Bring Your Own VPC is an enterprise-only deployment model. Contact your account team to scope and onboard a deployment.
How this differs from SaaS
On the standard SaaS product, Neo’s control plane runs in ProjectDiscovery’s cloud and reaches your internal systems through a connection you configure — VPN, SSH, or BYOS. Under Bring Your Own VPC, that connection isn’t needed: Neo already runs inside your network, so it reaches internal applications natively, with no tunnel and no inbound exposure.
The only traffic that leaves your VPC is outbound: image pulls to keep Neo updated, model calls (unless routed entirely through your own provider keys — see Model access below), and a small set of external tooling the agent draws on. The specific outbound allowlist is confirmed during onboarding so it can go straight into your firewall and proxy policy.
For most enterprise teams that choose this model, the driver is regulatory or compliance requirements — a data residency mandate, an industry regulation, or a contractual commitment that only a self-hosted deployment satisfies — rather than a general preference for running more infrastructure.
What you provide
A Bring Your Own VPC deployment runs on infrastructure you provision and operate in your own cloud account or data center — typically a Kubernetes cluster plus managed database, cache, and object storage. ProjectDiscovery provides the container images, deployment manifests, and onboarding support to bring it up. Exact sizing depends on your expected user count and scan volume, and is worked out with your account team rather than fixed in advance.The sandbox is part of what you deploy
On SaaS, a Neo-managed cloud sandbox is included by default, and adding BYOS is optional — something you connect on top when a task needs a specific network position or local files and tools. Under Bring Your Own VPC, there’s no separate cloud-hosted sandbox tier to fall back on. Since the whole platform runs on your infrastructure, the execution/sandbox environment is one of the components you provision as part of the deployment, not an optional add-on. See Sandboxes for what that execution tier does.Model access: hosted models or BYOK
A Bring Your Own VPC deployment can be configured either way:
See BYOK for how bringing your own provider keys works, and Models for which providers and models Neo supports.
Deciding whether this is the right fit
A few things are worth settling with your account team while scoping a deployment:- Regulatory or compliance requirements — industry regulations, government or public-sector mandates, or contractual terms that require data residency and infrastructure control are the most common reason teams choose Bring Your Own VPC over SaaS. Worth surfacing early, since it often settles the decision on its own.
- Scanning scope — whether you need Neo to test internal-only targets, internet-facing targets, or both. This is often the deciding factor between SaaS and Bring Your Own VPC.
- Model strategy — hosted models routed through ProjectDiscovery versus BYOK, and any compliance constraints on what may leave your network.
- Sizing — infrastructure sizing scales with expected users and scan volume and is confirmed jointly during onboarding.