Devin Security 2.0: Frontier Scans, Remediation and Enterprise Credits

Cognition launched Devin Security 2.0 on October 26, adding managed scans with Claude Mythos and other frontier cyber models, contextual prioritization and remediation workflows. Enterprise teams can use the models through Devin without separate model access, with free scans and a credits programme intended to help turn findings into fixes.

The announcement describes a broader security product, not another version of the Vulnerability Fixes plugin released last week. That plugin provides instructions for specific runtime-patching workflows. Devin Security coordinates investigation across repositories and carries findings into a managed remediation process.

What changed in Devin Security 2.0

Cognition's pitch connects three jobs that are often separated: discover a vulnerability, decide how much it matters in this environment, and prepare a change that addresses it.

The upgrade can also take existing findings from other tools and reports, rather than requiring a team to start with Devin's scanner. The original references remain attached as findings are investigated and reprioritized.

This is useful because another scanning tool can make a backlog larger without making it easier to act on. If an agent can establish that several reports share one root cause, or that an existing change already addressed a report, it can reduce review work before generating any code.

That benefit still depends on the evidence. A shorter list is useful only when the reasons for removing or combining findings are sound.

How the scanning architecture works

The underlying Agentic MapReduce architecture predates this launch. An agent develops rules for identifying relevant code, a deterministic pass selects candidates, and separate workers investigate bounded groups. A later stage combines their conclusions.

This separates finding the work from reasoning about it. Each worker gets a focused task instead of one agent carrying an expanding conversation through the entire repository.

There is a meaningful limit in Cognition's explanation: files that do not match the selectors never reach the investigation workers. Completing the work queue does not prove that every vulnerability was covered. Selector quality remains part of the system's effectiveness, and the company describes those selectors as inspectable and version-controlled.

For a security team, that makes the proposed scope worth reviewing. A clean report from an incomplete selection process can be reassuring for the wrong reason.

Runtime validation is optional

The Devin Security product FAQ says runtime validation depends on the scan profile. When enabled, agents run the application in an isolated environment and attempt to reproduce selected findings. It should not be assumed that every item in a report has been demonstrated against a running build.

The same page describes a choice between normal scanning and deeper investigation with frontier cyber models. It also frames the product as additive to existing scanners, rather than a reason to immediately remove them.

This distinction matters when comparing results. A plausible code-level finding, a reproduced exploit and a tested fix are different kinds of evidence. Teams should preserve those differences in their own dashboards instead of treating every generated report as equally certain.

Getting started, API access and finding status

The current documentation directs users to Security in the app, where they select repositories and scan effort. Advanced settings expose profiles, while the available choices depend on organizational access. Role permissions separately govern scanning and finding management.

Findings can be filtered by repository, severity and pull-request state, then assigned individually or in bulk for remediation. The documentation also links organization- and enterprise-scoped Code Scans APIs.

One small label deserves attention: Reviewed does not mean a pull request has merged. A reviewed finding is not necessarily a fixed application. Teams still need to follow the proposed change into their normal review and deployment process.

Free scans are not a permanent price table

Cognition is offering free frontier-model scans to current and future enterprise customers, with remediation credits also available to new customers. It describes a commitment of hundreds of millions of dollars in Devin credits. These are service credits, not payments to customers.

The announcement does not specify a universal per-customer allocation or a lasting price for every scan and remediation workload. Teams should establish the credit terms and ongoing costs before making assumptions about a recurring programme.

The useful test is whether security work reaches a verified resolution with less human effort. Finding more issues is easy to count. Measuring how much evidence survives review, how many fixes merge and whether the deployed application is actually protected will say more about the value of this release.

I’m Paras. I work at the intersection of AI, engineering and distribution.

I help teams explain complex AI and security products through clear technical stories that developers and decision-makers can use.

Book a 30-minute call.