Skip to main content
Neo uses a layered memory system designed around how security teams actually work: testing complex applications over time, running follow-up scans as code changes, and building on findings from previous engagements rather than starting from scratch every time. Memory operates at two scopes.

​
Working memory

Global memory is tied to your account and persists across every conversation. It stores your identity and preferences the agent learns over time, things like preferred report formats, tool configurations, or the types of targets you typically assess. When you start a new task, the agent already knows how you like to work without you having to re-explain it. Task memory is scoped to a single conversation and captures the live working context of what is happening right now: the insights the agent has identified about your goals, discrete facts it has discovered (target URLs, open ports, credential pairs, API endpoints), a structured todo list tracking what has been completed and what remains, and every tracked file the agent has created or modified during the session. This matters most during long-running security tasks. When you point Neo at a complex application with dozens of endpoints, authentication flows, and business logic to test, the agent may execute hundreds of tool calls across reconnaissance, scanning, and verification. At every step of that process, the agent’s working memory is refreshed with the latest state. If the agent discovers a new attack surface mid-task and logs it as a fact, that information is immediately available in the very next reasoning step. If a subagent finishes a scan and produces a report, the file is tracked automatically so the agent can reference it directly without re-running the work. Todos keep the agent aligned across phases, so a long engagement does not lose coherence as it moves from recon to exploitation to reporting. Working memory has a combined size limit of roughly 50,000 characters across both scopes. If memory approaches that limit, the agent consolidates by removing completed todos, merging related insights, and cleaning up tracked files that are no longer relevant. This keeps the memory footprint lean without losing the context that matters.

​
Cross-task recall

The real value shows up when you run multiple tests against the same application over time. Your global preferences carry forward, so the agent already knows your workflow. But more importantly, Neo can recall findings from previous sessions through semantic search. Instead of matching on exact keywords, the agent converts your query into a vector and finds the most relevant messages by meaning across your entire conversation history. If you ask what authentication issues were found in a prior engagement, the agent searches all of your past sessions and surfaces the relevant context. Each result includes a reference back to the source task, so the agent can follow up with a targeted lookup if it needs the full picture: browsing through that task’s messages, searching within it, or pulling a snapshot of that task’s working memory at the time (its insights, facts, and todos). This makes subsequent runs significantly more effective. The agent is not rediscovering the same application architecture or re-mapping the same endpoints. It recalls what was tested, what was found, and what was left unexplored. For security teams running continuous assessments or retesting after remediation, this is the difference between starting cold every time and having an agent that compounds its understanding of your targets. Cross-task recall is access-controlled. The agent can only retrieve conversations you own, that are shared with your team, or that have been made public.

​
Structured data

Beyond conversation history, the agent also recalls structured data that persists across sessions. Neo maintains its own issue tracker with a dedicated database and query engine. Every vulnerability, misconfiguration, or exposure that Neo identifies gets stored as a structured issue with severity, status, host, and full metadata. The database also tracks false positives, past decisions, and regressions, so the agent carries forward not just what it found but how those findings were handled. This makes the database directly useful at runtime. When the agent starts a new task, it can query previously known vulnerabilities, filter by severity or target, check whether a finding was already marked as a false positive, see if a previously fixed issue has regressed, or pull aggregate stats across your entire project. If Neo found an IDOR vulnerability in a previous engagement and you are now retesting the same application, the agent does not need to rely on conversation recall alone. It queries the issue tracker directly, sees the prior finding and its full decision history, and picks up where it left off. Codebase analysis works similarly. When a repository is indexed, the agent has access to the full structural map of the application: module trees, dependency graphs, entry points, and file-level metadata. During a security assessment, the agent can query which modules are most critical, trace dependencies from an authentication handler to the database layer, or identify HTTP routes that expose business logic. This structural awareness persists across sessions, so the agent does not need to re-analyze the codebase every time you return to the same target. The agent can also query indexed knowledge bases, which include both your private documentation and shared security references like vulnerability databases and best practice guides. This is semantic search over indexed content, not just conversation history. If the agent encounters an unfamiliar vulnerability class during a test, it can search your indexed knowledge for relevant patterns, code examples, or remediation guidance without leaving the current task.