Cohere Intends to Acquire AISLE for Cybersecurity Expansion

Cohere has signed a letter of intent to acquire AISLE, a startup that uses AI to identify vulnerabilities in software, the two companies announced on Thursday, October 15. The value, structure, and closing date have not been disclosed. The letter is non-binding: the deal still relies on definitive documents and may change or not materialize.

The management structure has already been defined. Ondrej Vlcek, CEO of AISLE and former CEO of Czech antivirus Avast, will become senior vice president of Cohere Cyber, the new division that will sell security tools to governments and enterprises. Jaya Baloo, co-founder of AISLE, will take on the role of global CISO at Cohere. Stanislav Fort, the third co-founder, will move to research on models as vice president of AI security, according to Cohere’s announcement.

What Cohere is Acquiring

AISLE has around 50 full-time employees, all of whom are set to transfer to Cohere, the startup's spokesperson told BetaKit. The core asset is a reasoning system that autonomously searches for flaws in source code.

The company claims to have discovered over 500 previously unknown vulnerabilities across more than 100 codebases in the past year. It also states that its system identified 18 of the 24 vulnerabilities patched in version 8.23.0 of curl, a data transfer library found in virtually all servers and connected devices. These numbers are reported by AISLE itself and have not been audited by third parties. Nevertheless, they highlight open-source code libraries that support a significant portion of commercial infrastructure, rather than handpicked targets.

Sovereignty as a Selling Point

Cohere does not compete with OpenAI and Anthropic in the consumer space. It sells models that operate within the client’s infrastructure to banks, governments, and regulated companies that do not want data leaving their own perimeter. The acquisition of AISLE reinforces this thesis from another angle: a government that already hesitates to send documents to an American API is even more reluctant to share the source code of its critical systems.

The operation also enhances the Canadian firm's presence in Europe. In September, Cohere signed a merger agreement with the German company Aleph Alpha, in a transaction that media outlets estimated to be around $20 billion. With AISLE, it gains an engineering hub in Prague: the startup’s headquarters will become Cohere’s office in the city, and the firm has promised substantial investment to transform it into its global center for AI cybersecurity systems.

There is a discrepancy regarding the origin of AISLE. Reuters described it as a startup from San Francisco; the company's own blog and Canadian media point to Prague as its headquarters. AISLE operates in both locations, and what is relevant for the corporate reader is that the engineering center Cohere is set to expand is in the Czech Republic.

The Market Across Three Countries

In Canada, the deal strengthens the local contender for national AI champion, which already includes the merger with Aleph Alpha and now a security division. For Canadian public sector clients, a domestic supplier with its own security division simplifies purchasing processes that currently require justification for reliance on American vendors.

In Germany and Central Europe, the channel involves suppliers of critical infrastructure subject to the NIS2 directive, which mandates operators in energy, transport, health, and finance to manage software supply chain vulnerabilities. A European flaw discovery tool, coupled with a model that can run on local cloud, meets a concrete regulatory requirement as well as a political preference.

In the United States, the perspective is competitive. AI-powered code scanning tools have become off-the-shelf products in major security platforms and labs like OpenAI and Google, and Cohere is entering this segment late. The strategy is to sell the combination of a private model with vulnerability research to those who cannot use the alternatives hosted by competitors.

The announced structure places Baloo in charge of Cohere’s own security while the division sells security externally. This accumulation is likely to be scrutinized by public sector clients, who often demand a clear separation between those who protect the house and those who profit from the product. Before that happens, however, Cohere needs to turn a letter of intent into a signed contract, and neither company has indicated a timeline for this step.