Cohere’s AISLE Deal Is Really a Cybersecurity Bet
Matthew Leo · Published October 23, 2026 · News
Canadian AI company Cohere is moving beyond model development and into software security. On October 15, Cohere and AISLE said they had signed a letter of intent for Cohere to acquire the young cybersecurity company. If the transaction closes, AISLE’s Prague headquarters would become Cohere’s Prague office and its founders would take senior security roles.
The wording matters: this is a preliminary agreement, not a completed acquisition. Neither company disclosed a price, closing date or regulatory conditions. That makes the immediate story less about financial scale and more about what Cohere is trying to assemble.
What Cohere would be buying
AISLE builds systems that search source code for vulnerabilities, validate findings and propose fixes. The company says it discovered more than 500 previously unknown vulnerabilities assigned CVEs across more than 100 codebases during its first year. It also says its work accounted for all 12 vulnerabilities in OpenSSL’s January security release and 18 of the 24 CVEs in cURL’s latest release.
Those are unusually concrete claims for an AI-security vendor because the underlying projects and vulnerability records can be examined. They still do not prove that the same performance will transfer to every private codebase, language or deployment. Buyers would need to ask about false positives, missed vulnerabilities, patch quality, reproduction steps and the human review required before a fix is merged.
Under the proposed structure, AISLE chief executive and Avast co-founder Ondrej Vlcek would become senior vice-president of a new Cohere Cyber unit. Jaya Baloo would become Cohere’s global chief information security officer, while Stanislav Fort would lead AI-security research and connect it with Cohere’s model-development work.
The sovereign-AI connection
Cohere sells enterprise models that can run privately on a customer’s own infrastructure. Reuters reports that the planned acquisition is aimed at enterprise and public-sector clients, including deployments kept on the customer’s systems. That fits Cohere’s broader sovereign-AI pitch: organizations can control where models and sensitive data run instead of sending everything to a public service.
Adding vulnerability discovery could make that pitch more useful, but it also creates a new trust question. A tool that inspects proprietary source code may see credentials, security assumptions and unreleased products. Canadian governments and regulated companies should therefore evaluate where scans run, what telemetry leaves the environment, how findings are retained and whether the vendor can train on customer code.
What customers should verify
Before treating Cohere Cyber as a replacement for established application-security tools, buyers should ask for evidence against their own languages and repositories. A useful pilot would compare confirmed findings, false positives, remediation time and regression failures against the organization’s current static analysis, dependency scanning and manual review.
The proposed combination is also not a reason to remove approval gates. AI-generated patches can be valuable, but changes to authentication, memory handling or cryptography still need reproducible tests and accountable human review. Mapletechie’s guide to approval gates for AI agents provides a practical model for those controls.
The acquisition could give Cohere a credible cybersecurity product rather than another generic AI feature. The evidence to watch is whether the companies publish repeatable results, preserve customer control and show that suggested fixes remain secure after deployment.
Sources
Tags: Cohere, cybersecurity, AI governance, Canada