By Pulumi shipped Neo Security into research preview this week — an AI agent that scans your entire cloud estate, traces attack paths to verify which vulnerabilities are actually exploitable, and then opens a pull request with the exact infrastructure fix. Not an alert. Not a ticket. A PR.
Most Security Tools Stop at Discovery. Neo Doesn’t.
The problem with the current generation of cloud security tools — Wiz, Orca, Prisma Cloud — is not that they’re bad at finding misconfigurations. They’re quite good. The problem is that finding the issue and fixing the issue are entirely different operations, separated by a wall of tickets, triage meetings, and engineering prioritization battles.
Pulumi’s pitch with Neo Security is simple: a validated finding maps directly to a code diff. If the affected resource is managed by IaC, Neo opens a pull request. Your CI/CD pipeline picks it up the same way it would any other PR — Pulumi previews run, policy checks fire, tests execute. A human reviews and merges. That’s it.
This is not a trivial distinction. Security teams have been generating findings for decades. Engineering teams have been ignoring the resulting ticket queues for nearly as long. The PR model doesn’t just improve the handoff — it eliminates it.
How the Scan Works
Neo Security doesn’t do static analysis alone. It queries your cloud providers directly to resolve what’s actually reachable and exploitable after every policy, permission boundary, and service control policy has been applied. AWS Access Analyzer tells it what’s externally reachable. IAM policy simulation tells it whether a principal can actually perform an action — not what the policy text says, but what survives the full policy evaluation chain.
The process runs in five phases:
- Crown jewel identification — finds production data, high-value accounts, and trust boundaries
- Attack vector mapping — internet entry points, federation relationships, workload identity, lateral movement paths
- Live cloud validation — queries cloud APIs directly to prove or refute each path
- Ranking by severity and confidence — survivors get evidence trails, not just flags
- PR generation — where IaC source is available, exact code diffs ship as pull requests
The output is a short list. Each entry has its evidence, its severity rating, and where possible, its fix. No 500-item misconfiguration dumps.
It Works on Non-IaC Resources Too
A fair objection: most production environments aren’t fully IaC-managed. Manually provisioned resources, legacy configurations, and shadow infrastructure are the norm. Neo handles this without requiring full IaC adoption first — it scans whatever is there. For IaC resources, it opens PRs. For manually-provisioned ones, it surfaces findings and evidence without the automated fix. You get visibility regardless.
That matters because 32% of cloud infrastructure sits idle and untracked, carrying an average of 115 vulnerabilities each. That dark matter doesn’t suddenly become visible just because you’ve adopted Terraform or Pulumi for new deployments.
Policy Violations Now Appear in Your PR Comments
On September 14, Pulumi separately shipped policy violations appearing directly in pull request comments and check runs — GitHub, GitLab, Bitbucket, and Azure DevOps. When a Pulumi preview runs with a policy pack, the PR comment now includes a “Policy violations” section listing mandatory and advisory violations, the resource flagged, and the violation message.
This is the connective tissue that makes Neo Security’s PR model work end-to-end. You request a Neo scan, it opens a PR, the PR comment shows policy violations inline. The entire security feedback loop lives in your pull request interface.
Why the Timing Is Right
Cloud misconfiguration is not an edge case. 81% of cloud breaches stem from misconfigurations. More than 60% of IaC templates contain misconfigurations in reviewed deployments. Nearly 70% of cloud vulnerabilities are caused by human error, not software flaws. The tools that exist to address this generate more alerts than teams can process.
The shift Pulumi is making with Neo Security — from detection to validated, PR-ready remediation — is the correct direction. The research preview is invite-only for now, and the initial scan is free. Pulumi says they’re prioritizing multi-cloud, multi-account estates with a mix of IaC and non-IaC resources.
If your infrastructure security backlog is growing faster than your team can close tickets, that’s exactly the profile they’re looking for. Request access through the Neo documentation and let the first scan tell you what’s already exploitable.
