Pulumi Previews Neo Security to Map and Remediate Multi-Cloud Attack Paths via IaC

Pulumi has announced a research preview of Pulumi Neo Security, an AI-powered agent engineered to discover and remediate exploitable vulnerabilities across cloud estates covering AWS, Azure, Google Cloud, and Kubernetes. The system operates across three systematic passes: first, it establishes a threat model detailing trust boundaries, realistic adversary profiles, and critical production assets; second, it maps lateral movement and privilege escalation paths; and third, it validates those vectors against six distinct evidence planes, including runtime state, infrastructure code intent, and Pulumi's graph-based Context API. Operating strictly read-only during discovery, Neo Security turns validated findings into pull requests with concrete code diffs. Why this matters is centered on resolving the chronic disconnect between security alert generation and developer remediation. Cloud security teams have long struggled with high false-positive rates from posture management tools that flag theoretical misconfigurations without confirming whether an attacker can practically traverse that path. By grounding risk analysis in a unified context graph and translating findings into verified infrastructure-as-code changes, Neo Security reduces remediation friction. Platform teams and developers receive prioritized, high-confidence findings that directly match their existing codebase syntax rather than ambiguous dashboard reports. In a broader industry context, this rollout marks a key milestone in the transition toward agentic DevSecOps. As modern cloud environments grow increasingly heterogeneous—spanning multi-account layouts, ephemeral compute, and complex identity boundaries—static linters and isolated policy engines are no longer sufficient to evaluate complex multi-hop threats. By embedding generative AI agents on top of full-fidelity infrastructure graphs, cloud tooling vendors are transitioning from passive observability toward proactive, automated remediations embedded directly into version-controlled engineering pipelines. In practice, engineering leaders should evaluate how agent-driven security fits into their continuous integration workflows. Although Neo Security is currently in an early preview for selected enterprise environments, teams should prepare by auditing their repository permissions, refining least-privilege policies, and establishing automated CI checks for AI-generated pull requests. Practitioners should prioritize tools that provide end-to-end traceability between detected cloud state and code definitions, ensuring that any automated remediation undergoes standard peer review before deployment.