AWS launches Continuum to find and fix code vulnerabilities at machine speed

Amazon Web Services Inc. today launched AWS Continuum, a security platform that uses frontier artificial intelligence models to discover, validate and remediate software vulnerabilities across a customer’s environment with limited human intervention.

Continuum is seeking to address what AWS describes as a breaking point in enterprise security. The company argues the operating model teams have relied on for the past decade, built around collecting telemetry, storing it and watching dashboards, can no longer keep pace.

AWS points to cybersecurity frontier models, including Anthropic PBC’s Claude Mythos, that can now find vulnerabilities and reason through complex attack paths at machine speed, driving an exponentially growing backlog of flaws. Continuum for code vulnerabilities, the platform’s first capability, is available in gated preview.

Continuum is model-agnostic, drawing on multiple frontier models depending on which performs best for a given task. The platform reasons over both structured data already in AWS, such as infrastructure, permissions, network topology and code, and unstructured data, including a customer’s documents, communications and business priorities. AWS says the system was built on lessons from securing AWS and Amazon.com, which required understanding business context rather than applying generic rules uniformly.

The product runs in four continuous phases. It begins by ingesting a customer’s existing vulnerability backlog and running its own scan, then prioritizes findings based on whether an affected component is deployed, reachable, in a production path and what the business impact would be if exploited.

Continuum then validates findings to weed out false positives, constructing working exploit examples in a sandboxed environment to provide reproducible evidence. In the final phase it assesses existing defenses and recommends a fix, whether a network change, policy change or code patch, with the patch validated by the same system that confirmed the flaw. The platform also provides blast radius visibility and rollback paths where feasible.

Trust is graduated. Continuum starts in a learn mode with a human in the loop and every recommendation accompanied by its reasoning. Customers can later move it to an enforce mode that increasingly automates remediation based on categories and risk profiles they define.

The launch folds in capabilities AWS introduced earlier. The penetration testing and code scanning functions of AWS Security Agent, which was previewed at the re:Invent 2025 conference in December, are now part of Continuum as Continuum pen testing and Continuum code scanning. AWS is also previewing Continuum threat modeling, which generates threat models from design documents or source code and outputs results in STRIDE format.

AWS said it’s working with customers across financial services, automotive and technology to shape the platform. Continuum starts with first- and third-party code and will expand to other areas of security over time.

Photo: AWS