San Francisco, CA, November 3rd, 2026, CyberNewswire
Cogent Security, an applied AI cybersecurity company, reported that the PHP2Shell vulnerability exposed significant gaps in enterprise vulnerability response. Disclosed on October 21, PHP2Shell involved two critical flaws that had remained in PHP for more than a decade. AI-assisted research helped identify the vulnerabilities and develop working exploits in approximately one week, with attacks beginning before a patch was available. Cloudflare recorded millions of exploitation attempts that day.
According to Cogent Security’s research, by 5 p.m. Pacific, the average Fortune 500 company had patched fewer than 1% of its 2,266 affected assets.
That gap between how fast attackers move and how fast large companies respond is the problem Cogent was built to close. The company, an applied AI lab focused on cybersecurity, has been named to the Fortune Cyber 60 for the second consecutive year.
The list, developed by Fortune with Lightspeed Venture Partners and AWS, recognizes 60 of the most important venture-backed cybersecurity startups that have yet to go public, be acquired, or reach another significant exit, grouped by stage. Selection weighs financial performance, growth, business operations, and cybersecurity market research, and Fortune validates the final list.
“Attackers already run like a factory. AI is finding the bugs and writing the exploits, and in some cases it’s running most of the attack,” said Vineet Edupuganti, Cogent’s co-founder and CEO. “Most enterprises are still defending by hand, one ticket and one handoff at a time. Making this list two years in a row tells us security leaders are ready to change how that work gets done.”
The attackers built their factories first
Edupuganti borrows an analogy from manufacturing. Factories replaced the lone skilled worker with a production line, and the most advanced plants now run largely on their own while people design the line and handle the exceptions. Offense, he argues, has already made that shift.
The data points the same way. Google’s M-Trends 2026 report estimates the mean time to exploit at negative seven days, which means exploitation now routinely begins before a fix exists. Researchers have shown AI producing working exploits for newly published vulnerabilities in about 15 minutes, at roughly a dollar apiece. In a state-sponsored campaign that Anthropic disrupted, AI agents carried out 80 to 90% of the tactical work.
Enterprise defense still moves at the pace of its slowest handoff. When PHP2Shell landed, security teams had to find every asset running PHP, including base images and forgotten servers, then work out which were internet-facing and which the business depended on. After that came owners, tickets, change windows, and a rescan to confirm each fix held, with every step falling to a skilled person with a tool.
Building the Defender’s Production Line
Cogent’s answer is what it calls the Cyber Defense Factory, an operating model in which AI agents take over the work that now moves by hand between security tools, while people set the policies those agents follow. The company sells an enterprise platform for autonomous cyber defense, and its first product applies the model to vulnerability management.
The line starts with an inventory. Agents build one deduplicated record of every asset across cloud, on-premises and endpoint environments, inferring each one’s owner and business importance from systems the company already keeps. Findings flow in from the scanners and security tools customers already run, and Cogent matches newly published vulnerabilities against its live software inventory so exposure surfaces before scanners catch up. Agents then check whether the vulnerable software is running and reachable, and they write out the reasoning behind every priority.
Cogent groups remediation work by fix, so one patch can resolve a vulnerability across dozens of servers. Inside the autonomy zones each customer defines, agents carry out supported fixes on their own. On managed endpoints, for instance, they write the remediation script, push it through the company’s existing endpoint management platform, and read back the results. Changes outside those zones go to a single owner as a ticket and wait for a person’s approval, and Cogent closes the work only after the next scan confirms the fix held.
The company says the goal is for enterprises to transform their cybersecurity functions with a factory model to do 100 times more work, 100 times faster. Most customers start with agents in an assistive role and widen their authority as the results earn trust, an approach Cogent calls progressive autonomy.
PHP2Shell gave the model a live test. Cogent’s Zero Day Response processed the advisory and mapped vulnerable assets across customer environments in an average of five minutes, days before scanner signatures were available. Applied to the average Fortune 500 environment in Cogent’s research, the analysis cut 2,266 affected assets down to 16 that had PHP loaded at runtime, faced the internet, and supported critical business functions. That shortlist was waiting for security teams when they sat down to start work.
A Lab With Its Own Models
Cogent describes itself as an applied AI lab that just happens to focus on defensive cybersecurity, and the label reflects how the company is built. It is the only cybersecurity company that trains and deploys its own frontier reasoning models for security use cases. Its domain-specific model, VR-1, has topped cybersecurity benchmarks, outperforming general-purpose frontier models on security tasks.
The model works alongside Cogent’s Context Engine, which ties each vulnerability to the assets, identities, applications, owners, and dependencies around it. That context usually sits scattered across asset databases, ticket histories and architecture documents, and pulling it together is what lets agents judge which changes are safe to make.
“A general-purpose AI model knows a little about everything,” Edupuganti said. “When an AI agent is deciding whether a patch is safe to push to a few thousand production servers, it needs a model that has learned how vulnerabilities, exploits and enterprise systems behave, plus deep context on the company it’s protecting. Put those together and you can give agents real responsibility.”
Racing the Exploit Clock
For security leaders, Edupuganti argues, the number that matters now is the time between a vulnerability’s disclosure and a verified fix, and that window has to be shorter than the time an attacker needs to build and launch an exploit. Cogent is betting that closing it takes a different operating model, one where security work grows with the production line rather than with headcount.
The company’s second straight appearance on the Cyber 60 suggests buyers are warming to that bet, though Edupuganti expects people to stay at the center of it.
“The most advanced factories still have people in them. They decide what the line builds and the standard it holds,” he said. “Security teams are moving into that role. They set the policy and make the judgment calls, and the agents do the work at machine speed.”
About Cogent
Cogent Security is an applied AI lab building the enterprise platform for autonomous cyber defense. Its AI agents find and fix vulnerabilities at machine speed so every enterprise can run its own Cyber Defense Factory. Starting with autonomous vulnerability management, Cogent carries vulnerabilities from disclosure to a verified fix across cloud, on-premises, and endpoint environments, identifying exposure within minutes and confirming what attackers can reach along the way. Customers set the policies the agents follow and decide which fixes run autonomously and which wait for approval. Fortune 500 security teams using Cogent have reduced the exposure window for critical vulnerabilities by 97 percent. Built by researchers and operators from Google DeepMind, Abnormal Security, and Coinbase, Cogent is backed by Greylock Partners and Bain Capital Ventures. Learn more at cogent.com.
Contact
Ignacio Ramirez
press@cogent.com
