On 22 October 2026, AWS announced that AWS Continuum for code vulnerabilities is now generally available. It is a security service that takes the findings your scanners already produce, checks which ones are actually exploitable in your AWS environment, ranks them by business impact and opens a fix as a pull request for your team to review.
For most engineering teams, the problem is not finding vulnerabilities. It is the long list of alerts that nobody has time to investigate. This guide explains what AWS Continuum does, how it works, what it costs and a practical plan to pilot it without losing control of what ships to production.
Why Vulnerability Backlogs Keep Growing
In the AWS News Blog launch post, AWS points out that threat actors using frontier AI models can turn a vulnerability disclosure into working exploit code in minutes, while the same AI tools that speed up development also increase the number of findings teams must process. Many of those findings need no action at all: a finding can be unreachable, unexploitable or already blocked by a runtime control.
Generic severity scores do not capture that context. As AWS puts it, a critical score on a dev-only utility looks the same as a medium score on a service one step away from a payments database.
What Is AWS Continuum for Code Vulnerabilities?
AWS Continuum is AWS’s service for discovering, prioritizing, validating and remediating security risks across the software lifecycle. It currently has two capabilities:
- Continuum for code vulnerabilities (newly GA): finds, validates and remediates first-party code vulnerabilities. According to the AWS Continuum User Guide, it integrates with GitHub and Amazon S3 for code and context.
- Continuum for penetration testing: the on-demand penetration testing agent formerly known as AWS Security Agent.
Continuum is model agnostic. AWS uses multiple frontier models on your behalf and picks the right one for each task, so you do not need to procure model access or build your own AI scanning pipeline.
How It Works: Four Phases
The AWS Security Blog describes four continuous phases.
1. Discovery
Continuum ingests your existing vulnerability backlog and runs its own scan of your code. To understand your environment, it builds a context graph from your code repositories and your AWS account. You set up a collector in the account and Region where your code runs; it gathers resource details such as AWS Config resources and network configuration.
2. Prioritization
Using that graph, Continuum works out which systems are business-critical, who owns them, how services depend on each other and which data they touch. It identifies high-value systems such as customer data stores, payment pipelines and authentication services, then ranks each issue by how close its attack path runs to them.
3. Validation
Each finding gets an evidence level, for example a verdict proven by static analysis of the vulnerable code path. For findings it can reproduce, Continuum runs the exploit in an isolated sandbox and attaches proof-of-concept code with reproduction steps. Instead of a single risk score, you get the attack path, the source analysis, a blast radius assessment and a view of whether your existing defenses would detect or stop the attack.
4. Remediation
For every confirmed issue, Continuum generates a fix (a code patch, a dependency upgrade or a configuration change) and opens it as a pull request in your connected repository. Every fix requires human approval. You review and merge the pull request, and the console states clearly that a generated patch does not mean the issue is fixed. AWS says that in future you will be able to let Continuum apply specific classes of fixes automatically once confidence gates such as test coverage, scope bounds and historical success rate are met.
Continuum works alongside existing AWS security services, including Amazon GuardDuty and AWS Security Hub, rather than replacing them.
Availability and Pricing
At launch, Continuum for code vulnerabilities is available in the US East (N. Virginia) and US West (Oregon) Regions. The AWS Continuum pricing page lists two pay-as-you-go dimensions with no upfront costs or minimum fees:
- Context fee: a monthly charge based on the lines of code Continuum protects, starting at $200 per 1 million lines for the first 10 million lines, with lower rates as your codebase grows.
- Inference fee: $10 per Continuum inference unit (CIU) for the security work performed.
AWS’s own small-codebase example (1 million lines of code, 100 vulnerabilities processed, an assumed average of 1 CIU each) comes to an estimated $1,200 per month. Actual inference varies with the work each vulnerability needs, so treat this as a starting point for your own estimate. Continuum for penetration testing is priced separately at $50 per task-hour, and new customers receive a 2-month free trial with up to 400 task-hours per month.
A Practical Plan to Pilot AWS Continuum
Based on the setup flow AWS describes, here is how we would approach a first rollout.
- Pick one high-value application. Start with a service close to customer data or payments, where prioritization makes the biggest difference.
- Connect a code source. In the Continuum console, go to Code vulnerabilities and connect either a GitHub integration or an Amazon S3 bucket. An S3 source must be in the same account and Region where you enable Continuum, and access is granted through an IAM role that Continuum assumes.
- Create an environment and scan schedule. An environment scans your code on a schedule you choose. You can change the frequency or queue a scan on demand from the Scans tab.
- Add AWS context. Optionally set up a Continuum collector in the account and Region where the code runs.
- Review issues, not raw findings. The Issues tab shows validated, prioritized issues, while the Findings tab keeps raw scanner output as evidence. Work through issues in priority order.
- Keep humans in the loop. Route Continuum pull requests through your normal code review and CI/CD checks. Merge only fixes your team understands.
- Measure and expand. Track how many issues were confirmed, how many were false positives and how long fixes took.
Tools like this work best when your pipeline is already healthy. If pull requests sit for weeks or tests are flaky, automated fixes will queue up too. Our cloud DevOps services team often starts there, while our security, governance and compliance practice helps define the guardrails, ownership and approval rules that make AI-driven remediation safe.
Frequently Asked Questions
Does AWS Continuum merge fixes automatically?
No. At general availability, every fix is opened as a pull request and needs human approval. AWS says graduated autonomy for specific fix types will come in the future, within guardrails you define.
Which code sources does AWS Continuum support?
Continuum for code vulnerabilities integrates with GitHub and Amazon S3. An S3 bucket must be in the same account and Region where Continuum is turned on.
Is AWS Continuum available in the Mumbai Region?
Not at launch. Continuum for code vulnerabilities is available in US East (N. Virginia) and US West (Oregon). Check the AWS Region table for updates before planning a rollout with data residency requirements.
Does AWS Continuum replace GuardDuty or Security Hub?
No. AWS positions Continuum as working alongside existing services such as Amazon GuardDuty and AWS Security Hub.
Want Help Cutting Your Security Backlog?
Shanav Technologies helps startups and growing businesses build secure, well-governed AWS environments and DevOps pipelines. If you want help deciding whether AWS Continuum fits your codebase, estimating its cost or setting up safe review workflows, talk to our team and we will help you plan a focused pilot.