Cohere, the Toronto-based model maker, said on October 15, 2026, that it plans to buy AISLE, an AI security start-up,, a Prague start-up whose AI systems find and patch security flaws in widely used software. The Cohere AISLE acquisition is a letter of intent, not a closed purchase, and no price was disclosed. What Cohere customers in Canada get, and when, depends on terms neither company has published.
- AISLE says its systems found more than 500 vulnerabilities that were assigned CVEs, across more than 100 codebases, in its first year.
- Cohere plans a new unit, Cohere Cyber, led by AISLE’s CEO, and will make AISLE’s co-founder Jaya Baloo its global chief information security officer.
- Neither company has said when the deal will close or what AISLE customers should expect in the meantime beyond “continuity.”
Most AI security products sold today check how a model behaves: prompt injection, data leaks, unsafe outputs. AISLE works on a different problem. It points AI systems at ordinary software, finds flaws nobody knew about, proves they can be exploited and proposes a fix. A Canadian model maker buying that capability says something about where Cohere thinks enterprise buyers will spend. Agent security is the other Canadian angle, as OpenAI Astra agent security shows.
What AISLE does
In the companies’ words, AISLE builds “autonomous AI systems capable of discovering and remediating vulnerabilities in critical software.” The workflow, as AISLE describes its platform, runs from discovery to triage to a verified fix before code is merged. A CVE is a public identifier assigned to a confirmed security flaw, so a CVE count means a maintainer or a numbering authority accepted each finding as real.
The two examples both companies cite: all 12 vulnerabilities in OpenSSL’s January security release, and 18 of the 24 CVEs in curl’s latest release. Cohere’s announcement says these findings “are independently reviewed by the relevant software maintainers.”
What the Cohere AISLE acquisition changes
“Ondrej Vlcek will become Senior Vice President, Cohere Cyber, and will lead the newly-established global cybersecurity business. Jaya Baloo will become Cohere’s Chief Information Security Officer, leading security across the company.”
Cohere emphasizes two things: a new security product line for customers, and Europe. It names its earlier acquisition of Reliant AI and its partnership with Aleph Alpha, and says it will make “a substantial long-term investment in Prague.” The third co-founder, Stanislav Fort, will lead AI security research inside Cohere’s model training work. AISLE’s post adds that its Prague headquarters will become Cohere’s Prague office.
What neither post covers: price, closing date, product names, plans, or whether Cohere Cyber will run inside private and on-premises deployments, the deployment options Cohere promotes to regulated customers.
What the vendors measured, and what others found
The CVE counts are the strongest evidence here, because each one passed review by someone outside the company. They measure discovery. They do not show the false-positive rate a customer would see on its own code, how many proposed patches maintainers accepted unchanged, or how long a scan of a large private codebase takes. We have not seen independent numbers on any of those.
What we ran and what we didn’t
We read both companies’ announcements and AISLE’s platform pages. We did not run AISLE’s tools, and we did not check the CVE counts against the OpenSSL and curl advisories ourselves.
The Limitation
Nobody outside AISLE has published how its system performs on private enterprise code. Open-source projects like curl and OpenSSL are public, heavily studied and maintained by experts who can confirm findings quickly. A bank’s internal systems are none of those things. A published result on a private codebase, with false-positive and patch-acceptance rates, would remove this limit.
What would change our mind
A closing announcement that names a Cohere Cyber product, its deployment options and its price would make this a buying decision rather than a watch item. We expect more detail when the deal closes. The companies said only that they “will share more details as the transaction progresses.”
For context on Cohere’s European strategy, see our earlier piece on sovereign AI in Canada, Cohere and Aleph Alpha. More Canadian company coverage is in Canadian AI Spotlight. Cohere’s chief has also argued the AI slowdown is a cartel, which gives context for this deal.
A buyer’s test
If you are a Cohere customer, send your account team three written questions: will Cohere Cyber run in your current deployment type, will code scanned stay inside your environment, and what is the false-positive rate on a codebase like yours. Pass if you get a written answer to all three, with a named product and timeline, within 30 days. If not, keep your current code-scanning tools and check again at closing.
FAQ
Is Cohere buying AISLE?
Cohere and AISLE signed a letter of intent on October 15, 2026, for Cohere to acquire AISLE. The deal had not closed at announcement, and no price was disclosed.
What does AISLE do?
AISLE builds AI systems that find previously unknown security flaws in software, check that they are real and propose fixes. It says it has found more than 500 vulnerabilities assigned CVEs.
What is Cohere Cyber?
A new Cohere unit, to be led by AISLE CEO Ondrej Vlcek, focused on bringing cybersecurity products to Cohere’s customers. Product details have not been announced.
