Global Safety & Security Manager

Cognition's Devin Oncall sends an AI agent to fix production alerts. Cognition's new SRE agent plugs into Datadog, Sentry and Dynatrace to triage alerts, run investigations and open pull requests for fixes. · 4 hrs ago Read 5 min * Cognition launched Devin Oncall, an AI SRE that investigates alerts and opens fixes. * Works out of the box with Datadog, Dynatrace, Sentry and other observability tools. * Already processes thousands of alerts daily for large enterprise customers. * Internal data at Cognition shows under 2% of alerts actually need code changes. * Launch follows Cognition's $2B raise at a $48B valuation and $492M run-rate. * Competes with AWS DevOps Agent and built-in AIOps from Datadog and Dynatrace. Devin Oncall sends an AI agent to production alerts. Cognition has launched Devin Oncall, a product that turns production alerts into tasks for its coding agent. When an observability platform reports an incident, Devin opens an investigation, examines the available telemetry and code, then returns a diagnosis or creates a pull request. The product extends Devin from planned development work into incident response. Cognition wants its agent to complete the initial investigation before an engineer joins, reducing the time spent searching logs, tracing deployments, and identifying the relevant service or repository. Alerts become agent sessions. Devin Oncall sits between monitoring systems and engineering workflows. Cognition lists integrations with Datadog, Dynatrace, Sentry, and other observability platforms. Those systems continue to detect incidents and generate alerts; Oncall consumes the payloads and begins the investigation. * The observability platform sends Devin an alert and its associated context. * Devin opens a session with access to its shell, editor, browser, connected repositories, and permitted infrastructure. * The agent inspects logs, code, recent deployments, and relevant documentation to test possible causes. * Devin posts its findings or prepares a code change as a pull request. * Engineers review the evidence, approve changes, or take over when the incident requires broader judgment. The published workflow preserves existing review, CI, merge, and deployment controls when Devin proposes a patch. That boundary matters during an outage because a pull request is reversible and reviewable, while an automated production change carries a larger operational risk. The same Devin, triggered by production. Oncall uses the existing Devin platform as a new trigger. An alert can open the same kind of coding session that Devin uses for planned work, allowing the agent to move from diagnosis to implementation while retaining the investigation context. Cognition's Model Context Protocol tools expose sessions, playbooks, knowledge, schedules, integrations, and repository documentation. MCP provides a standard interface through which systems can supply tools and context to an AI agent. Oncall builds on that toolset, so runbooks, service documentation, and repository knowledge can guide the incident session. The agent's reach depends on the permissions attached to those integrations. Repository access allows code inspection and pull requests, while access to logs, cloud consoles, deployment history, or secrets creates additional security requirements. Teams will need to apply least-privilege credentials and preserve audit records for every action. Early data shows a triage-heavy workload. Cognition says Devin Oncall already processes thousands of alerts per day for large customers. Its customer profile for document AI company Reducto says the agent serves as the first responder and has reduced the frequency with which engineers receive pages. Cognition also uses the workflow internally, routing Datadog alerts into Slack for Devin to investigate. In a recent presentation, one of its engineers said fewer than 2% of alerts resulted in code changes. The company has not published the sample size, measurement period, or severity mix behind that figure. The under-2% rate indicates that pull requests represent a small part of the workload. Many investigations may end with a false alarm, an operational explanation, a configuration issue, or an escalation that requires human action. Useful evaluation therefore requires more than counting generated patches. Incident response is filling with agents. Cognition is expanding Devin across more stages of software delivery, including code review, automated triage, code scanning, scheduled work, and production support. The company says Devin now writes 89% of its internal pull requests. It has also reported more than $2 billion in funding at a $48 billion valuation, enterprise usage growth above tenfold since the start of the year, and $492 million in run-rate revenue. AWS has previewed a competing DevOps Agent that correlates metrics, logs, and recent deployments to identify likely causes and recommend mitigations. Datadog, Dynatrace, and New Relic also offer AI-assisted root-cause analysis. Cognition's differentiator is the connection to a general coding agent that can inspect a repository, edit code, run tests, and submit the resulting patch. Checks before granting pager access. Production incidents expose an agent to incomplete evidence, rapidly changing systems, and pressure to act. A useful deployment plan should define the agent's scope before alerts begin opening autonomous sessions. | Area | Questions to resolve | | Alert scope | Which services, severities, and alert types can start a Devin session? | | Permissions | Which repositories, logs, cloud resources, deployment systems, and secrets can the agent access? | | Operational context | Are runbooks, service ownership records, dependency maps, and deployment histories current? | | Change controls | Which tests, approvals, protected branches, and deployment gates apply to agent-created patches? | | Escalation | When must Devin page a human, and what evidence should accompany that escalation? | | Evaluation | How will the team measure diagnosis accuracy, escalation rate, time to useful evidence, pull-request acceptance, and reverted changes? | | Data handling | What retention, tenancy, regional processing, and model-training policies apply to logs and source code? | Cognition's announcement does not list public pricing, a complete integration matrix, or a service-level commitment. Deployment architecture, data retention, permission boundaries, and the availability of individual integrations will require confirmation during evaluation. The pager becomes a work queue. Devin Oncall makes production alerts another entry point into an agent-driven engineering workflow. Its practical value will depend on the quality of each diagnosis, the evidence attached to escalations, and the safety of the permissions granted to the agent. Observability platforms supply the signals, while Devin adds investigation and code execution above them. If the product consistently filters routine alerts and prepares credible fixes, on-call engineers can begin incidents with a tested hypothesis and a documented trail instead of an unexplained page.

SecurityHQ research finds an Accountability Gap in how enterprises govern AI agents. 45% of Cybersecurity Leaders Report AI-Related Incidents with Unclear Accountability; meanwhile, only 17% could rapidly reconstruct an agent's actions within minutes of a critical incident. October 15, 2026 13:45 ET | Source: SecurityHQ LONDON, Oct. 15, 2026 (GLOBE NEWSWIRE) - SecurityHQ, the global cybersecurity company pioneering Security Performance Engineering for stronger operational performance and resilience, today published new research, in collaboration with Datadog, the leading AI-powered observability and security platform for cloud applications, identifying a massive disconnect between how enterprises define accountability for AI agents and their ability to establish an agent's recorded actions. "The Accountability Gap: The State of AI Agent Security and Governance 2026" surveyed 204 cybersecurity leaders at midsize and large organizations. Of the respondents, 76% said their organization has formally defined accountability for AI-driven operational or security decisions. At the same time, 45% have already experienced an incident involving AI agents or automation where accountability was unclear. The challenge is becoming more urgent as agents gain greater access across enterprise environments. 51% of respondents said AI agents already operate broadly across their organizations, and 93% expect agents to access enterprise systems more frequently than humans within five years. "Most security teams can see that agents are working. Far fewer can explain what an agent did, in what sequence, and under whose authority. Those are the questions that matter when something goes wrong," said Feras Tappuni, CEO of SecurityHQ. "Defining accountability in a policy document is the easy part. It has to hold up in the hour after an incident, when the facts are incomplete, the business needs answers, and someone has to decide what to isolate and who has the authority to act." The findings show that many organizations still lack the visibility to answer those questions quickly. Only 49% said they could fully reconstruct every action an AI agent performed over the previous 30 days. Following a critical incident, 17% could reconstruct that activity within minutes. 51% would need hours, 23% would need days, and 9% would need longer or were unsure. "Enterprises are adding a new class of actor to their infrastructure, and most observability was designed around people and the services they run," added Tappuni. "Agents need the same level of instrumentation. When teams can see what an agent touched and when, in real time, questions about accountability become answerable." That visibility becomes more complicated when agents operate outside approved processes. Nearly half of respondents (49%) believe someone inside their organization may already be running an unapproved AI agent. Among those respondents, 51% said the activity spans multiple teams. "The fundamentals are identity, permissions, logging, and being able to follow an agent across systems that were not designed to be read together," said Aaron Hambleton, Senior Vice President of Product & Services at SecurityHQ. "That operational context is what allows security teams to reconstruct what happened to make smart and defensible decisions quickly. Without it, the first hours of an incident can be wasted assembling the timeline." The research also found a clear expectation that human judgment will remain part of consequential decisions involving AI agents. 99% of respondents identified at least one category in which human review should remain mandatory, led by financial approvals at 61%. About SecurityHQ SecurityHQ is a global cybersecurity company that helps organizations engineer, measure, and continuously improve the performance of their security operations. Founded in 2003, the company delivers flexible and technology-agnostic solutions through its Security Performance Engineering approach. Built around each customer's environment, the approach brings together managed detection and response, threat and adversary intelligence, exposure management, and advisory services. With 400+ analysts and engineers across six global SecOps Centers, SecurityHQ provides 24/7 human-led detection, response, and continuous improvement. Its work is focused on reducing noise, improving decision-making, and strengthening security performance over time.

Berlin-based OllyGarden has raised $4 million to reduce unnecessary software telemetry data. The funding round included participation from Datadog, Grafana Labs, and Dash0 — companies that typically charge based on data volume. The startup addresses a growing problem: AI-generated code creates significantly more telemetry logs, metrics, and traces. This "noise" undermines AI agents that analyse such data, producing unreliable results. OllyGarden's solution includes Rose, an AI agent that examines OpenTelemetry code and suggests improvements. The company claims it has helped firms reduce log volume by up to 85%. CEO Juraci Paixão Kröhling sits on the OpenTelemetry governance committee and previously worked at Red Hat and Grafana Labs. The 10-person team secured this funding following a $1.6 million pre-seed round in July 2025, bringing total capital raised to approximately $5.6 million.