Blog
Security
Cyber Defense Has to Run Like a Factory
AI turned cyberattacks into a production line. Cogent is building the enterprise platform for autonomous cyber defense, so every enterprise can run its own Cyber Defense Factory.
7 min read
Goods were once made by hand, one skilled worker at a time. Factories put the whole process on a single line, and the most advanced ones now run largely on their own while people design the line and handle the exceptions.
Cyberattacks are going through the same shift. AI now helps find vulnerabilities and build working exploits, and agents can carry out most of an attack campaign with little human direction. Enterprise defense still moves each vulnerability from one tool to the next by hand.
We started Cogent to close that gap. Our goal is for every enterprise to run its own Cyber Defense Factory, where AI agents find and fix vulnerabilities at machine speed and people set the policies they follow.
Attackers Built Their Factories First
PHP2Shell, disclosed October 21, showed what the offensive production line looks like. AI helped researchers find its two critical flaws, hidden in PHP for over a decade, and weaponize them in about a week. Exploitation began before the patch shipped, and Cloudflare saw millions of attempts that day. By 5 p.m. Pacific, the average Fortune 500 company in our research had patched fewer than 1% of its 2,266 affected assets.
PHP2Shell is part of a broader shift. Google's M-Trends 2026 puts the mean time to exploit at an estimated negative seven days, so exploitation now routinely starts before a patch exists. Researchers have shown AI producing working exploits for new CVEs in about 15 minutes for a dollar each. And in a state-sponsored campaign Anthropic disrupted, AI agents did 80 to 90% of the tactical work. Attackers now operate like an automated factory, while defenders are stuck doing work manually.
Enterprise Defense Still Runs by Hand
PHP2Shell forced enterprise security teams to scramble. Someone had to find every asset running PHP, including base images and leftover servers nobody tracks closely. Someone had to work out which of those assets were running PHP and reachable from the internet, and which of them the business depends on. Then came the owners, the tickets, the change windows and a rescan to confirm each fix held.
Each step is a skilled person with a tool, passing the result to the next. The work moves at the speed of the slowest handoff, a pace that only held up while attackers worked by hand too.
The Cyber Defense Factory changes that operating model.
Traditional security operations | Cyber Defense Factory |
|---|---|
Fragmented point solutions | Unified, coordinated workflows |
Sequential human handoffs | Parallel AI-agent execution |
Periodic scans and reactive processes | Continuous discovery, investigation and action |
Siloed organizational context | Shared enterprise context |
Human-speed operations | Machine-speed operations with human oversight |
OpenAI described this model in its Defense Factory, a continuous loop in which AI agents find and validate vulnerabilities in OpenAI's own systems and prepare tested code fixes, with people reviewing consequential changes. Most enterprises need that loop for software they didn't write. They run thousands of third-party products across cloud workloads, endpoints and legacy servers, and fixing a vulnerability there usually means applying a vendor patch or changing a configuration. Cogent brings the Cyber Defense Factory to those environments.
How Cogent Runs the Production Line
Cogent turns the manual work people do with security tools into a production line run by AI agents, built to do 100 times more work, 100 times faster. For autonomous vulnerability management, that line runs in five stages.
1. Inventories Every Asset
Cogent's agents build one deduplicated inventory across cloud, on-premises and endpoint environments, merging each asset as it appears across tools. They infer every asset's owner and business criticality from the systems and documentation a company already has, and the Context Engine keeps that picture current as the environment changes.
2. Discovers Vulnerabilities and Attack Paths
Findings flow in from the scanners and the application security, cloud and EDR tools security teams already run. Cogent also matches newly published vulnerabilities against its live software inventory, so exposure surfaces before scanner detections exist. Attack path analysis then traces how individual weaknesses chain together toward crown-jewel systems.
3. Validates Exploitability
Agents check whether the vulnerable software is running and whether an attacker can reach it, accounting for the identities and compensating controls in the path. Every priority comes with written reasoning, so teams can see why a vulnerability ranks where it does.
4. Drives Remediation
Cogent groups work by the fix, so one patch can resolve a vulnerability across dozens of servers. Within the autonomy zones each customer sets, Cogent's agents carry out supported fixes on their own. On managed endpoints, for example, the agents write the remediation script, push it through the company's existing endpoint management platform, trigger the run and read back the results to confirm the fix landed. Changes outside those zones go to a single owner as a ticket with instructions and the affected assets attached, and wait for a person's approval.
5. Verifies Every Fix
Cogent closes work only after the next scan confirms the fix held, and escalates it automatically when a fix doesn't take.
People stay in charge of the line. Security teams set the policies the agents follow and approve the changes they make. Most teams start with agents in an assistive role and widen their autonomy as the results earn trust, an approach we call progressive autonomy.
What an Enterprise Defense Factory Requires
Running a Cyber Defense Factory across a large enterprise depends on capabilities Cogent was designed around.
The first is context. Defenders know their environment far better than any attacker, but that knowledge is scattered across CMDBs, ticket histories, cloud accounts and architecture documents. Cogent's Context Engine connects each vulnerability to the assets, identities, applications, owners and dependencies around it, which lets agents judge what matters and what can safely change.
Security work also calls for models trained for it. VR-1, Cogent's domain-specific model, brings specialized cybersecurity reasoning to each decision about what to investigate and how to fix it.
Finally, the agents need room to act, under rules each enterprise sets. Cogent's agents work across code, endpoints, servers, cloud, identities and applications, with approval controls that let each enterprise decide how much they handle on their own.
Why It Matters for Security Leaders
PHP2Shell gave us a live test of the production line. Cogent Zero Day Response processed the advisory and mapped vulnerable assets across customer environments in an average of five minutes, days ahead of scanner signatures. The analysis drew on EDR and external scan data customers already had, plus the business criticality our agents had already mapped for every asset.
Applied to the average Fortune 500 environment in our research, that context narrowed 2,266 affected assets to the 16 that had PHP loaded at runtime, were exposed to the internet and were critical to the business. When security teams started work on PHP2Shell, that list was already waiting for them in Cogent.
For security leaders, that result shows up in three ways.
Faster risk reduction. The measure that matters now is the time between vulnerability disclosure and a verified fix, and it has to beat the time attackers need to build and launch an exploit. Cogent shortens that window by closing the loop. Inside the autonomy zones each team sets, agents carry a vulnerability from discovery through autonomous remediation to a verified fix, with no handoff in between.
Greater efficiency. Analysts stop triaging thousands of findings by hand, and IT and engineering teams receive clear work with a named owner. Security operations grow with the production line rather than with headcount, and engineering gets time back for the products that drive revenue.
Unified operations. The scanners, EDR, cloud and ticketing tools a company already owns start working as one coordinated line, with shared context and fewer handoffs between teams.
The factories that run on their own still have people in them, and those people decide what the line builds and the standard it holds. Security teams are moving into the same role, setting policy and making the judgment calls while agents do the work at machine speed.
We're building Cogent so every enterprise can run its own Cyber Defense Factory. If your team wants to see what that line looks like in your environment, we'd like to show you.
