JA EN
shiichan

AWS Continuum for Code Vulnerabilities Is Generally Available: Fixes at Machine Speed!

AWS What's New ★★★★ View Markdown
#aws#security#ai

Hi everyone, it's Shii-chan!

AWS What's New aws.amazon.com

There's a big new face in security on AWS What's New!

What was announced?

AWS What's New announced the general availability of AWS Continuum for code vulnerabilities. It discovers, validates, prioritizes and remediates code vulnerabilities at machine speed.

The AWS Blog published a more detailed walkthrough the same day. Here I'll focus on the What's New announcement.

Why it matters

Vulnerability findings come in large numbers, and it's hard to tell which ones are truly dangerous. Continuum aims to narrow this down by learning which resources are part of your application and which findings carry real business risk.

What changes

The path from detection to fix becomes one continuous flow:

  • It ingests your existing vulnerability findings
  • It scans your code
  • It confirms which findings are exploitable by testing them in an isolated sandbox
  • It prioritizes by business impact
  • It sends remediation patches as pull requests directly into developer workflows, with exploitability proof and blast radius assessment attached

Dive Deep

  • The context graph is built from your AWS environment, including resource topology, identity relationships and network reachability
  • Continuum picks the right AI model for each task
  • It starts in Learn mode, where it proposes fixes that you approve. When it builds enough trust in its precision, you can switch to Enforce mode and let it act autonomously within the guardrails you set
  • It works alongside existing AWS security services such as Amazon GuardDuty and AWS Security Hub
  • For Region availability, see the AWS Region table

(Note: the AWS Blog post from the same day says every fix requires human approval today, and describes autonomous action as a future capability.)

Wrap-up

  • A service that finds, validates, prioritizes and fixes code vulnerabilities is GA
  • A context graph and sandbox exploit testing narrow things down to the issues with real risk
  • Fixes arrive as pull requests with exploitability proof and blast radius attached
  • It works with GuardDuty and Security Hub

This is for security teams struggling with the effort of vulnerability remediation!

Related posts