AWS has declared general availability for AWS Continuum for code vulnerabilities, a security offering designed to identify code flaws, validate their exploitability, and propose fixes delivered as patches or pull requests. The service determines which vulnerabilities pose actual risk in a given environment, prioritizes them based on business impact, and suggests remediation for each one. All fixes begin in a proposal state requiring human approval before deployment, with plans to expand automation capabilities based on user-defined guardrails in future releases.
Modern threat actors equipped with frontier AI models can convert vulnerability disclosures into functional exploits within minutes, while the same tools accelerating development amplify the quantity of findings security teams must evaluate. Organizations managing extensive application portfolios often face thousands of daily scanner alerts, many requiring no action due to being unreachable, unexploitable, or already controlled by runtime protections. Traditional severity ratings fail to distinguish between critical vulnerabilities in development-only systems and medium-rated flaws adjacent to payment infrastructure. Previously, teams spent hours manually confirming exploitability and days coordinating across security, infrastructure, and application groups to assess change impact. Continuum addresses this by proving exploitability and constraining the risk profile of proposed fixes.
The service constructs a context graph drawing from code repositories and AWS environments. Users deploy a collector in the account and Region running their code, which gathers AWS Config resources and network topology data to assess whether vulnerabilities are network-reachable and what an attacker could access downstream. This graph enables Continuum to map business-critical systems, ownership structures, service interdependencies, and data flows, allowing it to identify high-value targets such as customer data repositories, payment workflows, and authentication systems, then rank each issue by proximity of its attack path to those assets.
Continuum evaluates each finding against code and environmental context, assigning an evidence level such as verdicts derived from static analysis of vulnerable code paths. For reproducible findings, the service executes the exploit in an isolated sandbox and attaches proof-of-concept documentation with reproduction procedures. Rather than risk scores alone, it generates attack paths, supporting source analysis, and blast radius assessments, while also checking whether existing defenses would intercept and block the validated attack vector.
For each validated issue, Continuum produces a fix—whether a code patch, dependency update, or configuration adjustment—and opens it as a pull request in the connected repository for review. Human approval remains mandatory: teams review and merge pull requests, preserving final decision authority. Future versions will allow organizations to establish confidence in specific remediation categories and permit Continuum to apply those fixes automatically once confidence thresholds are met, including test coverage, scope limits, and historical success metrics.
Using AWS Continuum for Code Vulnerabilities
Users access AWS Continuum through the console and navigate to Code vulnerabilities. Initial setup requires connecting a code source—either a GitHub integration or an Amazon S3 bucket—and creating an environment configured with a scanning schedule. For S3 sources, the bucket must reside in the same account and Region where AWS Continuum is enabled, with access granted through an IAM role that AWS Continuum assumes. AWS infrastructure context is optional but available by deploying an AWS Continuum collector in the account and Region where code executes and authorizing the environment to use it. Complete requirements and setup instructions appear in the AWS Continuum User Guide.
The Overview page consolidates code integrations, environments, and AWS collector status in a single view. Opening an environment displays the Issues tab, which presents validated and ranked issues rather than raw scanner output, each showing severity, status, and creation timestamp. Selecting an issue reveals its risk assessment, including exploitability rating with evidence level and validation status, likelihood based on network reachability and authentication requirements, and impact scope showing what an attacker could modify and which users or systems would be affected. A Proof section documents the source analysis supporting the verdict.
The Remediation section displays fixes already delivered as pull requests, detailing file changes, lines added and removed, and the service affected. Continuum titles generated patches as "Continuum fix" and users can view the pull request directly in GitHub. The console explicitly notes that a generated patch does not constitute a fix; teams must review and merge it, keeping final authority with the organization. A Contributing findings section identifies the specific scanner alert underlying the issue.
Pull request descriptions include the same risk assessment, remediation summary, and proof visible in the console, allowing reviewers to evaluate evidence without leaving their GitHub workflow. The Findings tab lists raw scanner findings across the environment that form the basis for issues. The Scans tab presents scan history with status, origin, and request and completion times, with options to adjust scan frequency or trigger on-demand scans. The Configuration tab manages environment settings including code and context sources, code integrations, patch generation preferences, and AWS collectors supplying AWS context.
Teams work through validated issues in priority order across each scan, reviewing evidence and scope before approving and merging trusted fixes. Every fix awaits approval, allowing backlogs to shrink while teams retain control over what deploys.
Availability and Next Steps
AWS Continuum for code vulnerabilities is available today in US East (N. Virginia) and US West (Oregon) Regions. Pricing details are available on the pricing page. Additional information is available through the AWS Continuum for code vulnerabilities product page and User Guide. Organizations can begin using the service in the AWS Continuum console and provide feedback through standard AWS Support channels.