OpenAI and startup Cogent announced November 10 they are building AI-powered cyber defense factories that they say cut vulnerability remediation time by 75% S¹P³. The 75% figure is OpenAI's own, with no error bars, no released code, and no independent audit; no customers are named and no pricing is disclosed.
The 75% is a target, not a result yet: The only hard number in the announcement comes from the company making the product. It should be treated as a goal until Cogent publishes its methodology or a customer confirms it. The structural argument is more credible: OpenAI's Defense Factory page P⁵ argues that open-weight models can now sustain prolonged cyber operations, which means attackers are automating. If defense does not automate too, the gap widens by default. That logic does not need the 75% to hold.
Cogent's three-tool pipeline targets automated patching
Cogent, a North American technology startup, pairs OpenAI's models with a customer's codebase and internal security context so that AI agents can surface and repair vulnerabilities without manual intervention S¹P³. The product line includes three tools: API, Codex, and Daybreak P³. None of the sources identify which specific OpenAI models power the system, and the announcement does not say whether the offering is commercially available today or still in development.
The phrase "cyber defense factory" is OpenAI's own label, not an industry standard. OpenAI's separate Defense Factory page outlines the concept as a continuous, machine-driven operation that discovers, verifies, and repairs security flaws P⁵. Teams from Cloudflare and Ramp appear on that page, though their exact role is not specified P⁵.
Open-weight models give attackers automation, OpenAI argues
OpenAI's security push is partly a response to its own open-weight releases. The Defense Factory page warns that agents can now carry out extended cyber campaigns using freely downloadable open-weight models P⁵. OpenAI's own gpt-oss-120b and gpt-oss-20b, released as open-weight models on GitHub P⁶, fall into the same category of freely accessible models that the Defense Factory page cautions about.
The underlying logic is straightforward: if attackers have capable open models, defenders need automation that moves at the same pace. Cogent's pitch — that agents can remediate vulnerabilities in a company's own code, is the enterprise-facing expression of that idea.
No customers, no methodology, no timeline disclosed
The announcement omits the details a security team would need before signing on. No enterprise customers are named. No deployment timeline is disclosed. The 75% reduction in mean time to remediate carries no baseline, no sample size, and no methodology. Whether Cogent's agents handle real-world codebases, with their legacy dependencies and custom frameworks, or only clean test environments, is not addressed.
The partnership structure is also vague. The sources confirm a collaboration but say nothing about financial investment, acquisition, or joint venture terms.
For a vulnerability manager at a mid-size SaaS company, this would mean the backlog of unpatched CVEs currently sitting in a Jira queue could be auto-triaged and patched by an agent before the weekly review, shifting their daily work from writing patches to reviewing agent-generated diffs.
The first question for any team evaluating this is whether Cogent's agents can read and patch a real codebase, not a toy one. Ask for a live demo on your own repository, watch what the agent produces, and check whether the patches pass your existing CI pipeline. If the agent cannot handle a multi-service codebase with third-party dependencies, the 75% figure is academic.
OpenAI has not announced a date for broader availability of the Cogent integration.
Sources: S1 — Cogent and OpenAI build cyber defense factories for enterprises · S2 — Cogent and OpenAI build cyber defense factories for enterprises - Open · P3 — Cogent and OpenAI build cyber defense factories for enterprises | Open · P4 — n-kish/COGENT · P5 — Defense Factory | OpenAI · P6 — GitHub - openai/gpt-oss: gpt-oss-120b and gpt-oss-20b are two open-wei
Written from 6 sourced items, 5 of them primary.
