Pulumi Previews Neo Security to Trace and Remediate Cross-Cloud Attack Paths

Pulumi announced a research preview of Pulumi Neo Security, an AI agent designed to discover, validate, and remediate exploitable infrastructure flaws across AWS, Microsoft Azure, Google Cloud Platform, and Kubernetes environments. Rather than relying solely on static code analysis or isolated runtime anomaly alerts, Neo Security operates in three distinct phases. First, it constructs an estate-wide threat model that identifies crown-jewel data assets, external exposure surfaces, and trust boundaries. Next, it analyzes lateral movement paths and secret reachability across resources, regardless of whether they were provisioned via Pulumi, Terraform, or manual console actions. Finally, Neo Security validates each potential attack path against six evidence dimensions—including Pulumi's Context API graph, IaC intent, runtime telemetry, and direct cloud provider IAM policy simulations—generating remediation diffs as pull requests. For platform engineers, DevSecOps practitioners, and security architects, the primary bottleneck in cloud defense has shifted from vulnerability detection to contextual prioritization and remediation bandwidth. Traditional Cloud Security Posture Management (CSPM) and static code scanners generate vast backlogs of theoretical misconfigurations without resolving effective permissions, overlapping security groups, or organizational trust boundaries. A development sandbox is often flagged with the same severity as a customer-facing production database. By grounding attack-path verification in the actual context graph and producing concrete IaC diffs rather than advisory notifications, Neo Security enables engineering teams to eliminate validated risk without introducing manual remediation friction. This release reflects the broader industry movement toward agentic infrastructure management and unified operational graphs. Over the past year, infrastructure platforms have integrated LLMs to shift from reactive linting to proactive automation. However, AI static analysis tools have struggled with the interconnected nature of modern cloud topologies, where vulnerabilities emerge from the complex composition of IAM roles, VPC peering, network gateways, and service configurations rather than localized syntax defects. By leveraging the Pulumi Context API to treat multi-cloud resource dependencies as a queryable graph, Pulumi is positioning its platform not merely as a provisioning engine, but as an active reasoning layer across heterogeneous cloud estates. In practice, engineering teams evaluating Neo Security should note that the assessment phase operates in a strictly read-only capacity; the agent queries cloud APIs and inspects graph topologies without executing mutations directly against live environments. When a verifiable attack path is confirmed, the output manifests as a declarative code diff submitted to the corresponding Git repository, ensuring that proposed changes undergo standard peer review, testing, and CI/CD validation before deployment. Organizations with complex multi-account environments and legacy unmanaged resources can use this capability to audit exposed attack surfaces and reconcile drift through governed pull requests.