--- schema: "swft.publication/v1" id: "company-itau-devin" title: "Itaú and Devin: agents inside a bank's software maintenance" description: "How to interpret Itaú's reported Devin adoption and maintenance workflows, with clear boundaries between team usage, codebase coverage, and agent concurrency." summary: "To evaluate a large organization's agent program, separate who uses it, what work it covers, and which results people accept. This case applies that reading method to a vendor-hosted account of Itaú. It does not establish a concurrent-agent count or an independent productivity result." canonical: "https://swft.io/companies/itau-devin" author: "SWFT Editorial" author_type: "Organization" published: "2026-09-08" modified: "2026-09-08" kind: "case-study" section: "Companies" tags: ["Itaú", "Devin", "software factory adoption", "agent scale metrics", "financial services"] evidence_labels: ["INFERENCE", "SELF-REPORT"] source_ids: ["itau-devin-customer"] authorship_disclosure: "AI-drafted from the cited public sources and independently checked by a second AI editorial-review agent (Codex) for source fit, claim boundaries, overlap, and reader utility. SWFT Editorial is responsible for corrections." --- # Itaú and Devin: agents inside a bank's software maintenance Scanner-triggered repairs, codebase documentation and migrations show how agent work can spread through an established bank. > **Authorship:** AI-drafted from the cited public sources and independently checked by a second AI editorial-review agent (Codex) for source fit, claim boundaries, overlap, and reader utility. SWFT Editorial is responsible for corrections. ## Quick answer To evaluate a large organization's agent program, separate who uses it, what work it covers, and which results people accept. This case applies that reading method to a vendor-hosted account of Itaú. It does not establish a concurrent-agent count or an independent productivity result. At Itaú, a security scanner can trigger an agent to prepare a repair for an engineer to review. That is one of several ways the bank is weaving Devin into ongoing software maintenance. A vendor-hosted account featuring its technology leaders reports adoption by 75% of teams. The interesting story is how agents enter the existing work, not just how many people have access. ## Agents enter an existing delivery process The [Itaú customer account](https://devin.ai/customers/itau) describes Devin responding to security-scanner findings inside CI/CD, the automated pipeline that checks proposed software changes. Engineers review repairs. They also review tests generated from their playbooks. The account reports several different kinds of scale: | Reported measure | What it counts | | --- | --- | | 75% of teams use Devin | Organizational adoption | | More than 300,000 repositories documented | Codebase coverage | | About 70% of named scanners' findings resolved automatically | A reported maintenance outcome, with engineer review | | 59 .NET services consolidated into nine Java services | One migration's scope | The page is undated and does not give complete measurement windows. It describes universal first-pass PR review as forthcoming. These details constrain any claim about the bank's current operating system. ## A large codebase changes the product question The managerial question is how to make work repeatable across teams that maintain different services. A migration request needs a destination, a responsible owner, and a way to check behavior. A security finding needs enough context to locate and repair the defect. Both need a result that the receiving engineer can evaluate. SWFT's interpretation is that a useful factory makes those handoffs explicit. Start with a queue whose items share an acceptance rule. For example, a framework upgrade can require the target version, a passing build, and agreed behavior checks. If the next item needs different permissions or a different reviewer, record that difference before dispatching it. Company-wide access is a different operating achievement from that repeatable task flow. A team can use an agent frequently while still spending considerable time recovering context, correcting output, or waiting for review. Adoption alone cannot settle whether the workflow improved delivery. ## Read each number with its denominator Ask what entered the measured group and what was left out. For a repair rate, that means the eligible findings, duplicates, failed attempts, manual corrections, and accepted patches. For a migration, ask whether the comparison includes testing, deployment, and cleanup. For a usage percentage, ask what activity makes a team count as a user. These are requests for a measurement method, not reasons to discard a reported result. They let another organization decide whether its own backlog resembles the reported work closely enough to attempt a pilot. The missing number for a swarm comparison is concurrency: how many agents were active together on one defined objective. Repository coverage and team adoption cannot be converted into it. A useful run record would include the task, active workers over time, elapsed duration, accepted output, cost, and human review effort. Itaú is a relevant operating case in SWFT's financial-services coverage. Its public account supports further investigation of repeated agent work inside a bank; it supplies no basis for a numerical ranking of the largest coordinated swarms. ## How we know - **First-party report (SELF-REPORT)** Cognition publishes an account of Itaú's adoption and maintenance results. Sources: [How Itaú Deployed AI Across the SDLC at Global-Finance Scale](https://devin.ai/customers/itau). - **Analysis (INFERENCE)** SWFT distinguishes adoption, coverage, accepted output, and concurrency when assessing enterprise agent scale. Sources: [How Itaú Deployed AI Across the SDLC at Global-Finance Scale](https://devin.ai/customers/itau). ## Sources - **First-party report (SELF-REPORT)** [How Itaú Deployed AI Across the SDLC at Global-Finance Scale](https://devin.ai/customers/itau) — Cognition / Devin; accessed 2026-09-08. Undated vendor-hosted account featuring named Itaú operators; measurement windows are incomplete. ## Read next - [How Cognition uses Devin to build Devin](/companies/cognition-builds-devin) - [Software factory metrics that matter](/software-factory-metrics)