AWS Continuum for code vulnerabilities is now generally available as a new security service.
This service utilizes artificial intelligence to automatically locate, verify, and prioritize vulnerabilities within an operational environment. It then furnishes ready-to-review patches as pull requests, substantially reducing what previously required hours of manual inspection and days of inter-team coordination.
AWS Continuum for code vulnerabilities confirms exploitability within your specific environment and ranks resulting issues based on business impact. Furthermore, it proposes a resolution for every identified problem. Initially, every remediation proceeds with Continuum proposing the fix, requiring subsequent human approval before deployment. Future iterations will allow operators to define guardrails for autonomous actions by Continuum.
The proliferation of findings is amplified because threat actors can transform a vulnerability disclosure into working exploit code in mere minutes using frontier artificial intelligence (AI) models. For organizations managing extensive application portfolios, scanners often generate thousands of daily findings, many of which are irrelevant. Generic severity scores fail to indicate which resources a threat actor can actually reach, meaning a critical score on a development utility may mirror a medium score on a service near a payment database.
To bridge this gap, Continuum validates which findings are exploitable and quantifies the risk associated with each proposed fix. It constructs a context graph using data from both code repositories and the AWS environment. For AWS integration, a collector must be established in the relevant account and Region to gather resource details, such as network configuration and AWS Config resources, allowing Continuum to assess network reachability.
From this established graph, Continuum discerns critical systems, ownership, service dependencies, and data exposure. It uses this knowledge to pinpoint high-value assets—like payment pipelines, authentication services, and customer data stores—and subsequently ranks issues based on how closely their attack path approaches these critical systems. Continuum assigns an evidence level to each finding by analyzing it against the code and environmental context, such as a verdict proven through static analysis of the vulnerable code path.
For findings it can reproduce, Continuum executes the exploit in an isolated sandbox, attaching proof-of-concept code and reproduction steps. Instead of just a risk score, it delivers the attack path, supporting source analysis, and a blast radius assessment. It also evaluates whether existing defensive measures would detect and halt the validated path. For every confirmed issue, Continuum generates a fix—a configuration change, dependency upgrade, or code patch—and submits it as a pull request to the connected repository, ready for review.
The implementation workflow involves setting up an environment by connecting a code source, such as an Amazon S3 bucket or GitHub integration, and scheduling scans. If AWS infrastructure context is desired, an AWS Continuum collector is configured in the relevant account and Region. The Issues tab then presents validated, prioritized problems, detailing the risk assessment, which includes factors like Exploitability, Likelihood, and Impact.
The operational oversight remains with the team, as every generated patch requires human approval before merging. This mechanism ensures that while the backlog shrinks, the final deployment decision rests with the organization. AWS Continuum for code vulnerabilities is presently available in US East (N. Virginia) and US West (Oregon) Regions.
This capability addresses the increasing complexity faced by platform operators as development tools accelerate discovery, necessitating a shift from volume-based triage to context-aware risk management. Institutions managing large estates must now integrate deep environmental context to effectively manage the flood of security findings generated by modern development pipelines.
