The deal. On October 28, Corridor said it is joining Cognition, the company behind the Devin coding agent and the Windsurf editor. Corridor’s team and product fold into Devin Security. Price and terms: Undisclosed. Corridor had raised about $30.4 million, including a $25 million Series A at a $200 million valuation led by Felicis in March. Its co-founders, Jack Cable and Ashwin Ramaswami, both worked at CISA, the US cyber agency. They reunite with Alex Stamos, who backed Corridor’s seed, ran its security, and became Cognition’s chief security officer about a month before the deal.
What Corridor did, in plain words. AI coding agents like Cursor, Claude Code and Codex now write thousands of lines at a time. Corridor sat inside that loop. It warned the agent while it was writing, scanned changes before they became a pull request, and could block a merge if a flaw was serious enough. Security teams wrote rules in plain English, like “every API route must check the user’s permissions,” and Corridor turned them into checks for that codebase. Think of it as a building inspector who stands on the site, not one who shows up after the walls are closed.
Why the buyer matters more than the price. For a decade, the exit path for an AppSec startup ran to a security platform, the Palo Alto Networks or Snyk of the world. Corridor went to the company that writes the code. That’s a new kind of buyer, and it has money. Cognition raised $2 billion at a $48 billion valuation in September. Two days before the Corridor news, it launched Devin Security 2.0, which runs scans with Claude Mythos and other frontier cyber models, then has Devin reproduce each bug, write the fix and test it in its own virtual machine. Cognition says it’s committing hundreds of millions of dollars in Devin credits, including free scans, to win enterprise security teams.
Read one feature closely. Devin Security can now ingest findings from Snyk, Wiz or a CSV file and re-triage them. That turns the scanner into a feed and Devin into the place where the work gets done. Whoever owns the fix owns the customer relationship. Scanners that only find problems just got demoted to inputs.
Best-of-breed or platform? Here the platform has a real edge. The cheapest moment to stop a bug is the second it’s written. The company that owns the agent owns that moment. A separate tool has to plug in through an integration the agent maker controls. Corridor already integrated with Devin through MCP, the standard way agents call outside tools. Cognition decided it would rather own the integration than rent it.
The catch nobody has answered. Corridor’s value to buyers was neutrality. It worked across Cursor, Claude Code and Codex. Most large companies run more than one coding agent. Cognition hasn’t said whether those integrations keep the same support, how pricing changes for existing customers, or when Corridor’s controls land inside Devin. It also hasn’t published benchmarks for detection quality, false positives or fix quality. The seller of the car now also sells the brakes. That can work. It also means the brakes might work best on one car.
The pressure is real. Cognition’s own launch post shows why this matters. The curl project received 356 security reports in 2026 through October 22, compared with 181 in all of 2025. AI finds bugs faster than humans can fix them. Whoever closes that gap gets paid.
Where I land. This is a talent-and-position deal, not a revenue deal. Expect more of them. Every serious coding-agent company will want its own security layer, and the AppSec startups with agent-native tech are the shopping list. For founders, the exit market just widened. For CISOs, the move is simple: let the agent vendor secure its own output, but keep one independent check at the merge gate that you own. And get the multi-agent support commitment in writing before you renew.