Key points
- AWS Continuum for code vulnerabilities is now generally available as a security service.
- The tool validates whether findings are exploitable in the specific environment context.
- Proposed fixes are delivered as pull requests requiring human approval before merging.
AWS Continuum for code vulnerabilities is now generally available, offering a new approach to managing software defects. According to the AWS News Blog, the service uses artificial intelligence to automatically find, validate, and prioritize code vulnerabilities within an organization’s environment. Instead of leaving security teams to manually triage thousands of scanner alerts, the system delivers ready-to-review fixes as pull requests. This shifts the workflow from hours of manual investigation to a streamlined review process.
By the numbers
- The service reduces manual investigation time from hours to automated validation.
- Coordination across security, infrastructure, and application teams previously took days.
- Large application estates often produce thousands of findings per day from scanners.
What the figures mean
The shift to general availability addresses the speed at which threat actors can now generate exploit code. According to AWS, frontier AI models allow attackers to turn vulnerability disclosures into working exploits in minutes. This acceleration increases the volume of findings that security teams must process. Traditional scanners produce thousands of daily alerts, many of which are unreachable or already mitigated by runtime controls. Generic severity scores fail to distinguish between a critical flaw in a dev-only utility and a medium-risk issue near a payments database.
What to watch
AWS Continuum builds a context graph using data from code repositories and the AWS environment. A collector gathers resource details, including AWS Config resources and network configurations, to determine if a vulnerability is reachable over the network. The system identifies business-critical systems, such as customer data stores and authentication services, and ranks issues by their proximity to these assets. For confirmed issues, it generates fixes like code patches or dependency upgrades and opens them as pull requests in connected repositories.
Infection and persistence in general
Teams usually encounter vulnerability alerts through static analysis or dynamic scanning tools. These tools identify potential flaws but rarely confirm whether an attacker can actually reach the vulnerable code in production. Analysts typically examine network paths, identity permissions, and runtime controls to determine true exploitability.
Persistence often relies on unpatched dependencies or misconfigured access policies that allow lateral movement. Security operations should focus on validating the attack path rather than relying solely on severity scores. They must check whether existing defenses, such as web application firewalls or identity policies, block the specific exploit scenario.
What to do and how to stay safe: AWS
- Review the context graph to understand which systems are classified as business-critical and how services depend on one another.
- Verify that the collector is properly gathering resource details from the AWS accounts and regions where your code runs.
- Establish a process for reviewing and approving pull requests generated by the service before merging them into repositories.
- Monitor the evidence levels assigned to findings to prioritize those with proven static analysis or sandbox reproduction.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does AWS Continuum automatically apply fixes to my code?
No, every remediation currently requires human approval. You must review and merge the pull request yourself, though automatic application may be added in the future.
How does the service determine if a vulnerability is exploitable?
It builds a context graph from your code and AWS environment to judge network reachability and attack paths toward business-critical systems.
Can the service evaluate existing defenses against a vulnerability?
Yes, it evaluates whether controls like AWS WAF rules and IAM policies would detect and stop the validated attack path.
