Cogent agrees to buy Specular to add attacker-view AI agents to vulnerability fixing

What Cogent is buying

Cogent, a US startup that sells AI agents for vulnerability management, said on 10 November 2026 that it has agreed to acquire Specular, an AI security company. The Cogent press release describes Specular as Google-backed and trusted by Fortune 500 enterprises, but it does not name Specular's investors, the size of Google's stake or the customers. Financial terms, the form of payment and the expected closing date were not disclosed.

The two companies work on opposite sides of the same problem. Cogent's agents work from the inside: they take the vulnerability findings that scanners already produce, connect each finding with internal context about the affected system and its owner, analyse possible attack paths, rank which issues carry real risk and then drive the fix through the teams that have to apply it. Specular's agents work from the outside. According to the release, they probe a company from the open internet, find assets that are exposed, such as forgotten servers, login pages or cloud services, and test how a real attacker could exploit the weaknesses they find. Cogent says Specular's agents validate real world attack paths from the outside in.

Putting the two together, Cogent says, strengthens its ability to continuously discover, validate and remediate vulnerabilities, and moves it toward what it calls a fully autonomous Cyber Defense Factory. In practice, the goal is a single loop in which an external probe confirms that a weakness can actually be reached, the internal agents work out who owns the system and how serious the issue is, and the remediation step tracks the fix until it is verified. Existing Specular customers can keep feeding data from the security tools they already use into the combined platform, according to the release.

Peyton Smith, who founded Specular, will join Cogent as Head of Offensive Security. Offensive security is the practice of attacking one's own systems, through penetration tests and red team exercises, to find weaknesses before criminals do. According to his ONUG member profile, Smith worked at CrowdStrike Services from 2018 to 2023, splitting his time between incident response and red team work. The release does not say how many Specular employees will join Cogent.

Who Cogent is and what it claims

Cogent was founded in 2025 by Vineet Edupuganti, its chief executive, and Geng Sng, who both came from the email security company Abnormal Security. It announced a $42 million Series A on 18 February 2026, led by Bain Capital Ventures with Greylock Partners and Definition taking part, after an $11 million seed round from Greylock when it came out of stealth in July 2025. In March 2026 it described a partnership with Anthropic in which its platform runs Claude models inside its own execution framework, built for enterprise security environments. Earlier this month Cogent was named to Fortune's Cyber 60 list of security startups for the second year.

In the acquisition release, Edupuganti argues that defenders cannot keep up by adding more dashboards and alerts. What they need, in his framing, are AI agents that find, validate and fix vulnerabilities continuously, and he says Specular helps Cogent see a customer's environment the way an attacker would. In comments around the Fortune list a week earlier, he described the key metric for a security team as the time from the disclosure of a vulnerability to a verified fix, and said that time has to be shorter than the time an attacker needs to build a working exploit.

Cogent also makes a performance claim. The release says its Fortune 500 customers have reduced their exposure window for critical vulnerabilities by 97%. The exposure window is the period during which a known critical flaw remains open in a company's systems. Cogent does not say how many customers the figure covers, over what period it was measured or what the starting point was, and the number has not been independently checked. It should be read as a vendor claim.

What the deal means and what to watch

The Specular purchase is part of a wider wave of consolidation in AI security. Earlier this month CrowdStrike agreed to buy Fiddler AI and Dreadnode to monitor and test enterprise AI agents, and large security vendors and startups alike are buying small teams that build agents for offensive testing. For young companies such as Cogent, buying a team that already has working agents and customers is faster than building the same capability, and it lets them present a broader platform to the large enterprises they sell to. More deals and disclosures are on our cybersecurity page.

The things to watch are the closing of the deal, the first product release that combines Specular's external testing with Cogent's remediation agents, and whether Cogent publishes customer results with enough detail to check its claims. With AI tools speeding up both the discovery and the exploitation of vulnerabilities, buyers will increasingly judge security vendors on the measured time it takes to close a real exposure, which is exactly the metric Cogent says it is built to shorten.

Questions people ask

Who is acquiring Specular?

Cogent, a US startup that uses AI agents to manage and fix vulnerabilities in large companies, announced on 10 November 2026 that it agreed to acquire Specular.

How much is Cogent paying for Specular?

The price was not disclosed. The release also does not state the form of payment or the closing date.

What does Specular do?

According to Cogent, Specular's AI agents probe companies from the open internet, find exposed assets and test how attackers could exploit the weaknesses they find, validating attack paths from the outside in.

Sources

1. Cogent Agrees to Acquire Specular to Strengthen Autonomous Cyber Defense Against Frontier AI Threats (Cogent (PR Newswire), 10 Nov 2026)
2. Cogent Security raises $42M Series A (Cogent, 18 Feb 2026)
3. Peyton Smith, member profile (ONUG, 10 Nov 2026)