Pulumi: Infrastructure Automation Ledger 2026 Scorecard

Part of the Infrastructure Automation Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: product (Apache 2.0 engine and CLI with Pulumi Cloud; self-hosting on the Enterprise edition only)
Owner: Pulumi Corporation, Seattle, private and venture backed; last round found is a $41 million Series C in 2023; no acquisition
Engine: Pulumi open source engine and CLI (Apache 2.0) with native and Terraform-bridged providers
Licence: Engine Apache 2.0 with no change found. Pulumi Cloud editions (2026-10-15): Free ($0, one user), Essentials ($40 a month, up to 500 resources), Pro ($400 a month, up to 2,000 resources), Enterprise ($2,000 a month, up to 4,750 resources); resources billed hourly above the included amount; Neo at $3 per million tokens on paid editions
Latest release: v3.269.0 (2026-10-15); minor releases roughly weekly
Support lifecycle: Single rolling 3.x line since 2021-04-19; no support policy page found (the documented URL returned 404)
Next milestone: none published
Targets: vSphere: pulumi/pulumi-vsphere, Pulumi maintained, bridged from the Broadcom-maintained Terraform provider, v4.18.2 (2026-10-13). Proxmox VE: muhlba91/pulumi-proxmoxve, community, v8.6.0 (2026-09-06). Nutanix: pierskarsenbarg/pulumi-nutanix, community, v0.18.0 (2026-10-02). Hyper-V: pulumi/pulumi-hyperv repository exists with no releases. XCP-ng: Xen Orchestra provider maintained by Vates, listed in the Pulumi Registry (release date not retrieved). KubeVirt: through pulumi-kubernetes v4.34.2 (2026-09-21) as custom resources, no dedicated package. Any Terraform provider can be bridged from the OpenTofu registry
Tier: Infrastructure-as-code engine
Archetype: Real innovator
Evidence grade: B. The pricing page, licence, release feed, MCP and drift documentation and the 1.0, 2.0 and 3.0 changelog entries were read from primary sources. The 3.x release history between 2021 and mid 2026 was not retrieved, so the yearly line between 2019 and 2025 holds few steps. Pricing history and funding come from a tracker and news (grade B); Neo's GA date and the support policy were not found (grade C).

Scorecard

Dimension	Score	Direction
Capability today	60.7 / 100	higher is better
Momentum since end of 2022	+13.9 points (2018 to 2022: +18.2)	higher is better
Credibility	17.0 / 25	higher is better
Commercial risk	11.0 / 25	lower is better
Technical lock-in	8.0 / 25	lower is better
Integrator fit	12.5 / 20	higher is better
AI leverage	8.5 / 20	higher is better
Ledger Index	61.2 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Provisioning breadth (15)	n/a	3	3	3.5
Configuration management depth (12)	n/a	0.5	0.5	0.5
State, planning and safety (12)	n/a	3	3	4
Language and authoring (10)	n/a	4.5	4.5	4.5
Orchestration and self-service (10)	n/a	2.5	2.5	3.5
Scale and control plane (8)	n/a	3	3	3
Security and compliance (10)	n/a	2.5	2.5	4
Bare metal and day-2 operations (8)	n/a	0.5	0.5	0.5
Ecosystem and integrations (8)	n/a	3	3	3.5
AI assistance (7)	n/a	0	0	3
Total / 100	n/a	46.8	46.8	60.7

Year by year: 2018: 28.6 · 2019: 46.8 · 2020: 46.8 · 2021: 46.8 · 2022: 46.8 · 2023: 46.8 · 2024: 50.0 · 2025: 50.7 · 2026: 60.7

What moved the score

Year	Domain	Change	Points	Trigger
2019	Ecosystem and integrations	1.5 → 3	+2.4	1.0: CI integrations, webhooks, GitHub app
2019	Language and authoring	3.5 → 4.5	+2.0	1.0: stable SDKs in TypeScript, JavaScript, Python and Go with the languages' own test frameworks
2019	Orchestration and self-service	1 → 2.5	+3.0	1.0: Pulumi Cloud with RBAC, REST API, webhooks and CI integrations
2019	Provisioning breadth	2 → 3	+3.0	1.0: stable providers for AWS, Azure, GCP, Kubernetes and DigitalOcean
2019	Scale and control plane	1.5 → 3	+2.4	1.0: Pulumi Cloud as the hosted control plane
2019	Security and compliance	1 → 2.5	+3.0	1.0: Pulumi Cloud RBAC and encrypted secrets
2019	State, planning and safety	2 → 3	+2.4	1.0: preview, checkpointed state in Pulumi Cloud, import
2024	Security and compliance	2.5 → 3.5	+2.0	ESC secrets and configuration GA (2024-09-18)
2024	State, planning and safety	3 → 3.5	+1.2	Insights 2.0 preview with inventory, policies and remediation (half step)
2025	AI assistance	0 → 0.5	+0.7	Neo in public preview (2025-09-16)
2026	AI assistance	0.5 → 3	+3.5	Neo CLI, GitHub and Slack apps (2026-05); vendor states Neo generally available; hosted MCP server with scoped tokens
2026	Ecosystem and integrations	3 → 3.5	+0.8	Any Terraform provider from the OpenTofu registry; Terraform state and HCL support; Neo GitHub and Slack apps
2026	Orchestration and self-service	2.5 → 3.5	+2.0	Deployments gain drift remediation and VCS settings (3.264.0), scheduled tasks and agent accounts (2026-05)
2026	Provisioning breadth	3 → 3.5	+1.5	Terraform state, cross-language modules and HCL support (2026-08-04); community Nutanix package v0.18.0 (2026-10-02)
2026	Security and compliance	3.5 → 4	+1.0	3.258.0: opt-in credential encryption; policy violations in pull request checks (2026-09-14)
2026	State, planning and safety	3.5 → 4	+1.2	3.264.0: deployment settings for drift remediation; Terraform state support (2026-08-04)

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-10	Pulumi ESC secrets and configuration service, preview	Security	V
2024-09	ESC generally available	Security	V
2024-09	Insights 2.0 inventory, policies and remediation, preview	State and planning	V
2025-09	Neo AI platform engineering agent, public preview	AI	V
2026-05	Neo CLI, GitHub and Slack apps, scheduled tasks, agent accounts, MCP bridge	AI	V
2026-06	Neo billed per token	Packaging	P
2026-07	Migrate CloudFormation and ARM estates with discovered stacks	Provisioning breadth	M
2026-08	Full support for Terraform state, cross-language modules and HCL	Ecosystem	M
2026-08	Experimental Rust support; Context API	Language	V
2026-08	3.258.0: opt-in credential encryption with an OS-protected key	Security	C
2026-08	Neo Security, research preview for invited customers	AI	V
2026-09	Policy violations shown in pull request comments and checks	Security	C
2026-09	3.264.0: deployment settings for drift remediation and VCS	State and planning	C
2026-09	Tiers renamed; Enterprise moves to a $2,000 a month self-serve base	Packaging	P
2026-10	3.268.0: Automation API gains version, whoami and install	Orchestration	C

Centre of gravity: Security (4), AI (3), State and planning (2)
Blind spots (no items): Configuration management, Scale, Bare metal, Licensing
Driver mix: Vision 47%, Customer need 27%, Market window 13%, Upstream 0%, Portfolio 13%
Idea-to-need index: 0.54 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 17.0 / 25

Criterion	Score	Basis
Cadence	4	A minor roughly every week (3.266.0 on 2026-09-30 to 3.269.0 on 2026-10-15); the rhythm is visible but not published
Roadmap transparency	3	Open repository, changelog, blog and release notes; no dated roadmap found
Say-do	3	ESC went from preview to GA in 11 months; Insights 2.0 and Neo have no dated GA announcement, so one of three trackable previews is clearly closed
Velocity	4.5	Many capabilities a month across the engine, Deployments and Neo
Lifecycle stability	2.5	One rolling 3.x line with no forced upgrades, but no support policy page and tiers renamed twice in 2026

Commercial risk: 11.0 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	3.5	Engine licence unchanged; the cloud service added per-token Neo pricing (2026-06-17), renamed every tier (2026-09-21) and repriced Enterprise (2026-09-28)
Purchase constraints	2	Free edition for one user; self-hosting only on Enterprise at $2,000 a month; compliance policy packs and SCIM on Enterprise only
Channel and access	1	Open source CLI, self-serve signup, AWS Marketplace listing; partner terms not published
Owner stability	2.5	Independent venture-backed company; last funding round found is 2023; no acquisition
Cost of staying supported	2	No version windows to manage; paid support add-ons from $625 a month (tracker, not read at Pulumi)

Technical lock-in: 8.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	2	Programs in general-purpose languages; JSON checkpoint state is documented
Export path	2.5	No documented export to another IaC tool; the conversion path runs into Pulumi, not out of it
Stack coupling	0.5	Any backend (Pulumi Cloud, S3 and compatible, Azure Blob, GCS, PostgreSQL, local file)
Hardware / cloud coupling	1.5	Pulumi Cloud is the default and hosts ESC, Deployments, Neo and Insights; self-managed backends cannot recover from some partial failures
Skills and tooling coupling	1.5	Ordinary programming skills plus the Pulumi resource model

Integrator fit: 12.5 / 20

Criterion	Score	Basis
Partner programme openness	2.5	Partners page lists cloud, technology and integrator partners; no tiers, criteria or certification stated
Multi-tenancy and self-service	3.5	Organisations, teams, RBAC with custom roles (25 on Pro, unlimited on Enterprise), SCIM on Enterprise, templates
API and infrastructure-as-code	4.5	REST API plus the Automation API in Node.js, Python and Go
Skills and certification	2	No certification found; general language skills are common, Pulumi-specific experience is rarer

AI leverage: 8.5 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI code and plan generation	0	0	3	2026: Neo generates and applies infrastructure changes inside Pulumi Cloud under RBAC and policy; the vendor states it is generally available, billed per token; Neo CLI since 2026-05-20
AI platform stack	0	0	0	2018: None
AI-assisted operations	0	0	2	2026: Neo scheduled tasks and pulumi do (2026-05) run operations work; Neo Security is a research preview (2026-08-28)
Agent openness	2	2	3.5	2026: Hosted MCP server at mcp.ai.pulumi.com with organisation-scoped tokens, agent accounts (2026-05); the server does not run pulumi up itself and its GA status is not stated

Year by year: 2018: 1 · 2019: 2 · 2020: 2 · 2021: 2 · 2022: 2 · 2023: 2 · 2024: 2 · 2025: 2.5 · 2026: 8.5

AI say-do, 2023 to 2026: 4 AI items announced; 2 GA, 2 still preview, 0 pending, 0 dropped. Neo's GA rests on the vendor product page and per-token billing; no dated GA announcement was found. The MCP bridge and Neo Security remain previews.

Pulumi is the only product in this group with an in-product agent that writes and applies changes, and the only one that bills AI by the token. The buyer-side gap is proof: no dated GA post for Neo, no stated GA for the MCP server, and the benchmark that supports the claims is the vendor's own.

Reading

Pulumi's engine has not changed its licence or its major version since 2021, and the language and authoring score has been near the top of the group since 1.0. What moves is the cloud service: ESC, Insights, Deployments and Neo arrived as vision items, and in 2026 the tiers, prices and the AI agent all changed within four months. The commercial risk score sits below Terraform's because the engine is Apache 2.0 and the owner is unchanged, and above OpenTofu's because self-hosting, drift remediation and compliance packs are gated to paid editions. Check the state backend decision first: leaving Pulumi Cloud for a self-managed backend gives up ESC, Deployments and Neo, and no export path to another IaC tool is documented.

Open questions and items to re-score

Dated GA announcements for Neo, the MCP server and Insights 2.0.
The CLI support and versioning policy page returned 404; no support window could be read.
Whether the Hyper-V package (pulumi/pulumi-hyperv, no releases) is usable; Hyper-V counts as uncovered.
The Xen Orchestra provider's release date and the Nutanix package's maintenance beyond one individual.
FIPS builds and air-gapped self-hosting of Pulumi Cloud Enterprise were not found.
Pricing before 2026-05 is not on record; the tracker's Free tier Neo allowance conflicts with the pricing page.
The 3.x release history between 2021 and 2026-08 was not retrieved; the yearly capability line between those dates is held flat.