Amazon Web Services has taken its AI-driven application security service, Continuum for code vulnerabilities, to general availability. The announcement, published on the AWS News Blog on October 22, moves the service from gated preview to a production offering security teams can deploy.
Continuum for code vulnerabilities is built around a simple but hard problem: scanners find far more than teams can fix. The service discovers code vulnerabilities, proves which ones are actually exploitable inside a customer’s own environment, ranks the resulting issues by business impact, and then proposes a fix for each one — delivered as a pull request the team reviews and merges. Every remediation starts in a Learn mode where a person approves the fix before it ships; AWS says customers will later be able to let Continuum act autonomously within guardrails they define.
How Continuum Validates A Finding
The validation pipeline starts with context. Continuum builds a context graph from two primary sources: the customer’s code repositories and their AWS environment. An optional collector runs in the account and Region where the code executes, gathering resource details such as AWS Config resources and network configuration. From that graph, Continuum learns which systems are business-critical — customer data stores, payment pipelines, authentication services — who owns them, how services depend on one another, and which data each one touches. That picture is what lets it judge whether a vulnerability is reachable over the network and what an attacker could reach from it.
Continuum ingests a customer’s existing vulnerability findings and scans code itself, then assigns each finding an evidence level. For findings it can reproduce, it runs the exploit in an isolated sandbox and attaches proof-of-concept code with the reproduction steps. The output is not a bare severity score: Continuum produces the attack path, the supporting source analysis, and a blast radius assessment, and it also evaluates whether the customer’s existing defenses — AWS WAF rules, IAM policies — would detect and stop the validated path.
From Validation To Pull Request
The workflow lives in the Continuum console. After connecting a code source — a GitHub integration or an S3 bucket — each scan produces an Issues tab of validated, prioritized items rather than raw scanner output. Opening one brings up a risk assessment: AWS’s walkthrough shows an example rated High severity with exploitability marked Exploitable at a “Static proven” evidence level, likelihood High because the service is reachable with no authentication and no user interaction, and impact Moderate because an attacker could modify business data with a blast radius reaching other users in the same tenant.
For each confirmed issue, Continuum generates a fix — a code patch, a dependency upgrade, or a configuration change — and opens it as a pull request. In the AWS example, the fix arrives as a PR titled “Continuum fix” touching four files, with the risk assessment and proof carried into the PR description so reviewers see the evidence without leaving their workflow. The console is explicit that a generated patch does not mean the issue is fixed: a person still reviews and merges it. That human gate distinguishes the current Learn mode from the planned Enforce mode, in which Continuum would apply fixes automatically once confidence gates such as test coverage and historical success rate pass.
The service is available now in US East (N. Virginia) and US West (Oregon), with pricing published on the AWS pricing page, and it works alongside Amazon GuardDuty and AWS Security Hub. The GA follows another AWS availability milestone this week, as the cloud provider continues rolling AI-assisted tooling into its core services.
Why It Matters
Security teams drown in findings, and most of the flood is noise. AWS’s own framing is blunt: a large application estate can produce thousands of scanner findings a day, many of them unreachable, unexploitable, or already neutralized by a runtime control. Generic severity scores compound the problem — a critical score on a dev-only utility looks identical to a medium score on a service one hop from a payments database. Continuum replaces the score with two questions that actually drive triage: can an attacker reach this, and what breaks if they do. It is the same evidence-first turn seen in AI-assisted vulnerability triage elsewhere this month.
The timing is deliberate. AWS notes that frontier AI models let threat actors turn a vulnerability disclosure into working exploit code in minutes, while the same models multiply the findings defenders must process. A system that proves exploitability in a sandbox and bounds the blast radius of each fix attacks both sides of that asymmetry at once. For organizations running large AWS estates, the practical effect is a shrinking backlog where every remaining item carries evidence — and where the final decision to ship still sits with the team, not the agent.
Background
Continuum is one of four AWS capabilities in the suite: threat modeling and code scanning remain in preview, AI-driven penetration testing went GA earlier, and code vulnerabilities is the gated preview that has now graduated. The launch lands weeks after AWS reported that Continuum hit 89 percent on CyberGym-E2E, a public benchmark that asks an agent to find a flaw in a real codebase, demonstrate it, and repair it without breaking project tests. Continuum joins AWS’s growing set of AI services aimed at developers and security teams alike.
Source: AWS News Blog, OOSSA
0 Comments