Pulumi Neo Security Bridges Cloud Threat Modeling and Automated IaC Remediation

Pulumi has launched a research preview of Pulumi Neo Security, an AI-driven agent engineered to threat-model cloud estates and identify exploitable attack paths across multi-cloud environments and Kubernetes clusters. Rather than scanning configurations in isolation, Neo Security approaches estates in three distinct passes: establishing a threat model around critical assets and trust boundaries, tracing attack vectors such as lateral movement and credential reachability, and validating findings against multiple planes of evidence. These evidence sources combine the newly introduced Pulumi Context API graph, IaC declarations, runtime telemetry, and direct cloud provider access simulations. For platform, SRE, and security teams, this release tackles the chronic fatigue associated with conventional cloud security posture management (CSPM) tools. Standard rule engines often flood teams with alerts because they fail to distinguish between internet-facing production data stores and isolated sandbox resources. Neo Security uses organizational context to establish relative risk and blast radiuses. Furthermore, because Pulumi orchestrates the underlying infrastructure code, validated security vulnerabilities are converted directly into reviewable pull requests containing the exact configuration diffs needed for remediation. This release highlights the accelerating convergence of infrastructure-as-code management, context graphs, and agentic AI systems. As automated and agentic techniques increasingly challenge perimeter and identity controls, defensive tooling must evolve past static linters and periodic audits. By coupling full estate visibility—spanning Pulumi programs, Terraform state, and discovered cloud resources—with LLM reasoning over effective permissions and network topologies, Pulumi is transforming IaC frameworks from deployment engines into intelligent, self-healing governance control planes. In practice, engineering organizations should assess how agentic posture tools integrate with established review mechanisms. Neo Security's assessment phase operates in a strictly read-only mode, isolating all write actions to the pull request layer where human operators maintain merge approval. Platform teams evaluating this model should ensure their estate inventory is comprehensive, as the agent's threat modeling efficacy relies heavily on complete topology and identity mapping. Engineering leaders should prepare internal workflows to handle automated security pull requests without bypassing standard automated testing pipelines.