Remediation spans multiple teams and requires understanding how an attacker would exploit a flaw, which business systems are at stake and which changes can be made safely.

Cogent's agents pair GPT-6.1 Sol and GPT-5.6 with enterprise context and controls to carry work from investigation through verified remediation, while GPT-6 Astra handles upfront planning and complex reasoning. Co-founder and CTO Geng Sng said OpenAI models can sustain long-running tasks, unlocking what he described as a new level of autonomy in enterprise defense.

The context layer is what makes autonomy practical. Cogent's Context Engine maintains an enterprise knowledge graph of assets, vulnerabilities, identities, ownership and dependencies, with background agents continuously reconciling data across security tools. Sng calls it a memory harness for the enterprise that avoids relearning the environment for every task and cuts latency, inference cost and inconsistent results.

Permissioning is handled in two layers. Agent Policies define what changes are allowed and which need approval, and the TRACE enforcement engine checks tool calls against those policies deterministically without extra model inference. An Agent Gateway independently verifies authorization and higher-risk work can run in isolated sandboxes, so customers can limit agents to investigation, require approval for changes, or permit bounded autonomous remediation.

When the critical PHP2Shell flaw was disclosed in PHP, customers with deployed factories used the context layer to identify affected systems, assess exposure and build remediation plans that accounted for application dependencies and operational constraints, then verified the fixes. Cogent says a Fortune 1000 automotive customer cut mean time to remediate critical vulnerabilities by 75% and a Fortune 500 IT services customer reached 5x vulnerability-triage throughput, while trading platform MarketAxess says Cogent traces the route from the internet to a vulnerable system the way an attacker would.

The signal here is security agents moving from alerts and summaries into the authorized execution layer. For remediation to actually land, context, approval and audit have to hold at the same time, and the open questions are how reproducible these results are across future vulnerability events and how much autonomy enterprises will grant.