Pulumi Unveils Neo Security Agent to Graph and Remediate Multi-Cloud Threat Vectors

Pulumi announced the launch of Neo Security in research preview, introducing an AI infrastructure agent capable of uncovering exploitable flaws across multi-cloud environments. Operating across AWS, Azure, Google Cloud, and Kubernetes, Neo Security models crown-jewel assets and trust boundaries, evaluates attack paths such as lateral movement and reachability, and validates findings against six planes of operational evidence. These sources include resource inventories, graph-based relationship mappings from the Pulumi Context API, source intent, live runtime state, compliance policies, and real-time cloud provider queries. Rather than generating unstructured alerts, Neo Security executes a read-only assessment and produces pull requests with executable infrastructure as code (IaC) diffs for human review and remediation. The release marks a necessary pivot from reactive posture alerts to automated, deterministic remediation in cloud engineering. Modern platform teams struggle with alert fatigue generated by legacy Cloud Security Posture Management (CSPM) tools that identify misconfigurations without verifying true reachability or providing turnkey code fixes. By operating at the intersection of a full infrastructure graph and actual deployment code, Neo Security allows security engineers and platform practitioners to validate genuine exploit vectors and deploy tested fixes through standard CI/CD workflows without disrupting production workloads. This evolution reflects a broader trend toward AI-augmented operations and agentic platform engineering. As generative models lower the cost of traversing complex relational graphs, infrastructure tooling is evolving from static declarative files into dynamic systems that actively protect their own topologies. While AI coding assistants have focused on source-level static analysis, cloud security requires contextual awareness of live boundaries, IAM policies, and interconnected services. Bridging IaC definitions with real-time discovery and graph analysis provides agents with the deterministic grounding needed to safely automate operational tasks. In practice, organizations should evaluate how Neo Security integrates into existing platform engineering pipelines. Because assessments remain read-only, teams can run threat models across mixed estates containing both managed IaC and unmanaged resources without risking operational drift. Platform teams should treat Neo Security’s generated diffs as standard pull requests subjected to normal review, automated testing, and preview policies before merging. Teams managing multi-account complexity or legacy cloud resources should monitor how effectively the agent prioritizes critical attack vectors over benign policy deviations.