What is Cohere actually buying when it buys AISLE? In short: a small team whose AI systems, according to Cohere, discover, validate and help remediate previously unknown vulnerabilities in critical software. Cohere announced a proposed agreement to acquire AISLE, the company building autonomous systems to discover and remediate previously unknown vulnerabilities in critical software. The deal, reported by Cybersecurity Insiders, also creates a new unit called Cohere Cyber.
Why does an AI model company want a security startup? Because Cohere's pitch to enterprises and governments is "sovereign AI" — AI that an organization can run and control on its own terms. That pitch only works if the software underneath is secure. Buying the team that finds zero-day flaws is one way to make that argument credible. The deal is also Cohere's continued investment in Europe, following its acquisition of Reliant AI and its partnership with Aleph Alpha.
For readers new to this space, the story touches three ideas worth unpacking: sovereign AI, zero-day vulnerabilities, and autonomous security research. Each term explains a different part of the deal, and together they explain why a model vendor is hiring vulnerability hunters. More background on the wider market sits in our AI & Machine Learning coverage.
What is sovereign AI, and why does security keep coming up with it?
Sovereign AI is the idea that organizations — especially governments and regulated industries — should keep control over their AI strategy, data, infrastructure and governance, rather than depending entirely on a foreign vendor's cloud. Cohere has long argued that position. The company says it combines frontier AI models, agentic applications, secure deployment infrastructure and advanced security capabilities so organizations can deploy AI with confidence.
Security enters the picture because moving AI from experimentation to production raises hard requirements: data protection, governance, regulatory compliance, software vulnerabilities and the risks of more autonomous AI systems. Customers also want the flexibility to run AI in private cloud, on-premises, or fully air-gapped environments — setups with no internet connection at all — without giving up control. A model that cannot be deployed securely is not deployable at all in those settings. Our cybersecurity section tracks how these requirements shape buying decisions.
What does AISLE actually do?
AISLE was founded in 2024 and builds AI systems that discover, validate and help remediate previously unknown vulnerabilities in complex production software. Its approach combines foundation models with specialized security expertise, large-scale code analysis, rigorous validation and automated remediation.
The track record is the striking part, though it comes from Cohere's own announcement and has not been independently audited. According to the company, in its first year out of stealth AISLE discovered more than 500 previously unknown vulnerabilities assigned CVEs — the public identifiers given to confirmed security flaws — across more than 100 codebases. That includes, per Cohere, all 12 vulnerabilities in OpenSSL's January security release and 18 of the 24 CVEs in curl's latest release. Flaws in projects like OpenSSL and curl matter because the vulnerabilities were confirmed in the projects' own security releases.
One detail matters for how you read those numbers: according to the announcement, the vulnerabilities were independently reviewed by the relevant software maintainers. They are not self-reported claims. They are real zero-days — flaws unknown to the vendor until reported — confirmed by the projects themselves.
Why an AI company cares about vulnerability hunting
Cohere frames the deal as more than a security bolt-on. The company argues that a foundation model's capabilities and the specialized system built around it can reinforce each other. By bringing AISLE's autonomous security research closer to Cohere's frontier-model development and training, Cohere sees an opportunity to build more capable cybersecurity systems — and to use difficult, verifiable security problems to evaluate and improve future models. Security research is attractive for model training because a found vulnerability is either real or it is not; there is little room for a model to bluff. We covered a connected angle in Entry Level Cybersecurity Jobs: The Real First Rungs of the Ladder. For related coverage, see Entry Level Cybersecurity Jobs: The Real First Rungs of the Ladder.
Who is running the new unit, and where?
AISLE's team joins Cohere, and its three founders take leadership roles spanning cybersecurity, corporate security, AI security research and frontier model development. The named roles:
- Ondrej Vlcek becomes Senior Vice President, Cohere Cyber, leading the newly established global cybersecurity business.
- Jaya Baloo becomes Cohere's Chief Information Security Officer, leading security across the company.
- Stanislav Fort becomes Vice President, AI Security, joining core model research and training and leading AI security research.
Cohere also plans a substantial long-term investment in Prague, expanding AISLE's existing presence there and establishing the city as its global center for AI cybersecurity and autonomous security systems. That deepens Cohere's European footprint, which the company says strengthens capabilities protecting critical infrastructure, governments and highly regulated industries.
What does this change for customers?
For enterprises and public sector buyers, the combined capabilities are expected to enhance four things: security and threat detection across deployments; governance, monitoring and observability for AI agents and autonomous workflows; protections for sensitive organizational data and mission-critical systems; and support for secure deployments across private cloud, on-premises and fully air-gapped environments. Cohere also wants to advance cyber-resilient AI systems that can identify, prioritize and respond to emerging threats.
Keep the framing sober, though. This is a proposed agreement, not a closed deal, and the customer benefits are what Cohere expects, not measured results. The concrete evidence today is AISLE's vendor-reported CVE track record and the founders' assigned roles. Everything else — how well autonomous remediation works inside a model vendor's platform — remains to be shown.
The context a newcomer needs: AI is now on both sides of the attack
The deal lands at a moment Cohere itself describes bluntly: increasingly capable AI systems are transforming both cybersecurity and the threats organizations face, and defensive capabilities must advance just as quickly. As AI becomes embedded in critical workflows, securing the software those systems depend on becomes as important as the models themselves.
That is the strategic bet in one sentence: combine autonomous vulnerability research with frontier models and a sovereign AI platform, and make discovering, validating and fixing software flaws a continuous, scalable capability. Whether that bet pays off operationally is the question to watch. For security teams, the near-term takeaway is simpler: watch whether AISLE's discovery rate holds after the acquisition, and treat vendor claims about "cyber-resilient AI" as claims until the CVEs say otherwise. For more on how security work is staffed and paid in practice, see our guides to the cybersecurity analyst's day, tools and alerts and what moves a cybersecurity salary. For related coverage, see The Cybersecurity Analyst: The Day, the Tools and the Alerts.
