AWS Continuum uses AI to manage code vulnerabilities
▼ Summary
– AWS Continuum for code vulnerabilities is now in gated preview, managing vulnerabilities from discovery to fix by reasoning over customer environments and confirming real findings.
– It is model agnostic, using multiple frontier models for tasks they perform best, and designed to incorporate newer models as available.
– The system operates in four phases: discovery, prioritization (based on deployment context and business impact), validation (filtering false positives and building exploit examples), and mitigation/remediation (recommending network changes, policy changes, or code patches with blast radius visibility).
– It reasons over both structured data (infrastructure, permissions, code) and unstructured data (documents, communications, business priorities).
– Continuum starts in learn mode with human review, can be moved to enforce mode for automated remediation, and integrates existing tools like AWS Security Agent pen testing and code scanning, plus new threat modeling in STRIDE format.
AWS has launched AWS Continuum for code vulnerabilities in gated preview, a system designed to manage the full lifecycle of a vulnerability from discovery through remediation. The platform analyzes a customer’s environment, verifies which findings are genuine, and drives toward resolution. It is model agnostic, leveraging multiple frontier models and assigning each to tasks where it performs best. AWS built it to incorporate newer models as they become available.
“We need to shift to the new world: telemetry, context, reasoning, and actions. An approach that produces outcomes. The latest cybersecurity frontier models further made this shift urgent. Models like Claude Mythos can now find software vulnerabilities and reason through complex attack paths at machine-speed, leading to an exponentially increasing backlog of vulnerabilities,” said Chet Kapoor, VP of Search, Security, and Observability at AWS.
Four phases of operation
Continuum for code vulnerabilities operates in four continuous phases.
During discovery, the system ingests a customer’s existing backlog and runs its own scan of the environment, producing a broader view of vulnerabilities and the attack paths connected to them.
In prioritization, it weighs each finding against context such as whether the affected component is deployed, reachable, or sits in a production path, along with the business impact if exploited. The output is an evidence-backed list of priorities.
In validation, the system filters false positives and builds working exploit examples in a sandboxed environment, providing reproducible evidence of each issue.
In mitigation and remediation, it reviews existing defenses around a confirmed issue, including blocking controls, compensating controls, and detection mechanisms. It then recommends a network change, policy change, or code patch. The patch recommendation goes through the same validation system that confirmed the vulnerability. The product also supplies blast radius visibility and rollback paths where feasible.
The system reasons over both structured and unstructured data. Structured inputs include infrastructure, permissions, network topology, and code. Unstructured inputs include documents, communications, and business priorities that describe how an organization operates and where its risk lies.
Graduated automation and added capabilities
Continuum begins in learn mode with a human reviewing its work, and every recommendation comes with the reasoning behind it. Customers can move it to enforce mode, where remediation becomes increasingly automated according to categories and risk profiles they define.
AWS has folded several existing tools into the product. The penetration testing and code scanning functions of the AWS Security Agent now run as Continuum pen testing and Continuum code scanning, both in preview. The company also launched Continuum threat modeling in preview, which generates threat models from design documents or source code and produces output in STRIDE format. These functions feed detection and analysis into the broader Continuum loop of discovery, prioritization, validation, and remediation.
Download: Secure Foundations for AI Workloads on AWS
(Source: Help Net Security)