Snapshot
Continue to About ↓- What it does
- Neo is ProjectDiscovery's AI-powered offensive-security platform that autonomously pentests web apps, APIs, code and internal networks.
More detail
- Its agents sign in as real users, prove findings with working exploits, open fix pull requests with regression tests, and retest after each fix or deploy.
- Best for
- Security engineers, AppSec teams, bug bounty hunters, MSSPs and startups that want proof-backed, automated app and API pentesting tied into pull requests.
More detail
- Enterprises needing private deployment, SSO/SAML, BYOK or more than five seats can move to the Enterprise tier.
- Pricing
- Free is $0 with one seat and limited one-time usage on standard models, no credit card required.
More detail
- Pay as you go is $200 per seat per month for up to five seats, with $400 giving 2x and $800 giving 5x the weekly usage allowance
- annual billing is $2,100/$4,200/$8,400 per seat per year, paid upfront wi
- Main limitation
- Teams needing more than five self-serve seats, SSO/SAML, dedicated infrastructure or BYOK must go through Enterprise sales.
More detail
- Mobile app security is still labeled Beta, and Free is one-time limited usage rather than a recurring allowance.
- Record
- Living and monitored
- Reviewed
- Evidence
- Public web research
- Machine access
- Structured profile ↗
About
- Neo is ProjectDiscovery's AI-powered offensive-security platform that autonomously pentests web apps, APIs, code and internal networks.
- Its agents sign in as real users, prove findings with working exploits, open fix pull requests with regression tests, and retest after each fix or deploy.
What it helps with
- Scanners produce noisy, unproven findings; Neo replays each finding against the live target and reports it only when the
- Automated scanners miss business-logic flaws such as coupon stacking, cross-tenant invoice reads and reusable reset toke
- Security tooling is fragmented across separate scanners; ProjectDiscovery positions Neo as one connected system for exte
- Remediation stalls after a ticket is filed; validated findings come with a fix pull request and a regression test
- Fixes regress after shipping; the original exploit and variants are replayed against the patch
- New CVEs outpace manual triage; detections land in the open-source library within hours and assets are rechecked on the
Capabilities
A practical view of what is available and where limitations apply.
| Offering | Available | Detail |
|---|---|---|
| Autonomous app and API pentesting | Yes | Agents sign in through SSO and TOTP MFA and test signed-out, member and admin roles across authenticated routes |
| Proof-backed findings with exploit replay | Yes | A verifier reproduces each claim against the live or preview target before it is reported |
| Fix pull requests with regression tests | Yes | Each validated finding gets a PR for the fix and a regression test, then retesting after it ships |
| PR security review | Yes | Reads the diff against a repository-wide threat model, runs the exploit in a preview build and comments on the offending line |
| Attack surface discovery across external, internal, cloud and code | Yes | One asset inventory covering domains, IPs, internal hosts, cloud resources, buckets and repositories |
| Internal network scanning | Yes | Announced July 21, 2026 per the official blog listing |
| Cloud security for AWS, GCP and Azure | Limited | Listed on the pricing page as Beta |
| Mobile app security | Limited | Listed on the pricing page as Beta |
| Model choice and bring your own key | Limited | Frontier model selection on paid tiers; BYOK only on Enterprise |
| SSO/SAML, dedicated VPC and private network access | Limited | Enterprise-only per the pricing page |
Bot trust
How confidently AI systems can verify this profile from public evidence.
—of 100
ChatGPT—/100
Claude—/100
This profile has not completed a Bot Score assessment yet.
Evidence
Where this record came from, when it was reviewed, and how confidently it can be used.
- Verification
- Scribble researched these facts from the linked public sources.
- The owner has not manually confirmed every field.
- Last reviewed
- Primary source
- projectdiscovery.io
Technical profile details
Record ID
39790505-0047-4366-9ac3-1cde5ad6d519Canonical URLhttps://profiles.scribble.network/listing/projectdiscovery-39790505