cognium.net

What It Is

Cognium positions itself as “Trust Infrastructure for Code Built by AI Agents.” Its core focus is not traditional point-solution SAST, but a pre-PR verification layer for code generated by AI Agents. It combines semantic SAST, AI Trust Verification, Agent Governance, a Skills Registry, and CI policy orchestration to generate a Trust Score for each change and decide whether to block, require human review, or allow it to ship.

Core Capabilities and Deployment

In terms of protection coverage, Cognium addresses code vulnerabilities, dependency and data-flow semantic analysis, spec drift, known exploit patterns, risk scoring for Agent tools/skills/MCP servers, and audit evidence retention. It can reconstruct what an Agent changed, whether the code behavior matches the stated intent, and summarize vulnerabilities, specification gaps, and compliance issues for reviewers. Deployment is flexible: the open-source CLI can be installed via npm and supports local use, pre-commit hooks, CI, SARIF, and GitHub Code Scanning. The Enterprise edition supports GitHub Enterprise, GitLab, Jenkins, Bitbucket, custom pipelines, and cloud, hybrid, or on-premises deployment. For management, the Trust Score ranges from 0 to 100: 0-39 means block, 40-84 means review, and 85-100 means ship. Teams can start in report-only mode and gradually move to blocking gates.

Pricing and Compliance

Pricing is split into three tiers: the open-source Developer edition is permanently free, with an MIT licensed static engine suitable for individuals and public CI; Pilot is a 30-day customized pilot that includes staging CI integration, threshold tuning, private repository scanning, and weekly reviews; Enterprise uses organization-specific annual pricing based on deployment model, repositories, scan volume, private registries, compliance needs, and support level. On compliance, the main materials mention PCI, HIPAA, SOC 2 workflows/evidence paths, audit trails, and exportable reports, but do not state that Cognium itself has obtained the corresponding certifications.

Pros, Cons, and Best Fit

Its main advantage is that its positioning closely matches a new pain point brought by widespread AI coding: as generation speed increases, security review, intent verification, and compliance evidence become bottlenecks. It can run alongside CodeQL, Snyk, and similar tools, avoiding a rip-and-replace migration. The open-source CLI also makes it easy for developers to first validate signal quality. Limitations include undisclosed commercial pricing, a pilot-oriented platform stage, and limited public information on customer cases, third-party benchmarks, and real-world false-positive rates. In addition, the effectiveness of spec verification depends on whether the team has clear tickets, specs, or runbooks. Cognium is best suited for mid-to-large engineering, security, and platform teams that already use AI coding Agents, private repositories, and CI workflows, and want to bring generated code under compliance governance.

Access in China

The main materials do not disclose information about network accessibility from mainland China, RMB payments, invoices, or local support, so china_access can only be marked as unknown. If access, procurement, or cross-border data transfer is constrained, it is worth first evaluating the open-source CLI and the feasibility of on-premises deployment, and comparing it with CodeQL, Snyk, Semgrep, GitHub Advanced Security, or internal CI security gates.