Why Neo

Every security team evaluating AI-powered testing eventually asks: can we just build this ourselves on top of Claude, GPT, or an open-source agent framework? You can. But the real decision isn’t whether a team can assemble a DIY agent. It’s whether that stack can match Neo on the things that matter in production: accuracy, speed, depth, scale, and cost efficiency. Neo gives you a security platform that is purpose-built for vulnerability workflows from day one: specialized agents, pre-packed tooling, proprietary validation systems, live target deployment, and infrastructure designed to run reliable testing at scale without the engineering overhead of building and maintaining it yourself.

​

Multi-Agent Swarm Architecture

Neo isn’t a single agent with a lot of tools. It’s a coordinated swarm of 15+ specialized agents orchestrated by a central routing system that delegates tasks to the right specialist for each phase of a security engagement. Each agent has curated tool sets, domain-specific prompts, and shared memory. A reconnaissance agent maps the attack surface. A browser agent navigates and interacts with the application. An XSS agent handles contextual injection testing. A CVE intelligence agent researches known vulnerabilities. A deploy agent spins up target environments. A GitHub review agent analyzes pull requests. And so on - each one purpose-built for a specific class of security work. The orchestrator dynamically routes across four execution modes (direct, swarm, filtered-swarm, experiment) depending on the task, and agents delegate to each other as the engagement unfolds. This is the architecture that makes Neo’s depth possible: not one agent trying to do everything, but a team of specialists coordinating in real time. DIY cost: Multi-agent orchestration with tool isolation, agent-to-agent delegation, and dynamic routing is months of architecture work. Most DIY efforts never get past a single-agent loop. Neo cost: Ships with 15+ specialized agents, coordinated out of the box.

​

Build Your Own Agents

Neo’s agent system isn’t locked down. You can create your own specialized subagents with custom system prompts, hand-picked tool sets, custom command-based tools with inline scripts, package prerequisites, and environment variable requirements. Up to 50 custom agents per user, each shareable publicly or kept private. You can fork existing agents as a starting point, tag them for organization, and Neo handles installation and reconciliation automatically - only re-provisioning when your config actually changes. DIY cost: Building a user-facing agent creation system with tool registries, config reconciliation, and multi-tenant isolation is a platform engineering project. Neo cost: Built in. Create, fork, and share agents from day one.

​

60+ Security Tools, Ready to Go

A base LLM has no tools. It can reason about security, but it can’t do security. To get from “text generator” to “functional security agent,” you need to build and maintain a full tool layer: HTTP clients, crawlers, fuzzers, proxy integrations, browser automation, payload generators, report formatters. Neo ships with 60+ tools across 15+ categories out of the box: browser automation (15 tools), container deployment (23 tools), sandbox execution (8 tools), GitHub integration (11 tools), Linear integration (11 tools), VPN management, scheduling, web research, knowledge indexing, memory management, and more. This includes purpose-built open-source tools like Nuclei, httpx, subfinder, katana, and naabu, alongside widely adopted third-party tools like Frida, ffuf, and sqlmap. Every tool is built, tested, and maintained by the ProjectDiscovery team, the same team behind the open-source tooling used by tens of thousands of security professionals. You don’t wire anything up. You point Neo at a target and it has everything it needs to start working. DIY cost: Weeks to months of tooling development before your agent can do anything beyond making HTTP requests. Neo cost: Zero. 60+ tools ready at first login.

​

30+ Proprietary Tools Built for LLMs

Beyond OSS and third-party tools, Neo includes 30+ proprietary tools custom-built specifically for LLM-driven security workflows. These aren’t traditional security tools with an AI wrapper. Every tool is designed to produce structured outputs that models can reason over, accept natural-language parameterization, and integrate into multi-step agent workflows where context carries across actions. Here are a few examples:

• API Parsing Engine: Automatic ingestion and decomposition of OpenAPI specs, GraphQL schemas, and undocumented APIs into structured attack surfaces. Neo also dynamically discovers undocumented API endpoints by analyzing JavaScript sources loaded during browser sessions - extracting endpoints with methods, paths, and metadata grouped by source.
• Browser Network Capture: Full Chrome DevTools Protocol integration that captures every network request, response, WebSocket frame, console log, and security event during browser testing. This gives Neo deep application understanding that goes far beyond page rendering.
• Out-of-Band (OOB) Validation: Built-in OOB interaction infrastructure for confirming blind vulnerabilities (SSRF, blind XSS, blind SQLi) with real callback verification. No manual Burp Collaborator setup, no custom DNS servers.
• Cross-Site Scripting Context & Validators: Contextual XSS analysis that understands where a reflection lands (attribute, script block, event handler, DOM sink), selects context-appropriate payloads, and validates actual execution in a real browser.
• AI-Powered Deep Research: An autonomous research agent that plans and executes multi-step research operations. When Neo needs to understand a new vulnerability class or research a bypass technique, it dispatches deep research that returns synthesized intelligence - not just search results.
• Leaked Credential Intelligence: Queries breach databases for compromised credentials by domain and discovers associated/related domains for a target. Neo doesn’t just test - it checks if you’ve already been breached.
• Vulnerability Verification Engine: Structured validation workflows that confirm exploitability with evidence, separating real findings from noise.

DIY cost: Each of these is a standalone engineering project. OOB infrastructure alone can take a team weeks. Contextual XSS validation requires deep browser integration work. And none of it improves automatically. You maintain it forever. Neo cost: Included. Continuously improved by the PD team.

​

Dynamic Target Deployment

Neo can spawn, manage, and test against live application containers - autonomously. Support for 6 container types (WordPress, Docker Hub images, Dockerfiles, Docker Compose, GitHub repos, and custom images) with full lifecycle management: create, start, stop, restart, exec, read/write files, manage environment variables and ports. Point Neo at a GitHub repo or a Docker image, and it will deploy the application, configure the environment, and then test it. This is especially powerful for WordPress plugin testing, custom application testing, and dynamic analysis where you need a live target. DIY cost: Container orchestration, image analysis, GitHub repo parsing, async build pipelines, TTL-based cleanup. Each one is a serious infrastructure problem. Neo cost: Built in. Deploy and test in a single workflow.

​

Internal Network & Mobile Testing

VPN integration: Most AI security tools can only test publicly accessible targets. Neo supports 10+ VPN providers - WireGuard, OpenVPN, OpenConnect (Cisco AnyConnect, Meraki, Pulse, GlobalProtect), Tailscale, IPsec/IKEv2, Twingate, Cloudflare WARP, Netbird - so it can connect to your corporate network and test internal applications. Mobile app testing: Neo sandboxes come pre-installed with ipatool (iOS IPA downloader) and apkeep (Android APK downloader), alongside Frida for dynamic instrumentation. Neo can download iOS and Android apps, decompile them, and analyze them for security issues - all autonomously. DIY cost: VPN integration alone requires support for multiple protocols and credential management. Mobile tooling adds another layer of complexity. Neo cost: Pre-installed. Connect your VPN or point at a mobile app and go.

​

Semantic Code Intelligence

Neo runs a dedicated microservice for deep code understanding, powered by Tree-sitter parsing across 20+ languages (C, C++, C#, Go, Java, JavaScript, Python, Ruby, Rust, Swift, Kotlin, PHP, TypeScript, and more). Code is split into semantically meaningful chunks, embedded via OpenAI, and stored in a vector database for semantic search. Merkle tree-based incremental sync means large codebases index in seconds after the first run - only changed files get re-processed. The result is an always-current semantic index that Neo draws from during every engagement. DIY cost: A standalone microservice: tree-sitter integration, embedding pipeline, vector DB, incremental sync. Months of work for a single-language prototype. Neo cost: 20+ languages indexed automatically.

​

Integration Platform

Neo exposes its full API surface - custom-built for vulnerability workflows - and integrates bidirectionally with the tools your team already uses. This goes beyond MCP support:

• GitHub: Full App integration with OAuth, PR reviews, inline comments, status checks
• Linear: 11 tools covering issues, comments, projects, labels, status, teams, and attachments
• Slack: Event handling, message formatting, session management
• Jira, Notion, Confluence: Via Merge.dev connector platform with OAuth flows

Neo can create Linear tickets from findings, update Jira issues as testing progresses, notify Slack channels, and expose all of this through MCP so you can trigger Neo from Claude or any MCP-compatible client. Per-user tool filtering lets each team member enable exactly the integrations they need. DIY cost: You’re locked into the framework you built. Every integration is custom work. Neo cost: API-first. Plug into anything.

​

Tuned for Cybersecurity

An LLM with tools still isn’t a security agent. The prompting, evaluation, and feedback loops have to be specifically engineered for security workflows. Claude Code is exceptional at coding tasks because Anthropic tuned everything (prompts, evals, tool selection logic) for development. Neo does the same thing for security. This means:

• Agent behavior is optimized for discovery -> analysis -> exploitation -> verification workflows, not code generation.
• Prompt engineering is calibrated for security-specific reasoning: threat modeling, attack chaining, business logic abuse, authentication edge cases.
• Evaluation suites test for security outcomes: did the agent find real vulnerabilities, or did it generate a report full of false positives?
• Human feedback from real security engagements is fed back into the platform continuously.
• Every tool execution is wrapped in a safety layer with timeout enforcement, output size limits, automatic error recovery, malformed call repair, and secret redaction.

Same brain, different body. The model is the same. Everything around it is built for your job. DIY cost: Ongoing prompt engineering, custom eval pipelines, and continuous refinement as models change and your use cases evolve. You’re building a product. Neo cost: Battle-tested out of the box, improving every release.

​

Zero Setup Time

Building a DIY security agent means standing up infrastructure: container orchestration for sandboxed execution, browser environments, network proxy layers, callback servers, credential management, session handling, output storage. Before you run a single test, you’re deep in DevOps. Neo is fully hosted. Sign up, provide a target, run a scan. No infrastructure to provision, no dependencies to manage, no containers to orchestrate. DIY cost: Days to weeks of infrastructure work. Ongoing maintenance burden. Neo cost: Minutes from signup to first scan.

​

Sandbox Scaling That Actually Works

A single agent running a single scan is table stakes. Real security programs need parallel execution across targets, environments, and workflows simultaneously. Every Neo sandbox spins up as a fully loaded image carrying pre-installed replicas of all Neo tools, custom scripts, and your defined access controls. There’s no cold-start penalty, no dependency resolution, no environment drift. Each sandbox is identical, isolated, and ready to execute immediately. This means you can delegate tasks to hundreds of sandboxes running in parallel. Run continuous monitoring across your entire stack. Execute regression checks on previously discovered vulnerabilities while simultaneously testing new attack surfaces. Launch parallel scans across multiple applications, each with its own scope and access configuration. The scaling model isn’t “run the same scan faster.” It’s “run your entire security program concurrently.” DIY cost: Container orchestration, image management, secret distribution, parallel execution coordination, result aggregation. Each one is a serious engineering problem. Together they’re a platform. Neo cost: Built in. Scale up, scale down, no infra to manage.

​

Cost Efficiency at Scale

Long-running security workflows get expensive fast in generic LLM setups. Costs compound when the model stays in the loop for mechanical work like parsing responses, transforming data, replaying context, coordinating tools, and re-processing the same environment across many steps. Neo keeps large workflows materially cheaper by reserving model usage for actual security reasoning and pushing the mechanical work into native tools and purpose-built infrastructure. Browser automation, scanning, parsing, validation, and execution run natively instead of burning tokens on tasks that do not need intelligence. Prebuilt sandboxes remove setup overhead, and platform-level optimizations reduce repeated context and wasted model calls across multi-step runs. On large, long-running tasks, these optimizations can reduce cost by 80-90% compared to generic LLM setups. DIY cost: The longer the task runs, the more token spend, orchestration overhead, and infrastructure cost stack up. Neo cost: More of your spend goes to real security reasoning and validation, not plumbing. Large workflows stay cheaper at scale.

​

Highest Benchmark Performance

Neo consistently outperforms DIY agent setups and competing tools on standardized security benchmarks. This isn’t because the underlying LLM is different. It’s because every layer around it (tools, prompting, evaluation, verification) is purpose-built and continuously refined. The same base model that produces shallow crawls and false positives in a generic agent framework achieves deep coverage and verified findings through Neo. We’ve demonstrated this head-to-head: same model, same target, dramatically different results. DIY cost: You benchmark yourself, against yourself, with no external reference point. Neo cost: Benchmarked, measured, and improving on every release.

​

Comparison

​

The Real Question

The question isn’t can you build a security agent. You can. The question is whether your security team should spend their time maintaining AI infrastructure and agent architectures, or designing attack workflows, reviewing findings, and making your organization more secure. Neo exists so security teams can focus on security.