Turning AI security research into a developer-facing security platform
Visit Cortex↗Executive Summary
Modern software development is increasingly AI-assisted. Developers can generate large portions of an application in minutes, but an application that compiles and appears to work can still contain weaknesses in authentication, authorization, architecture, data handling, dependencies, or business logic. Cortex began as research into applying AI to security and evolved into a complete engineering system for analyzing application codebases. Rather than treating security as a collection of isolated scanners, Cortex was designed to reason about an application across several dimensions and combine those observations into a structured security assessment.
The Challenge
Application security is inherently fragmented. One tool may identify vulnerable dependencies, another may search for exposed secrets, another may perform static analysis, while architecture and authorization problems often require human reasoning. The challenge was to make these different forms of analysis work together without reducing the entire system to a single opaque LLM request. Cortex needed specialized analysis stages that could focus on different security concerns while still sharing context. Findings also needed to persist across the scan so downstream analysis could build on information discovered earlier. Beyond the AI pipeline itself, the product required authentication, persistent state, repository ingestion, report generation, developer workflows, and infrastructure capable of turning research concepts into something engineers could actually use.
The Approach
We designed Cortex as a multi-agent sequential analysis pipeline. Specialized stages perform focused analysis across areas including security vulnerabilities, application architecture, code quality, technical debt, and AI-generated code patterns, followed by a synthesis stage that combines the observations into a coherent assessment. Shared scan state is persisted in PostgreSQL so information discovered by one stage remains available to later stages rather than disappearing with an individual model call. Around that analysis engine, we built the conventional software infrastructure required by a real developer product: authentication, workspace isolation, model-provider abstraction, persistent application state, reporting, CLI workflows, Git-oriented development flows, and remediation guidance. This architecture intentionally treats AI as one component of the system rather than the entire system. Models provide reasoning where reasoning is useful; conventional engineering provides persistence, orchestration, security, isolation, and deterministic application behavior.
The Impact
Cortex evolved from an AI security research concept into a complete developer-facing security platform. The system can analyze a codebase through multiple specialized perspectives and turn those observations into structured findings rather than a generic model response. More importantly, the project demonstrated an approach to AI engineering that extends beyond prompting: persistent state, orchestration, provider abstraction, security boundaries, developer tooling, and product workflows all become part of the system. Cortex therefore became a practical example of translating research into production-oriented engineering — using AI where it provides leverage while relying on conventional software engineering for everything required to make the platform reliable and usable.
What’s sitting on your engineering backlog?
Give us one task. We’ll take it from scope to production while your team keeps building the core product.