JA EN
shiichan

AWS Security Agent gets budget controls and finding revalidation!

AWS What's New ★★★★ View Markdown
#aws#security#ai

Hi, it's Shii! I spotted a security update from AWS today — it might look small, but it's actually a nice quality-of-life improvement for real-world use. Let me walk you through it!

AWS What's New aws.amazon.com

What was announced?

Over on AWS What's New, AWS announced that AWS Security Agent (now part of AWS Continuum) has added budget controls and finding revalidation. AWS Security Agent is an on-demand penetration testing service that uses an AI agent to autonomously test web applications for vulnerabilities.

The story so far

Until now, security teams and DevSecOps engineers had no built-in way to cap how much a penetration test could cost or how long it could run — there was no way to control the time or cost of a test ahead of time.

On top of that, if you just wanted to confirm that a fix actually resolved a vulnerability, there was no way to check only that one finding. Even to verify a single fix, you had to re-run a full penetration test from scratch.

What changes

These two new capabilities make cost control and fix verification much easier:

  • Teams running penetration tests can now cap task hours per test, avoiding open-ended billing
  • Teams that just fixed a vulnerability can confirm the fix without re-running a full test

This should be especially welcome for security teams working within a fixed budget, and for DevSecOps teams that need to verify fixes repeatedly.

Dive Deep

Budget controls

You can now set a maximum task-hours limit for each penetration test:

  • Choose a preset value (for example, 20 or 30 hours)
  • Set a custom value
  • Or leave it with no limit at all

When the limit is reached, the test stops gracefully and all findings discovered up to that point are preserved. Billing reflects only the task hours actually used, so setting a higher limit doesn't increase cost unless the test actually needs that extra time. See the AWS Security Agent Penetration Test documentation for details.

Finding revalidation

After deploying a fix, you can now revalidate individual findings without re-running a full penetration test:

  • Select one or more findings from a completed run
  • AWS Security Agent re-tests only those specific findings against your live application
  • Results come back as either "Active" (still exploitable) or "Resolved" (fix confirmed)
  • The revalidation history stays linked to the original finding

Check the AWS Security Agent Revalidation documentation for the full walkthrough.

Wrap-up

  • AWS Security Agent (part of AWS Continuum) now supports budget controls and finding revalidation
  • Budget controls let you cap task hours via preset, custom, or unlimited settings; findings up to the limit are preserved, and billing only reflects actual usage
  • Finding revalidation re-tests only the findings you select against your live app, returning an Active/Resolved status plus history
  • A great update for security and DevSecOps teams who want tighter budget control and less overhead when confirming fixes

Related posts