Cognition ×

Nothing on screen but the lockup. Every word of the open is spoken, so the room is looking at you, not reading ahead.
Because nothing here is written down, the open only exists if you say it. Have the first two sentences memorised cold — not paraphrased on the day.
Do not narrate the logos. The lockup is the whole slide; talking about it wastes the one moment the room is giving you their full attention.
Names/titles confirmed the morning of. Say names correctly or don't say them.

Cognition operates Devin, the first autonomous software engineer.

Ten seconds. Do not linger.

The line is Cognition's own, verbatim from cognition.com. Using the house language is deliberate: in this room it reads as literacy, not as a pitch you wrote.
Assert the category, never argue it. Cognition's own surfaces never explain what an agent is or compare Devin to a copilot — arguing it concedes the category is contested. If someone raises Copilot, that's appendix A1, not this slide.
Say the word autonomous once, clearly, then move on. The room will test it later and you want them testing your definition, not one they filled in themselves.

Three of the world's systemically important banks already build with Devin

Case study available

40,000

developers at Citi, rolling out agentic AI across the org

8-12×

efficiency gain on Nubank's 6M-line migration

70%

of security vulnerabilities auto-remediated at Itaú

Cognition's own selling motion: a named peer and a number, early.

The headline claim is precise, not decorative. Citi, Goldman Sachs and Santander are all on the FSB's global systemically important banks list — the same list Bank of America is on. That is deliberately a stronger statement than "Fortune 100" for this room: it says these are firms inside your regulatory perimeter, not just firms your size. Re-check the FSB list before the meeting — it is republished every November and the claim is only worth making if it is exactly right.
Every logo here is publicly named by Cognition or independently reported. Citi's 40,000-developer rollout is American Banker, not a Cognition claim — say that out loud, it's the strongest citation on the slide.
"Case study available" on Itaú, Nubank and Ramp is a real offer, not decoration. All three are published at devin.ai/customers. If anyone shows interest, send the links the same day — that's the follow-up hook.
Only three of the six carry a number, deliberately. Goldman, Santander and Ramp are named partners without published figures for this shape of work, and inventing one would be the single fastest way to lose this room.
Nubank is the one to go deep on if asked: 6M+ lines, 1,000+ engineers, ~100,000 call sites, dependency chains 70 deep, fanned out across parallel Devins. That is structurally the same problem as the Angular initiative.
Verify all three figures at devin.ai/customers the morning of. Case-study numbers get revised, and a stale stat here costs you the same credibility as a wrong EOL date.

What would each of you like to get out of this?

Ask it. Then stop talking.

Introduce yourself here, spoken, in about twenty seconds. No slide for it. Only the load-bearing part: you spent six years shipping code that ran inside other companies' production systems, and you ran the technical sale and the integration yourself. Then the bridge, in one line: that is the same trust problem Devin has here, running inside someone else's production system where their engineers have to be able to verify what it did. Then ask the question.
The slide is empty on purpose. Nothing to read means the only thing happening in the room is the question, and the silence after it belongs to them.
Deliberately no names and no guesses at what anyone cares about. Guessing on screen is a bet with no upside: right is unremarkable, wrong is presumptuous, and in front of their colleagues it's expensive. Asking gets you the same information and hands them control.
Count to ten in your head before saying anything else. Whoever speaks first tells you who the real decision-maker is. That is worth more than any slide after this one.
Write the answers down visibly, then actually change your emphasis. If someone names something you hadn't planned for, return to it explicitly in the close.
Everything after this is "the how." If an answer here contradicts what you were about to recommend, follow the answer, not the deck.

High urgency projects

Project

Today

Objective

Test coverage

30% covered across 12+ services

Pass the OCC exam

Angular upgrade

Angular 14, shared component library

Upgrade before the EOL deadline

Notification service

On-prem: Java/Spring, IBM MQ, Oracle

Serverless on Lambda, 99.99% held

Their words, their numbers. No recommendation yet.

Nothing on this slide is Cognition's opinion. It is their three objectives read back accurately, with the numbers they gave you. Most vendors cannot do this, and doing it well is worth more here than a recommendation would be.
You have just asked them what they want. Repeating it back before pitching anything is the natural next move, and it gives them a cheap chance to correct you while it is still free to be wrong.
Do not propose a sequence here. You do not yet know their priorities or their internal politics, and a printed running order is something they have to push back on rather than something you can adjust. Ask instead: "which of these is under the most pressure right now?"
If they name one, that is where you go, and the deep-dive slides are ordered by them, not by you. Jump straight to it.
If any objective here is wrong, that is the most valuable thing you learn all meeting. Fix it out loud and carry the correction into the rest of the deck.

“Shifting from proofs of concept… to actual end-to-end process transformation.”

Hari Gopalkrishnan, Chief Technology & Information Officer, Bank of America. CIO Dive, 14 April 2026.

Their words, so let them carry the weight.

Read it once and stop. Do not explain it, do not agree with it out loud, and do not add "which is exactly why we're here". The room knows their own CTIO's position, and narrating it turns a strong slide into flattery.
This is the frame for everything after it. It says the bar for today is not "is this interesting enough to trial", it is "is this ready to run as a programme". You want that bar set by them, not by you.
It commits you. Having put this up, do not close by asking for a proof of concept. If your ask sounds like a POC, someone in the room will hold this slide against it. Whatever you request at the end has to be programme-shaped, with a real owner and written success criteria.
Verify the exact wording against the CIO Dive piece before the meeting. The version in our research has an ellipsis in the middle, which means it may be stitched from a longer passage. If you cannot confirm it verbatim, drop the quotation marks and state it as their published direction instead.
Same interview, useful if governance comes up: "If you overdo it, you stall innovation. If you underdo it, you introduce a lot of risk."

Test coverage

Divider. Two seconds on screen. Say why the demo is this one.

Why this one and not the other two, spoken, in about twenty seconds. The Angular risk lives in their proprietary component library, their SSO/MFA integration and their analytics SDK, none of which is reproducible outside their walls, so a demo would show the easy part and skip what they are worried about. The notification service has no application code migrated yet, so there is nothing to run. Coverage is the only one where the demo is the proof. On the other two you would be demoing a promise.
That is a statement about your preparation, not a ranking of their roadmap. If they want the hour on Angular, go to Angular and the demo waits.
30% overall is the headline number they gave you, but it is not the job. The job is the four paths they named: transaction processing, authentication, PII handling and audit logging, where they say coverage is "significantly lower."
The exam wants edge cases around error handling and data validation. That is their wording, and it is the reason mutation testing is on the next two slides rather than a coverage percentage.
Skip this section entirely if they told you it is not a priority. These three sections are jumpable and independent, in whatever order the room asked for.

Pass the exam, then keep passing it

Phase

Objective

Description

OneGroundwork

Make every service testable

Some services have no framework, no CI job and no mocks. Nothing can be written until they do.

TwoCompliance

Pass the OCC exam

Transaction processing, authentication, PII handling and audit logging: the four paths the examiner asks about.

ThreeDelivery

Keep coverage rising

Coverage ratchets on new code, so tests arrive with the feature rather than a year after it.

The exam is phase two. Phase three is what stops you doing all of this again in three years.

Every phase leaves an asset, not a dependency.

What each phase leaves behind is spoken, not on the slide. One leaves the playbook every later session follows. Two leaves tests that fail when a control breaks. Three leaves a ratchet, so coverage cannot fall back. Say it as the answer to the lock-in question every bank has and almost none of them ask out loud: nothing here stops working when Cognition leaves the room.
The description column is there so nobody has to ask "why those four?" out loud. If anyone does, the answer is that they are the paths the OCC examines and the paths where they told you coverage is lowest. Do not read the column aloud.
Phase three is aimed at the VP. One and two answer the Chief Architect and the Security Engineer. Three is the one that pays the engineering org back: they told you the team has been focused on feature delivery, leaving testing as persistent tech debt. Phase three is where that trade stops being necessary, because the tests arrive with the code rather than after it.
Phase one is their own sentence. They told you some services have no test frameworks, no CI test jobs and no mocking patterns. You cannot write a test into a service that has nowhere to put it, so bootstrapping is genuinely first, and it is also the safest possible place to start: no production code is touched.
Phase one's real output is the playbook. A fleet writing tests without one produces two hundred pull requests in two hundred styles, which is exactly what the Chief Architect is afraid of. Say that to him directly: he reviews and signs one versioned artifact, not two hundred diffs.
Phase two is scoped to the four paths they named, not to a percentage. If the VP asks for a number, the honest one is that the inventory comes out of phase one: a coordinator session counts the units and returns them as structured JSON, and only then does anyone commit to a date against the OCC exam.
Sizing, if it comes up: 4-8 hours of junior-engineer work per unit is Cognition's own published guidance on where Devin performs best. One module, one pull request, and the work is additive, new test files rather than edits to theirs, so parallel sessions cannot collide.
Phase three is the one nobody else offers. Diffblue and an offshore testing vendor both leave you with a number on the day they finish and no mechanism to hold it.

Demo

The third one is the demo. The first two are setup.

Anyone can show a green pipeline. The moment that earns the room is Devin hitting a genuine ambiguity and asking instead of guessing, a human answering in under a minute, and that answer being promoted to shared knowledge so the next module inherits it. Stopwatch that exchange out loud and report the elapsed minutes.
Say the time-box at the start: "thirteen minutes, I stop at [clock time] regardless of where we are." An external, spoken clock makes the cutoff read as discipline rather than as running out of road.
Start from a pipeline that is already green on the untouched code. A red starting point destroys the "your existing safety net" framing before you begin.
If it breaks, do not debug live past thirty seconds. Switch to the recording of the same run from that morning and say so plainly: "let me show you this morning's run rather than debug my network in front of you."
Pre-flight, day of: reset to the known-good tag, confirm CI is green on it, confirm the escalation-triggering ambiguity is still genuinely unresolved, confirm the backup video plays offline. Never narrate a feature that got cut from the build.

The same work, at two regulated institutions

Litera

+40%

Test coverage lifted, regression cycles cut by about 90%, with teams of Devins acting as QE and SRE.

devin.ai/customers/litera

Itaú Unibanco

70%

Of security vulnerabilities auto-remediated, and test coverage roughly doubled, at global-finance scale.

devin.ai/customers/itau

Named customers, published numbers.

Both are public case studies with live links, so anyone in the room can check them afterwards. Offer to send them the same day rather than reading the numbers aloud.
Itaú is the stronger of the two for this room: a regulated bank, across the SDLC. Litera is the closer match to the actual work.
Verify every figure at the source the morning of. Case-study numbers get revised, and a stale stat costs you the same credibility as a wrong EOL date.

Angular 14 to 18 upgrade

Divider. Two seconds on screen.

Their words, their target version. Do not correct the 18 on this slide, it comes up on the next one as a question.
Skip this section entirely if they told you it is not a priority. These three sections are jumpable and independent, in whatever order the room asked for.

Get off 14, then stop landing on dead versions

Phase

Objective

Description

OneGroundwork

Make the shared library safe to change

It is consumed by many teams with no contract tests between them. Nothing fans out safely until changing it is provably safe.

TwoMigration

Get off the end-of-life version

Module by module, behind flags, with every consumer app still building green before anything releases.

ThreeCadence

Be able to hold a version

Angular ships roughly every six months. The deliverable is keeping up without a programme each time.

The target version is worth deciding together. Angular 18 is already end of life.

Phase three is the one they did not ask for.

Ask early whether the component library is centrally owned or forked per consumer team. Centrally owned means harden once and fan out. Forked means a contract-test layer comes first and phase one is materially bigger.
Raise the version question as a question, not a finding: "18 is already past EOL, so worth picking the target together." Do not turn it into a gotcha.
SSO and MFA live in this app, so expect the Security Engineer to focus there. Be straight that this is the highest blast radius of the three initiatives, which is exactly why release is per module and behind flags.
Phase three is the commercial subtext: this converts a one-off project into a capability. Let them reach that conclusion rather than selling it.

Off Angular 14 without stalling the teams that depend on it

Harden the shared library

Migrate module by module

Consumer builds stay green

Your team reviews, then flags on

Proof is every consumer repo still building, module by module, behind a flag you control.

FE fundinfo: engineering capacity scaled across 1,800 repos.

The shared library is the whole problem.

Ask early whether the component library is centrally owned or forked per consumer team. Centrally owned means harden once and fan out. Forked means a contract-test layer comes first, and the scope is materially different.
Their stated target is Angular 18, which is already end of life. Raise it as a question, not a finding: "worth picking the target together, because 18 is already past EOL." Do not turn it into a gotcha.
SSO and MFA are in this app. Expect the Security Engineer to focus there, and be straight that customer-facing auth flows are the highest blast radius of the three initiatives, which is why flags and per-module release exist.
Visual diff is worth naming explicitly. A build passing does not prove a screen still renders correctly, and everyone in the room knows it.

Fan-out migrations, already done at scale

FE fundinfo

1,800

Repos covered as engineering capacity scaled across the estate, the same fan-out shape as your component library.

devin.ai/customers/fefundinfo

Mercedes-Benz

8mo → 8d

A 200,000-line modernisation estimate cut to eight days during a four-week pilot.

cognition.com/blog/mercedes-benz-cognition

Named customers, published numbers.

Both are public case studies with live links, so anyone in the room can check them afterwards. Offer to send them the same day rather than reading the numbers aloud.
FE fundinfo is the relevant one: one shared library, many consumer repos. Mercedes is there for scale of legacy, not for Angular.
Verify every figure at the source the morning of. Case-study numbers get revised, and a stale stat costs you the same credibility as a wrong EOL date.

Notification service migration

→

Divider. Two seconds on screen.

The biggest and the most human-led of the three. Set expectations here: this is the one where the plan looks different.
Skip this section entirely if they told you it is not a priority. These three sections are jumpable and independent, in whatever order the room asked for.

Move the system without moving the risk

Phase

Objective

Description

OneDesign

Settle the target and the cutover

Ordering semantics, data residency and failure modes are judgment calls. Your architects decide them before any code moves.

TwoBuild

Adapters, harnesses and load tests

The mechanical surface around that design, fanned out in parallel once the shape is agreed.

ThreeCutover

Prove it on real traffic

Shadow run against production traffic, compare the two outputs, then cut over with a rollback path.

Correctness here shows up at cutover, not in a code review. The plan is built around that.

Be honest about which half is human.

Phase one is deliberately theirs, not ours. On this initiative the humans own the design and Devin takes the mechanical edges. Saying that plainly is worth more than claiming the whole thing.
This is not a refusal and must not sound like one. If this is their priority, this is where you start.
Ask whether ordering is global or scoped to a partition key before anything else. Partition-scoped is tractable on SQS FIFO. Truly global ordering is an architecture question worth answering before the target platform is committed to, whoever builds it.
Depth to hold in reserve, only if the Chief Architect pushes: RDS Proxy does not support Oracle, error-budget maths against 99.99%, and IBM MQ semantics that do not map cleanly onto SQS.

Out of the data centre without dropping an event

Your architects own target and cutover

Devin builds adapters and harnesses

Shadow run on real traffic

Compare, then cut over

Proof is a shadow run against real traffic, not a code review.

Nubank: 6M-line core migration, 8-12x on engineering hours.

Be honest about which half is human.

The highlighted step is first here, deliberately. On this initiative the humans own the design and the cutover, and Devin takes the mechanical edges. Saying that plainly is worth more than claiming the whole thing.
This is not a refusal. If this is their priority, this is where you start. The point of the slide is that the plan looks different, not that the work is off the table.
Ask whether ordering is global or scoped to a partition key. Partition-scoped is tractable on SQS FIFO. Truly global ordering is an architecture question that deserves answering before the target platform is committed to, whoever builds it.
Depth to hold in reserve, only if the Chief Architect pushes: RDS Proxy does not support Oracle, error-budget maths against 99.99%, IBM MQ semantics that do not map cleanly to SQS.

Core migrations, with the numbers published

Nubank

8-12×

Efficiency gain migrating a 6M-line core monolith, fanned out across parallel Devins. Over 20x cost saving.

devin.ai/customers/nubank

AngelList

5.2×

Faster Redshift to Snowflake migration, a data-platform move with the same cutover-shaped risk.

devin.ai/customers/angellist

Named customers, published numbers.

Both are public case studies with live links, so anyone in the room can check them afterwards. Offer to send them the same day rather than reading the numbers aloud.
Nubank is the flagship and the closest analogue: legacy core, millions of records, humans owning the architecture.
Verify every figure at the source the morning of. Case-study numbers get revised, and a stale stat costs you the same credibility as a wrong EOL date.

Suggested next steps

Programme owner

A single point of accountability

This week

Success criteria

Measurable targets, agreed in writing

Two weeks

Security review

SOC 2 Type II and the VPC deployment model

Two weeks

Executive sign-off

Approval of the agreed criteria

Three weeks

Commercials

Scope, cost and a start date

Four weeks

Questions first. This goes up last.

Take questions first. This goes up once they have run out, never before.
Close it verbally, not on the slide: you come back in three weeks with results measured in their own environment, not a case study from another bank.
A programme ask, not a pilot ask. Their CTIO is on screen six slides earlier saying they are past proofs of concept, so a trial here would undercut your own slide.
The sequence is the argument: criteria are written, then reviewed, then approved, then funded. Nobody is asked to fund something undefined.
"A single point of accountability" is deliberately neutral. If they run this through a steering group, that is their business. What matters is one name you can call between meetings, and you can say exactly that if asked.
Measurable targets means numbers: a coverage figure, an exam-readiness bar, a ceiling on review hours. Offer to draft it for them to edit. Faster than asking them to write it, and it keeps you close to the definition.
Name the Security Engineer when you reach that row. Before anything is touched, not after, and it is thirty minutes rather than a workshop.
If they counter with a free proof of concept, accept it, then hold the owner and the written criteria. Those two are what stop this quietly dying.

Thank you

Cognition ×

Leave it up.

This is what stays on screen through the questions, so it should be the lockup rather than a slide full of content competing with the conversation.
Do not add a new argument here. If something got missed, it goes in the written follow-up the same day.