The report
AISLE announced on November 10, 2026 that Cohere had completed its acquisition and that the company would operate as Cohere Cyber. The closing statement names Ondrej Vlcek as the new security unit's senior vice president, Jaya Baloo as Cohere's CISO, and Stanislav Fort as vice president of AI Security; it also places a development center for AI cybersecurity in Prague. This is a completed corporate transaction and new operating identity, not merely a proposed partnership or a new intrusion campaign.
Cohere Cyber describes a workflow spanning vulnerability discovery, triage, candidate fixes and verification. Its claimed deployment options range from managed SaaS to private-cloud, on-premises and air-gapped operation, which may alter where source code and sensitive evidence are processed. A private installation does not by itself prove better detection, a safe patch or independent verification of the model's output, although it changes the data-flow and network boundaries that an enterprise can audit.
The vulnerability numbers describe different things
The announcement claims more than 650 discovered CVEs in 14 months. A public product page also displays counts for findings, triage, fixes, deliveries and resolutions, but those are workflow states with possible overlap and different underlying units. Adding them would fabricate a larger discovery count; treating all 650 CVEs as exploitable production incidents or as demonstrably resolved defects would make a different, equally unsupported leap.
A defensible claim of autonomous remediation requires more than a scanner alert and a generated patch. The defect must be reproduced in the affected build, the proposed change must remove the root cause without reintroducing an equivalent path, and regression checks must include the actual release and downstream dependencies. A CVE publication, an internally accepted fix and a patch deployed by customers are separate events. The existing automated-remediation dossier is a different system, but it illustrates why repair outcomes must be measured at the effect boundary rather than inferred from the presence of AI-assisted coding.
Ownership changes the evidence path
Combining a model vendor with a security-research product may shorten iteration between failure discovery and tool improvement, but the public closing statement provides no comparable controlled experiment establishing such savings. It also creates a reason to examine how conflicts, false positives, embargoes and missed findings are disclosed when model development and vulnerability research share an owner. That is a governance question, not an allegation that Cohere Cyber hid a finding.
Neither the transaction's price nor a full migration timetable was disclosed in the source reviewed. The next independent measurement should map identifiable CVE records to reproduced failures, accepted patches and re-tested releases, with deployments and versions distinguished from the product's promotional funnel. Until then, the closing and leadership changes are established, while remediation efficacy and incident reduction remain vendor claims awaiting evidence.