The Day Devin
Opened a Door to Government
Government AI adoption has long stalled behind a high wall of security review. Cognition AI, maker of the autonomous coding agent Devin, just cleared a new step on one of those walls — FedRAMP. It's not relevant to consumer-facing products, but for vendors chasing federal contracts, it's a meaningful move forward.
What "In Process"
Actually Means
Cognition AI, maker of the autonomous coding agent Devin, has disclosed that its platform reached "In Process" status under FedRAMP's new 2026 "Class D" category (the successor to the old "High" baseline), and was listed on the FedRAMP Marketplace. In parallel, "Devin Desktop (FedRAMP)," delivered via Palantir's FedStart cloud platform, was listed on AWS Marketplace — giving Cognition simultaneous paths through FedRAMP Moderate/High, DoD Impact Levels 4 and 5, and ITAR.
What's worth flagging: "In Process" is not the same as full authorization. Under FedRAMP's 2026 consolidated rules, the old Low/Moderate/High impact tiers were replaced with Classes A through D, and Class D demands roughly 410–421 controls — the most rigorous baseline in the program. "In Process" means an agency sponsor and third-party assessment organization (3PAO) are actively reviewing the platform; Devin has not yet reached the finish line.
| Before (private-sector focus) | After reaching In Process |
|---|---|
| Deals centered on private enterprise contracts | Procurable via AWS GovCloud and the FedRAMP Marketplace |
| Every agency needed its own security review | A foundation exists for agencies to reuse one authorization |
| Track record built mostly on private dev teams | Pilots running inside the Army, Navy, Treasury, NASA JPL |
| Legacy system migration stayed largely manual | COBOL modernization pushed jointly with channel partners |
Hiring alone can't close the talent gap in aging government systems. Cognition CEO Scott Wu reportedly told Bloomberg Law that recruiting and training specialized engineers at the scale needed would take decades.
FedRAMP Authorization
Runs in Four Stages
Where Devin sits today is still the middle of the road.
Ready
The cloud service provider assembles documentation and implements required controls ahead of formal review.
In Process (current)
A sponsoring agency and a third-party assessment organization (3PAO) verify the actual control implementation. Class D requires roughly 410–421 controls, and this is the stage Devin is being reviewed under.
Authorized
An Authorization to Operate (ATO) is issued and the platform can formally call itself "FedRAMP Authorized." Only then can every agency adopt it at once.
Coding-Agent Vendors
Are Racing for Government
Devin's step wasn't an isolated event — a rival moved the same week.
Just six days earlier, on July 7, 2026, Anthropic put Claude Code and Claude Cowork into public beta inside a FedRAMP High authorized environment, extending access across all three branches of the federal government. Devin reaching Class D "In Process" right after that shows multiple coding-agent vendors lining up for the same federal procurement window at roughly the same time.
Underneath this is a structural problem: much of the government's aging core infrastructure — often COBOL running on mainframes — can't be modernized through hiring alone. Cognition had already set up its go-to-market for this: a strategic partnership with federal reseller Carahsoft, announced June 3, 2026, focused on jointly selling COBOL-to-modern-language transformation and mainframe migration. The FedRAMP progress now gives that sales motion real ammunition.
Pilots Are Already
Running in the Field
The named customers — Army, Navy, Treasury, NASA JPL — are real, specific organizations.
Core system COBOL migration
The joint proposal with Carahsoft targets reading and rewriting legacy mainframe assets into modern languages — work at a scale human teams alone struggle to finish, with Devin handling the bulk of it.
Army, Navy, Treasury, NASA JPL
Cognition itself states its platform is already used across these organizations and defense partners including Anduril, Palantir, and SNC — much of it reportedly still at the pilot stage.
A separate IL4/5, ITAR path
"Devin Desktop (FedRAMP)," delivered via Palantir FedStart, is listed on AWS Marketplace — a separate high-security channel for defense and regulated-industry use cases outside FedRAMP proper.
Who Should Act,
and What's Still Unproven
The direct beneficiaries are vendors and systems integrators chasing government contracts. Procurement leads and PMs who previously ruled Devin out for lacking FedRAMP status can now formally fold it into evaluation, citing the "In Process" milestone. Partners with existing government channels, like Carahsoft, now have a concrete argument to put Devin into their proposals. Consumer-facing product teams, by contrast, have little reason to change their priorities over this.
Three concrete actions follow. First, business and PM leads working government deals should track when Devin actually reaches full Authorized status (ATO issuance) rather than treating "In Process" as the finish line. Second, companies that already hold federal channels like Carahsoft should add Devin to their shortlist for COBOL and mainframe migration engagements. Third, teams with IL4/5 or ITAR requirements should separately confirm the scope of the Palantir FedStart-delivered "Devin Desktop," since that path runs outside FedRAMP proper.
None of this should be read as unqualified good news, though. "In Process" is only a review-in-progress status; it can stall if a sponsoring agency withdraws or gaps in controls surface. No standard timeline for completing Class D authorization has been published, and the gap between this milestone and an actual production contract could still run months. It's also worth noting Cognition raised $1B at a $25B valuation in May 2026 — a track record in the federal market carries real weight for the story it's telling investors, too.