Pulumi Previews Neo Security to Automate Threat Modeling and IaC Remediation

Pulumi has launched a research preview of Neo Security, an AI-powered security agent engineered to detect and remediate exploitable flaws across AWS, Azure, Google Cloud, and Kubernetes environments. Operating across three sequential passes, Neo Security first builds a threat model by identifying high-value crown jewels and trust boundaries, maps lateral movement and credential exposure paths, and subsequently validates those vectors against six planes of evidence. This multi-layered assessment integrates resource inventories, reference graphs from Pulumi's Context API, infrastructure code semantics and history, live runtime telemetry, policy-as-code evaluations, and direct cloud provider verification queries. Once an exploitable path is verified, the agent formulates concrete code diffs and creates pull requests for review. Traditional Cloud Security Posture Management (CSPM) and static linters often struggle with high false-positive rates because they evaluate resources in isolation without understanding runtime reachability or full architectural intent. Neo Security addresses this operational bottleneck by combining structural graph awareness with live provider state, ensuring that sandbox environments and production workloads are evaluated according to their actual blast radius. For platform engineers, cloud architects, and SecOps teams, this capability transitions cloud defense from manual alert triage to an actionable remediation model where identified risks come pre-packaged with corresponding code-level corrections. This development reflects a broader paradigm shift across the DevOps ecosystem toward context-rich, agentic infrastructure management. As cloud environments expand across hundreds of accounts and interconnected services, human-driven threat modeling and static configuration scanning can no longer keep pace with release frequencies. Modern platform engineering increasingly demands deep context graphs that map transitive dependencies and identity permissions across both managed and discovered unmanaged infrastructure. By leveraging frontier AI models to analyze these large graphs affordably, security tooling is progressing from passive observation toward closed-loop automated resolution within developer pipelines. In practice, engineering teams should evaluate Neo Security as an enhancement to existing platform governance rather than an autonomous substitute for security reviews. Because the discovery and assessment phases operate in read-only mode, the tool integrates safely into existing environments while restricting all write actions to repository pull requests. Platform teams must establish review protocols to inspect agent-generated infrastructure diffs, verifying that suggested changes adhere to corporate naming conventions, modular standards, and state management constraints. As agentic security matures, organizations should audit how graph-based infrastructure context can reduce mean time to remediation (MTTR) across multi-cloud estates.