The force multiplier effect. Cotool lets a lean security team operate at a scale that would normally require a much larger headcount. The agent framework is genuinely flexible: we've built everything from automated SAST triage that routes confirmed findings to code owners in Slack, to a threat intel monitor that chains into our IR playbooks. The GitOps workflow (agents and skills managed via PR review with GitHub Action validation) means we ship agent changes the same way we ship code — no untracked UI edits. And the team behind it is the best vendor relationship we have: biweekly syncs, they take feedback seriously, and they actually build what we ask for. Review collected by and hosted on G2.com.

Frontier model providers (OpenAI, Anthropic) are adding increasingly aggressive "cyber refusal" guardrails that occasionally block legitimate defensive security agent runs. Not Cotool's fault, but it's a real friction point when an agent refuses to execute a task it's run successfully before. They're actively working on provider failover and open-source model hosting to address it. The threat hunt product is also still maturing — early classification can conflate "this threat is relevant to your environment" with "you're actively compromised," which creates noise. But they're transparent about it and tuning actively, which is more than I can say for most vendors. Review collected by and hosted on G2.com.