AWS has made Continuum for code vulnerabilities generally available, a security service that finds and validates code vulnerabilities, then delivers fixes as patches you can automate or as pull requests in your repositories.

The service confirms which findings are actually exploitable in your environment, ranks the resulting issues by business impact, and proposes a fix for each one. Every remediation starts in a mode where Continuum proposes the fix and a person approves it before it ships. AWS says that in the future, customers will be able to decide which actions Continuum can take on its own, within guardrails they define.

AWS frames the service as a response to two pressures: frontier AI models that let threat actors turn a vulnerability disclosure into working exploit code in minutes, and development tooling that increases the volume of findings teams must process. Large application estates can produce thousands of findings a day, many of which need no action because they are unreachable, unexploitable, or already mitigated by a runtime control. Generic severity scores, AWS argues, do not show which resources a threat actor can actually reach.

Continuum builds a context graph from code repositories and the AWS environment, using a collector set up in the account and Region where code runs to gather resource details such as AWS Config resources and network configuration. From that graph it learns which systems are business-critical, who owns them, how services depend on one another, and which data each touches, then ranks issues by how close their attack paths run to high-value systems. It assigns an evidence level to each finding, runs reproducible exploits in an isolated sandbox with proof-of-concept code and reproduction steps, and produces the attack path, source analysis and a blast radius assessment rather than a risk score alone.

For each confirmed issue, Continuum generates a code patch, dependency upgrade or configuration change and opens it as a pull request in the connected repository for review and merge. The console states that a generated patch does not mean the issue is fixed; the final decision stays with the team.

The service is available in US East (N. Virginia) and US West (Oregon) Regions.

Source: AWS