Cognition's Devin Review Now Catches Security Flaws Every Scanner Misses

Devin Review just got a significant upgrade: every pull request you open now automatically receives a full security review. Not a linter pass, not a dependency CVE check -- a deep, reasoning-level analysis of how your code actually behaves at runtime. Cognition is betting that as AI agents write more code faster, the security review layer needs to keep pace, and static pattern-matching tools simply cannot.

The timing is deliberate. AI coding assistants have accelerated output, but security review still depends heavily on deterministic scanners that miss important flaws -- and reports tracking AI-authored vulnerabilities show that faster generation often produces less safe software. Devin is now trying to be both the agent that writes the code and the one that catches what it missed.

What pattern-matching scanners miss by design

Traditional SAST tools (Static Application Security Testing -- tools that analyze source code without running it) work by matching code against known vulnerability signatures. They are fast and reliable for catching CVEs in dependencies and obvious injection patterns. But they evaluate lines in isolation, which means they are structurally blind to a whole class of bugs.

Devin reads your codebase and reasons across the full repository, understanding your auth model, business logic, and service interactions to catch what pattern-matching misses by design. The canonical example Cognition gives: a password-change endpoint that looks perfectly valid in isolation, but allows a full account takeover because a missing token quietly creates a guest session that reaches the handler. No scanner catches that without tracing the full request path through the auth layer.

The vulnerability classes Devin targets that scanners miss:

• Broken authorization: endpoints that appear correct in isolation but allow privilege escalation through unexpected session or token flows
• Business-logic flaws: a refund that returns more than was paid, or a discount code that can be redeemed repeatedly
• Chained findings: individually low-severity issues that combine into a critical exploit path

From finding to fix, without leaving the review

Each finding comes classified by severity, tagged with a CWE ID (Common Weakness Enumeration -- a standardized catalog of software vulnerability types), and grounded in your actual codebase. That last part matters: the explanation traces the exact path through the code that makes the issue exploitable, not a generic description of the vulnerability class.

Beyond just flagging the issue, Devin also writes the fix and opens it as a merge-ready PR, so it arrives as code ready for an engineer to review instead of a ticket that waits weeks in a queue. You can also ask follow-up questions like "are there other places in the codebase where this pattern appears?" and Devin investigates across files. One click posts the finding as an inline GitHub comment, keeping the whole workflow inside code review.

The real problem this solves

As coding agents proliferate, the number of PRs increases, but the quality of that code can be mixed, and the size of each PR is increasing past maintainers' ability to understand. Customers are reporting that code review -- not code generation -- is now the bottleneck to shipping great products. Security review is the most expensive part of that bottleneck: it requires the most context, takes the longest, and is the easiest to skip under deadline pressure.

Cognition's own data shows the scale of the problem. Itaú used Devin to resolve roughly 70% of SonarQube, Fortify, and Veracode vulnerabilities automatically -- clearing a large backlog across scanner findings without bypassing existing review controls. And in a real-world supply chain test, when a malicious version of axios shipped with a hidden dependency masquerading as crypto-js, Devin Review flagged it for multiple customers about 45 minutes after publication -- pinpointing the new dependency, the broken-CI publishing pattern, and the impersonator package, and recommending the PR not be merged.

Where it still falls short

The honest caveat: LLM-based systems often raise recall while also driving up false positives, and hallucination and reasoning reliability remain limiting factors because LLMs can generate plausible security explanations without being able to confirm production reachability. Devin cannot tell you whether a flagged code path is actually reachable in your production environment -- that requires runtime context no static analysis tool has.

It also does not replace your existing scanner stack. Devin does not replace your scanners, SIEM, EDR, or other detection systems -- it acts on their output. Think of it as the reasoning layer on top, not a replacement for the signal layer underneath.

Availability and pricing

Security review is live now and included automatically in every PR opened through Devin Review -- no extra configuration or routing required. It runs inside the code review workflow engineers already use, meaning no new tools or context switching.

Devin Review is part of the broader Devin platform. Devin's entry price dropped from $500/month to $20/month in 2026. The Core plan starts at $20/month on a pay-as-you-go model using Agent Compute Units (ACUs) at $2.25 each, where one ACU represents roughly 15 minutes of active Devin work. The Team plan at $500/month includes 250 ACUs at a slight discount and adds parallel sessions, API access for CI/CD integration, and structured pull request workflows. Enterprise pricing is custom and includes VPC deployment and SAML SSO.

The practical implication: if your team is already using Devin Review for code quality, you are getting security analysis on every PR at no additional cost or workflow change. For teams not yet on Devin, this is a meaningful reason to evaluate it -- especially as AI-generated code becomes a larger share of what ships to production.