Neo

• Running a recurring authenticated pentest of a staging app and API, with each run retesting past findings and new routes
• Clearing a backlog of bug bounty, pentest and scanner reports by reproducing each one and closing duplicates and non-issues with evidence
• Reviewing every pull request for exploitable auth and logic flaws and confirming them against a preview deployment before merge
• Mapping an organization's external attack surface and checking new assets when a CVE drops
• Red teaming an internal network from a VPN, SSH or self-hosted sandbox foothold within an authorized scope
• Running recurring pentests and triage as an MSSP or small security team on a self-serve per-seat plan

Neo's distinguishing bet is that pentesting, PR review and triage should share one context. Most AI security tools either attack a running app or read code. Neo does both, then remembers roles, routes and past findings so later runs and fix retests build on earlier work. Neo Triage is the most practical new piece: teams drowning in bug bounty and scanner reports get a reproduced verdict with evidence instead of another risk score, and it is free for a limited time on self-serve plans. The tradeoffs are budget and control. Usage draws down a weekly allowance whose consumption varies widely by task, the free plan is a one-time trial, and the controls large companies expect (SSO, BYOK, VPC, on-prem) sit behind Enterprise. Teams evaluating it should start with triage or a scoped staging pentest, check verdicts by hand, and watch credit use before automating.

About Neo

Neo is a hosted platform in which an orchestrator plans each task and dispatches specialist agents (recon, browser, API security, XSS, CVE intelligence, red team, Android and iOS, code review, verification) that run in isolated sandboxes with ProjectDiscovery's own open-source tools pre-installed alongside tools such as SQLMap, Semgrep, Impacket and BloodHound. The same platform covers several jobs. A pentest starts from a target URL, optional OpenAPI or GraphQL schema, out-of-scope list and test credentials; Neo signs in like a real user (including SSO and TOTP MFA), tests each role for injection, access-control, SSRF and business-logic flaws, chains findings, and leaves out anything it cannot reproduce. PR security review installs as a GitHub App that runs Semgrep, TruffleHog and ast-grep on the diff, reasons about the change, can exercise the flagged endpoint against a preview URL, and posts inline comments with suggested fixes and an optional merge-gating check. Triage, released on October 26, 2026, pulls reports from HackerOne, Bugcrowd, GitHub security advisories, a Gmail security inbox, or any scanner with an API into one backlog, reproduces each one against your environment, and returns a verdict (valid, likely duplicate, needs more information, informative, not applicable or spam) with its own severity, evidence and a drafted reply to the reporter; auto-triage can run every 15 minutes to once a day. Projects keep memory of architecture, roles and past findings, so later runs build on earlier ones and confirmed fixes are retested. What sets Neo apart from AI pentesting tools that do only one of these jobs is that pentesting, triage, code review, threat modeling and attack-surface discovery share one context and one issue database. The tradeoffs: usage is metered against an allowance, so long Thorough or Goal-mode runs cost more; the Free plan is a one-time allowance on standard open-weight models; SSO, BYOK, a dedicated VPC and on-prem deployment are Enterprise-only; and Neo itself is a commercial product, not open source, even though the scanners it runs are.