Cognition Expands AI Engineering Capabilities with Devin Desktop, Security Swarm, and Enterprise Tier

Cognition, the creator of the artificial intelligence software engineer Devin, has expanded its platform with the launch of Devin Desktop, a security scanning and remediation system called Security Swarm, and a dedicated Devin Enterprise tier. The company has also detailed how its automated agent system is being utilized by enterprise clients like Brazilian digital bank Nubank, which used a fine-tuned fleet of Devin agents to refactor millions of lines of legacy code, claiming significant reductions in both engineering hours and operational costs.

---

Expanded Platform Tooling and Devin Desktop

The Devin ecosystem has expanded beyond its original browser-based interface to include multiple deployment environments:

• Devin Desktop: Evolved from Cognition’s acquisition of Codeium and built on the foundation of the Windsurf IDE, this application transforms the traditional editor into an agent orchestration platform. It features an Agent Command Center as the default interface, allowing developers to manage local, cloud, and third-party agents from a single Kanban-style board.
• Devin CLI: A command-line interface that allows developers to run, manage, and interact with Devin directly from their local terminal.
• Devin Cloud: The cloud-hosted environment where Devin agents execute tasks.

The desktop application is downloadable locally for Windows, Mac, and Linux. Through support for the Agent Client Protocol (ACP), Devin Desktop can run any ACP-compatible agent alongside Devin. The environment also introduces “Spaces” to enable related agents to share context and collaborate on complex development tasks.

The platform has also introduced Devin Enterprise, a tier that offers organizations additional administrative control, compliance capabilities, and heightened security protocols.

---

Agentic Vulnerability Remediation with Security Swarm

Cognition has launched Security Swarm, an agentic vulnerability scanning and remediation product. Rather than acting as a runtime guardrail for Devin, Security Swarm utilizes parallel Devin agents to find, validate, and patch security vulnerabilities directly within a customer’s codebase.

The system is built on a custom architecture called Agentic MapReduce. The scanning and remediation pipeline operates through the following steps:

1. Plan: A planner agent analyzes the repository to write deterministic “selectors”—relevance tests tailored to the codebase’s routes, authentication boundaries, and deserialization sinks.
2. Shard & Map: Files matching the selectors are batched and handed to child Devin agents. These agents run in parallel to investigate shards of the codebase, identifying issues like business logic flaws, SQL injections, and cross-service exploit paths.
3. Reduce: A reducer agent dedupes findings and reasons across individual shards to map complex, chained attack paths.
4. Verify: Serious findings are reproduced in isolated sandboxes against a running build to confirm exploitability at runtime, filtering out false positives.
5. Remediate: Once a vulnerability is verified, Devin autonomously writes a patch and opens a pull request for human review.

---

Enterprise Code Migration and Refactoring

According to data released by Cognition, Brazilian financial technology company Nubank used Devin to execute a migration of its eight-year-old monolithic Extract, Transform, Load (ETL) pipeline containing over 6 million lines of code.

Initially, Nubank projected that migrating its monolithic ETL repository into smaller, modular sub-modules would require 18 months of manual work distributed across more than 1,000 engineers. To accelerate the process, Nubank and Cognition fine-tuned Devin on examples of manually completed migrations.

Cognition reports the following metrics from the Nubank deployment:

• Performance Improvements: Fine-tuning Devin on Nubank’s specific codebase doubled its task completion score and reduced average sub-task completion times by 75% (a 4x improvement in task speed).
• Efficiency and Costs: Nubank achieved an 8x to 12x improvement in engineering time efficiency, alongside a 20x reduction in costs for the portions of the migration delegated to Devin. These cost savings were calculated by comparing the operational cost of the AI agent against human engineering hourly rates.
• Autonomous Optimization: During the project, the Devin agent autonomously wrote its own helper and utility scripts to automate repetitive mechanical steps.

---

Core Capabilities and Agent Workflows

Devin operates as an autonomous agent capable of planning and executing multi-step engineering projects. Its core workflows cover several distinct operational areas:

• Pull Request Review and Visual QA: Devin automatically detects and resolves bugs, organizes code differences for human review, and conducts visual quality assurance using built-in browser and desktop simulation environments.
• Scheduled Chores: Users can schedule Devin to perform recurring engineering tasks, such as generating release notes, conducting daily QA checks, and updating documentation based on continuous user feedback.
• Issue Triage and Automated Fixing: Devin integrates with external monitoring systems to investigate Datadog incidents, route bug reports received via Slack, and automatically resolve continuous integration (CI) failures.

---

Platform Integrations and Workspace Collaboration

Devin is designed to fit into existing developer environments and supports bidirectional communication with third-party systems. It can read from and write to standard engineering tools, adjusting its code based on automated build results and human feedback.

[Datadog / Slack] ──> (Incident/Bug Trigger) ──> [Devin Agent]
                                                       │
                                            (Autonomously Generates PR)
                                                       │
                                                       ▼
[GitHub / Linear] <── (CI Results & Human Review) <───┘

The system integrates with developer tools, collaboration suites, and cloud platforms, including GitHub, Linear, Slack, Microsoft Teams, AWS, Azure, PostgreSQL, Snowflake, MongoDB, Databricks, Confluence, Jira, Notion, Asana, Airtable, Segment, and Stripe.

To handle large-scale, multi-repo initiatives, Devin can spin up parallel fleets of agents to tackle sub-tasks simultaneously. Over long-term projects, the agents parse historical session trajectories to identify past errors and adapt to the specific conventions of an organization’s codebase.