AWS Security Agent adds threat modeling and a Claude Code plugin!

Hi everyone, it's Shiichan! Today I've got great news for security fans. AWS Security Agent — the one that proactively hunts down threats while you build — just got a lot smarter. It even comes with a Claude Code plugin you can call from your IDE, and I got so excited about it!

AWS Blog aws.amazon.com

What was announced?

The AWS Blog announced a bundle of new features for AWS Security Agent. AWS Security Agent is a "frontier agent" first previewed at re:Invent 2025 that protects your app across the whole development lifecycle (it's now part of AWS Continuum).

Based on customer feedback, this update brings three things:

• Threat modeling (preview)
• Code review updates (preview)
• Kiro power, a Claude Code plugin, and MCP integration

Let's walk through them!

The story so far

Until now, Security Agent was best known for on-demand penetration testing tailored to your app. It even verifies whether a risk is truly exploitable before reporting it — a very grounded approach. Since the preview, that penetration testing reached general availability (GA), and a full-repository code review that reads your entire codebase in depth arrived in preview too.

But people wanted to catch threats earlier, at the design stage, and to run everything right inside the IDE they already use. This update fills exactly those gaps.

What changes

The biggest shift is that Security Agent now covers three phases with a single agent:

• Design-time: design reviews and threat modeling (preview)
• Development-time: code review (preview)
• Deployment-time: penetration testing (GA)

The old "rethink the design, fix the code, hammer it before production" flow now connects into one path. And because you can call it from Kiro, Claude Code, and MCP-capable IDEs, you don't have to bounce between tools!

Let's take a closer look

Threat modeling (preview)

It reads your design docs or source code and builds the big picture — data flows, architecture, and trust boundaries. Then it maps out who might attack, what the attack paths are, and where the weak spots might be, organizing threats with recommended mitigations using the STRIDE framework. It even prioritizes them so you know where to start. Just choose "Enable threat model" in the console and connect a repository.

Code review updates (preview)

The headline here is more integrations! On top of GitHub, it now supports GitLab and Bitbucket — both SaaS and self-hosted. Connect Confluence and it will reference your internal docs as context for reviews.

The analysis isn't simple pattern-matching; it reasons deeply over each pull request and the whole repository. It checks against your organization's security requirements and common risks to catch complex vulnerabilities other tools miss. Fixes come back as commits and remediation guidance right in your GitHub, GitLab, or Bitbucket workflow. And every finding is validated in a simulated environment to prove it's exploitable, so you're less likely to drown in false positives!

Security requirements packs

For both design and code reviews, there are managed packs that continuously check your compliance requirements:

• AWS Well-Architected Framework
• NIST CSF
• PCI DSS
• AWS best practices
• Your own requirements imported from internal docs or Confluence

Every finding maps back to your compliance posture, so you stay audit-ready as you build.

Kiro power, Claude Code plugin, and MCP

And here's the treat for developers: IDE integration! A Kiro power and a Claude Code plugin were added, and the open MCP integration lets you call the agent from any AI IDE. The Kiro power uses the AWS Security Agent MCP server, so you just talk to it. For example:

• "Set up AWS Security Agent" to get set up (it even guides you through creating or picking an Agent Space)
• "Run a full security scan on this repo" to scan the whole repository
• "help me remediate my findings" to pull findings locally and start fixing the most critical ones
• "Build a threat model for this application" to generate a threat model (saved to .security-agent/threat_model.md)

There's also an Agent hook that decides whether to run a diff scan after Kiro finishes its turn, so you can keep fixing things with your usual IDE and tooling. For Claude Code, it ships as a plugin called "AWS Agents for DevSecOps" (supporting both AWS DevOps Agent and AWS Security Agent).

Where you can use it and pricing

These features are available in the AWS commercial Regions where AWS Security Agent is offered. Check "AWS Capabilities by Region" for the per-Region status. Best of all, there's a 2-month free trial, so you can try it from the console if you're curious.

Wrap-up

• AWS Security Agent adds threat modeling (preview), code review updates (preview), and IDE integrations
• Threat modeling uses STRIDE to surface threats from designs and code, and even prioritizes them
• Code review now supports GitHub / GitLab / Bitbucket (SaaS and self-hosted) plus Confluence, and validates exploitability in a simulated environment before returning fix commits
• Security requirements packs like AWS Well-Architected, NIST CSF, and PCI DSS make audits easier
• Kiro power, the Claude Code plugin (AWS Agents for DevSecOps), and MCP let you run it straight from your IDE, with a 2-month free trial

I think this really lands for development and security teams who want security to flow seamlessly from design all the way to deployment!