AWS has announced the general availability of AWS Continuum for code vulnerabilities. This new security service identifies exploitable code flaws and delivers fixes as patches or pull requests. The system confirms which findings are actually dangerous in your specific environment and ranks them by business impact.
Context-Driven Vulnerability Validation
Threat actors use artificial intelligence to turn vulnerability disclosures into working exploit code in minutes. At the same time, development tools generate thousands of findings daily. Many of these findings are unreachable or already mitigated by runtime controls. Generic severity scores often fail to distinguish between a critical issue in a development utility and a medium issue in a service connected to a payments database.
Continuum builds a context graph using data from your code repositories and your AWS environment. You set up a collector in the account and region where your code runs. The collector gathers resource details such as AWS Config resources and network configuration. This allows the service to judge whether a vulnerability is reachable over the network and what a threat actor could reach from it.
The system learns which systems are business-critical, who owns them, and how services depend on one another. It identifies high-value targets like customer data stores and payment pipelines. It then ranks each issue by how close its attack path runs to those systems. This approach replaces generic risk scores with a clear picture of actual exposure.
Automated Remediation with Human Oversight
Continuum analyzes each finding against your code and environment context. It assigns an evidence level to each verdict. For findings it can reproduce, the service runs the exploit in an isolated sandbox. It attaches proof-of-concept code with reproduction steps. It produces the attack path, supporting source analysis, and a blast radius assessment.
For each confirmed issue, Continuum generates a fix. This can be a code patch, a dependency upgrade, or a configuration change. The service opens the fix as a pull request in your connected repository. Every fix requires human approval. You review and merge the pull request. The final decision stays with your team.
In the future, you will be able to decide which actions Continuum can take on its own. You can define guardrails for specific remediation classes. The service will apply fixes automatically once its confidence gates pass. These gates include test coverage, scope bounds, and historical success rates.
The service is now available in the US East (N. Virginia) and US West (Oregon) Regions. You can access it through the AWS Continuum console. For pricing details, visit the AWS pricing page. To learn more, visit the AWS Continuum for code vulnerabilities product page and the User Guide.
Source: AWS
