Cosine Launches AI Security Tool for SMEs, Mid-Market

Cosine, a YC W23 alumnus, has launched an AI-powered security tool designed to identify vulnerabilities in codebases and live systems. It aims to address a gap in the market where sophisticated cyber-focused AI models are typically gated for large enterprises, leaving small to medium-sized businesses (SMEs) and mid-market companies underserved.

Many existing AI cyber tools are described as mere wrappers around foundation models, inheriting their built-in guardrails and refusal mechanisms. This limits their effectiveness in adversarial security tasks, where an AI needs to think like an attacker to uncover weaknesses.

To overcome this, Cosine post-trained an open-weights model, Kimi K2.6, on a decade of capture-the-flag (CTF) contest data. This specialized training involved supervised fine-tuning (SFT) on CTF writeups and reinforcement learning (RL) with verifiable rewards against actual exploit checks.

The tool offers two primary modes via a command-line interface (CLI). The "Security scan" provides a read-only audit of a local codebase, reporting specific vulnerabilities tied to file and line numbers, avoiding vague findings.

The "Pen test" mode, currently gated, operates as an active adversarial agent within a sandboxed environment. It demonstrates vulnerabilities by executing exploits and showing the exact requests sent and responses received, rather than relying on confidence scores.

"It proves each vulnerability by running the exploit and showing the request it sent and the response your code gave back, not a confidence score."

As a demonstration, Cosine pointed its scanner at Google's open-source "Bank of Anthos" application, identifying an integer overflow vulnerability in the transfer path, alongside common authentication and secrets issues. This example allows users to replicate the scan independently.

The CLI is distributed as a local binary, processing code locally before sending context to Cosine's inference API over TLS. Installation is free, and users can run scans up to 2 million tokens without charge, with token-based pricing thereafter.