Amazon Web Services announces that enterprise application security can be streamlined through automated remediation with the general availability of AWS Continuum for code vulnerabilities. Virginia) and US West (Oregon) Regions to provide automated security fixes, vulnerability validation, and risk ranking for enterprise application estates.
The Investigation Bottleneck in Corporate Portfolios
Application security scanners generate thousands of findings daily across large corporate software portfolios. Many of these alerts require no action because they target unreachable code paths, unexploitable dependencies, or resources already shielded by runtime controls. Generic severity scores fail to account for network topology or data sensitivity, leaving security teams to spend hours manually investigating whether a reported vulnerability poses an actual threat.
AWS is partnering with @AnthropicAI and @OpenAI to bring AWS Continuum into Claude Code, Codex, and @Kirodotdev. Discover, prioritize, validate, and remediate code vulnerabilities without leaving your dev environment.From AWS VP Chet Kapoor on the AWS Security Blog:… pic.twitter.com/Fg9QHudi5K
Automating Discovery and Proof of Concept
To eliminate this investigation bottleneck, Amazon Web Services rolled out AWS Continuum for code vulnerabilities. The service discovers code flaws, verifies whether those issues are exploitable within a specific operational environment, calculates business impact, and writes proposed fixes as pull requests or automated patches.
Mapping Dependencies Across Accounts and Regions
Continuum connects directly to code repositories like GitHub or Amazon S3 buckets while pulling environmental data from AWS Config and network configuration files via an infrastructure collector. By mapping dependencies across AWS accounts and Regions, the service traces data flows toward high-value assets such as customer databases, payment pipelines, and authentication endpoints.
The platform assigns an explicit evidence level to every finding. When static analysis proves a vulnerability path, Continuum executes the exploit inside an isolated sandbox environment. This verification generates proof-of-concept code, an exact attack path, and a blast radius assessment rather than relying on an abstract risk score.
Maintaining Human Oversight in Production Codebases
Once a vulnerability is confirmed and prioritized, Continuum generates a remediation package—such as a code patch, dependency upgrade, or configuration change—and opens it directly in the connected repository as a pull request. Reviewers see the complete risk assessment, static evidence, and proof-of-concept details embedded within the pull request description.
Human oversight remains mandatory for every deployment. Reviewers must examine and merge the proposed pull request manually, ensuring that engineering teams retain final authority over every change entering production codebases.
Configurations, scan frequencies, and integration settings are managed through the AWS Continuum console under dedicated tabs for Environments, Scans, and Findings. Pricing details and technical setup instructions are available directly on the official product documentation pages.
