Cogent Security joins Fortune Cyber 60 with AI-driven defense model

The speed of AI exploitation

Cybersecurity is currently facing a massive imbalance between how quickly attackers can strike and how slowly companies can defend themselves. Recent data from Google’s M-Trends 2026 report suggests that the mean time to exploit a vulnerability is now negative seven days. This means that hackers are often launching attacks before a fix even exists for the public.

The PHP2Shell vulnerability served as a clear example of this problem. Disclosed in October 2026, the flaw involved two critical issues in PHP that had remained unaddressed for over a decade. AI-assisted research helped hackers develop working exploits in roughly one week, leading to millions of exploitation attempts recorded by Cloudflare.

While attackers are moving at a factory-like pace, most large enterprises still rely on manual processes. Security teams often have to find every instance of a software, determine which are internet-facing, and then navigate a long chain of owners, tickets, and change windows. This manual approach creates a significant window of opportunity for cybercriminals.

The Cyber Defense Factory

Cogent Security is attempting to solve this by creating what it calls a Cyber Defense Factory. This operating model uses AI agents to handle the repetitive work that usually moves by hand between different security tools. Instead of humans performing every step, people set the high-level policies that the agents then follow to execute the work.

The process begins with an automated inventory that builds a single record for every asset across cloud, on-premises, and endpoint environments. These agents then match newly published vulnerabilities against the live software inventory to find exposure surfaces before standard scanners can even catch up. The system then analyzes whether the software is actually running and reachable from the internet.

To make the work manageable, Cogent groups remediation by fix so that one patch can resolve a vulnerability across many different servers. In certain 'autonomy zones,' the agents can write and push remediation scripts to endpoint management platforms on their own. For areas outside these zones, the agents simply create a single ticket for a human to approve, ensuring that the system remains under human oversight.

Testing the model on PHP2Shell

The company recently put its Zero Day Response tool to the test during the PHP2Shell incident. The system processed the advisory and mapped vulnerable assets across customer environments in an average of just five minutes. This occurred days before scanner signatures were even available for the security community.

When applied to a typical Fortune 500 environment, Cogent's research showed a dramatic reduction in the workload for security teams. The analysis took 2,266 affected assets and narrowed them down to just 16 that were actually loaded at runtime, faced the internet, and supported critical business functions. This allowed security leaders to focus their energy on the most dangerous risks immediately.

By narrowing the scope so quickly, the company aims to help enterprises do 100 times more work at 100 times the speed. The goal is a transition toward 'progressive autonomy,' where customers start with agents in an assistive role and gradually give them more authority as the results earn the trust of the security team.

Custom models for security

Unlike many other security firms that use general-purpose AI, Cogent describes itself as an applied AI lab. They train and deploy their own frontier reasoning models specifically for security tasks. Their domain-specific model, VR-1, has been shown to outperform general models on various cybersecurity benchmarks.

The company argues that general AI models know a little bit about everything but lack the deep context needed for high-stakes security decisions. To fix this, they use a Context Engine that ties vulnerabilities to specific identities, applications, and dependencies. This allows the AI to understand the unique architecture of a specific company before it decides if a patch is safe to push.

This specialized approach is what allows the agents to take on real responsibility in a production environment. By combining deep context with a model trained on how vulnerabilities and enterprise systems behave, the AI can make safer judgments. This combination is intended to help security teams move into a role where they set the standards while the agents do the heavy lifting at machine speed.