AWS has made Continuum for code vulnerabilities generally available in US East (N. Virginia) and US West (Oregon), four months after introducing it in gated preview. The service is designed to find and validate code vulnerabilities, then deliver fixes as patches or pull requests, with AWS positioning it as a way to cut through the volume of scanner output that security teams increasingly have to triage.
AWS Continuum moves from preview to general availability
The launch was described by principal solutions architect Esra Kayabali as a system that does more than flag potential issues. Continuum builds a context graph from connected repositories and the surrounding AWS environment, and it can optionally use a collector to bring in resource and network context from wherever the code runs.
That broader context is meant to help the product understand not only what looks vulnerable, but what is actually relevant in a specific deployment. AWS says the service can then present fixes in a way that can be automated or delivered as pull requests in the connected repositories.
Why AWS says validation matters more than raw detection
Swami Sivasubramanian, vice president of Agentic AI, and Christopher Rae, who leads AI security go-to-market at AWS, both framed the challenge as a problem of volume. Sivasubramanian said many organizations running large application estates see thousands of findings each day, while Rae said scanners often find thousands daily and “most becomes noise that doesn’t matter in your environment.”
Continuum’s answer is validation, not just ranking. Instead of relying mainly on severity scoring, the service confirms whether a finding is reachable by running the exploit in an isolated sandbox, then attaches proof-of-concept code and reproduction steps.
AWS says findings include an evidence level, such as a verdict proven by static analysis of the vulnerable code path, and the output is an attack path plus a “blast radius assessment instead of a risk score alone.”
How the AWS Continuum pricing model works
The pricing page, which is not mentioned in the announcement, shows a two-part model. One fee covers the codebase context, billed by protected lines of code per month. The other charges for inference work as findings are processed.
- Context fee: starts at $200 per million lines of code protected per month, and tiers down to $100 above ten billion.
- Inference fee: $10 per Continuum inference unit.
AWS provided worked examples to show how the pieces add up. One million lines with 100 vulnerabilities at one unit each comes to $1,200. A much larger case, with 100 million lines and 10,000 vulnerabilities at two units each, reaches $218,200.
In that larger example, AWS says $18,200 is context and $200,000 is inference, which works out to roughly $20 per validated finding. The company’s own framing of “thousands of daily findings” and the per-finding fee describe the same scale of workload from different angles.
Autonomous remediation is the longer-term goal
For now, Continuum does not apply fixes on its own. AWS says every remediation begins in a mode where the service proposes the fix and a person approves it before it ships.
The console also warns that a generated patch does not mean the issue is fixed. That caveat matters because the product is clearly moving toward greater autonomy, but AWS says it will only let Continuum apply classes of fixes automatically once confidence criteria are met, including test coverage and historical success rate.
In other words, the current release is about assisted remediation, not full hands-off repair. AWS is signaling that autonomous merging may come later, but only after the system can prove it is trustworthy enough for broader use.
Questions raised by the validation-first approach
The rollout also sparked discussion about what validation does and does not prove. Bernardo Meireles Correa, an engineer working on non-human and agent identity at Avatier, welcomed the ranking approach on LinkedIn but raised a key concern: proving exploitability in an isolated sandbox does not automatically show that the path exists in a customer’s real environment.
That is where the optional collector comes in, since it can gather AWS resource and network configuration to assess reachability. Even so, it is an added setup step rather than a default part of the workflow.
The other open question is what happens to findings that Continuum cannot prove. The documentation explains what occurs when a vulnerability can be validated, but it does not spell out a path for the rest, which means unproven findings may still require another process for triage.
What AWS Continuum says about the product boundary
The launch also fits into a broader AWS security portfolio that has drawn some confusion. InfoQ noted in July that AWS serverless hero Yan Cui questioned the overlap between products, saying, “we have the same capabilities, two product names, and no clarity on which one you should use.”
That boundary is still visible in the documentation. The Continuum user guide covers code vulnerabilities, while a separately titled AWS Security Agent User Guide handles penetration testing and threat modeling.
Only the code vulnerabilities capability is now generally available. Penetration testing remains separately priced at $50 per task-hour, and threat modeling, which AWS announced in preview in June, still has no published pricing.
What matters for teams evaluating the service
For security and platform teams, the appeal of Continuum is not just that it finds problems, but that it tries to narrow the list to the issues that are actually exploitable in context. That can matter in environments where the more common problem is not a lack of findings, but too many findings to investigate well.
Still, the product’s usefulness will likely depend on how well its validation aligns with a real application’s architecture, how much setup the context collection requires, and how much trust teams are willing to place in AWS’s remediation workflow. The eventual shift from human approval to automated fixing will likely be the feature that gets the closest scrutiny.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: November 7, 2026 at 10:33 pm
2 views
