AI Security
AWS Continuum Brings AI-Powered Security Automation to Enterprise Codebases
Amazon's new integrated platform automates vulnerability discovery and remediation across the entire software development lifecycle using agentic AI capabilities.
InfoQ
Amazon Web Services has unveiled AWS Continuum, an integrated security platform designed to automatically identify, enforce, and remediate security weaknesses across applications, their dependencies, and source code. The service launches with four autonomous AI capabilities that cover the complete vulnerability lifecycle: penetration testing, code review, threat modelling, and vulnerability management.
What AWS Continuum Does#
The platform operates across a continuous four-stage process. In the discovery phase, it scans an organization's entire codebase and infrastructure environment to create a comprehensive list of potential vulnerabilities and associated attack paths. The service then prioritizes findings by validating whether vulnerable components are actually deployed and accessible, while assessing business impact. AWS notes that the ability to construct working proof-of-concept exploits in sandboxed environments significantly reduces false positives.
During validation, the tool confirms which vulnerabilities pose real risk. Finally, in the remediation phase, it proposes fixes—ranging from network policy adjustments to code patches—while showing teams the scope of proposed changes and potential rollback strategies.
Four Agentic Capabilities#
The platform's penetration-testing and code-review functions launched alongside AWS Security Agent in late 2025 and are now generally available. Developers can run on-demand penetration tests and automated code reviews either manually or within CI/CD pipelines to catch compliance gaps and security flaws.
The threat-modelling capability—currently in preview—lets teams analyze application architectures to identify security risks. It generates system overviews and risk assessments, with each threat labeled by severity, STRIDE classification, and mitigation guidance.
The code-vulnerabilities capability, still in gated preview, reasons across an organization's full security context: infrastructure, access permissions, network design, documentation, and business goals. AWS built it with a model-agnostic approach, allowing it to adopt new AI models as they emerge.
