---
url: "https://www.xcademia.com/news/aws-makes-continuum-for-code-vulnerabilities-generally-available"
title: AWS Makes Continuum for Code Vulnerabilities Generally Available
description: "AWS Continuum is generally available to validate code vulnerabilities, prioritize business risk, and propose fixes through human-reviewed pull requests."
publishedAt: "2026-10-23T10:00:18.762+00:00"
updatedAt: "2026-10-23T12:30:57.51742+00:00"
type: news
category: "cloud-security"
source_name: AWS News Blog
source_url: "https://aws.amazon.com/blogs/aws/aws-continuum-for-code-vulnerabilities-is-now-generally-available/"
tags:
  - "#AWS"
  - "#AWSContinuum"
  - "#Cybersecurity"
  - "#CloudSecurity"
  - "#ApplicationSecurity"
  - "#VulnerabilityManagement"
  - "#DevSecOps"
  - "#SoftwareSecurity"
---

# AWS Makes Continuum for Code Vulnerabilities Generally Available

> AWS has made Continuum for code vulnerabilities generally available in the US East (N. Virginia) and US West (Oregon) Regions. The service validates exploitability, prioritizes issues using business context, and proposes code fixes as pull requests that require human approval.

Source: **AWS News Blog** · 23 October 2026

**A**WS has announced the general availability of AWS Continuum for code vulnerabilities, a security service designed to help organizations validate software vulnerabilities, prioritize them according to business impact, and prepare remediation changes for review.

Rather than presenting teams with raw scanner output alone, Continuum analyzes findings in the context of application code and the AWS environment. It determines which findings are exploitable, assesses their potential impact, and generates proposed fixes as code patches, dependency upgrades, or configuration changes.

The service can deliver remediation through pull requests in connected repositories. Every fix starts with human approval required: teams review and merge the proposed change before it ships. AWS says that future capabilities will let customers authorize certain remediation actions to run automatically within guardrails they define.

AWS Continuum for code vulnerabilities is available in the US East (N. Virginia) and US West (Oregon) Regions.

## 
Why AWS Is Focusing on Validated Vulnerabilities

Security teams often face large volumes of findings from code scanners. AWS notes that some findings may be unreachable, unexploitable, or already mitigated by runtime controls. A severity score alone may not show whether an attacker can reach a vulnerable component or how close that component is to a critical business system.

The announcement also highlights how frontier AI models can help threat actors turn vulnerability disclosures into working exploit code more quickly. At the same time, development teams must process growing volumes of findings and coordinate fixes across security, infrastructure, and application teams.

AWS Continuum aims to narrow this gap by validating exploitability and assessing the potential scope of each proposed fix. Its goal is to help teams distinguish findings that present a demonstrated risk in their environment from those that need further investigation.

## 
How AWS Continuum Builds Business Context

Continuum creates a context graph from two main sources: code repositories and the customer's AWS environment.

For AWS infrastructure context, customers can configure a Continuum collector in the AWS account and Region where their code runs. The collector gathers resource details, including AWS Config resources and network configuration, to help assess whether a vulnerability is reachable over the network and what an attacker could potentially access from it.

Using this context, Continuum maps relationships among systems, services, owners, and data. It can identify connections to business-critical resources such as customer data stores, payment pipelines, and authentication services.

This context informs how Continuum ranks issues. Instead of relying on a severity score alone, the service considers how an attack path relates to important systems and business resources.

![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1792749217230-info-1--233-.webp)

## How Continuum Validates Exploitability

Continuum analyzes each finding against the code and its environment context, assigning an evidence level to explain the basis for its assessment. One example in the announcement is "Static proven," a verdict supported by static analysis of the vulnerable code path.

For findings that Continuum can reproduce, the service runs the exploit in an isolated sandbox and attaches proof-of-concept code and reproduction steps. It also provides the associated attack path, supporting source analysis, and a blast radius assessment.

The service evaluates whether existing defenses would detect and stop the validated attack path. This gives teams more information than a scanner finding or generic severity rating alone.

AWS's announcement describes the resulting issue record as containing several elements:

- Exploitability: Whether the finding is considered exploitable, along with its evidence level.
- Likelihood: An assessment based on conditions such as attacker reachability, authentication requirements, and user interaction.
- Impact: The potential consequences and affected scope, including the blast radius.
- Proof: Supporting analysis behind the exploitability verdict.
- Remediation: A proposed fix delivered as a patch or repository pull request.

These elements help reviewers understand why an issue was prioritized and what evidence supports the proposed remediation.

![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1792749244756-info-2--215-.webp)

## Remediation Through Pull Requests, With Human Approval

For each confirmed issue, Continuum generates a proposed fix. Depending on the issue, this may be a code patch, a dependency upgrade, or a configuration change.

The service opens the proposed remediation as a pull request in the connected repository, allowing developers to review the change in their existing workflow. The pull request includes the risk assessment, remediation summary, and supporting proof from the Continuum console.

AWS emphasizes that a generated patch does not mean the vulnerability has been fixed. A person must review and merge the pull request before the change is accepted.

AWS says it plans to let customers authorize automatic remediation for specific classes of changes in the future. The proposed approach would use customer-defined guardrails and confidence gates, including test coverage, scope bounds, and historical success rate. These automatic remediation capabilities are described as future functionality, not as part of the current approval workflow.

## 
A Look at the AWS Continuum Workflow

The AWS News Blog walks through an example of using Continuum in the AWS console.

### Connecting code and infrastructure

Before reviewing issues, a customer sets up an environment and connects a code source. The announcement describes two options:

- A GitHub integration.
- An Amazon S3 bucket.

For an S3 source, the bucket must be in the same AWS account and Region where Continuum is enabled. Customers must also grant access through an AWS Identity and Access Management (IAM) role that Continuum assumes.

Customers can optionally add AWS infrastructure context by configuring a Continuum collector in the account and Region where their code runs and authorizing the environment to use it.

### 
Reviewing prioritized issues

The environment's Issues tab lists validated, prioritized issues with their severity, status, and creation time. The Findings tab lists the underlying scanner findings from which issues are built.

In the example published by AWS, an issue is rated High severity and marked Completed, with remediation Delivered to GitHub. Its risk assessment reports the exploitability verdict as Exploitable, the evidence level as Static proven, and the validation run as Completed.

The example describes likelihood as High because the service is reachable from an attacker, requires no authentication, and needs no user interaction. Impact is rated Moderate, with the described blast radius reaching other users in the same tenant.

The corresponding pull request changes four files, with 50 lines added and 24 removed across the cart service. These figures describe the specific example in the announcement, not a general performance or remediation benchmark for Continuum.

### 
Managing scans and configuration

Continuum also provides tools for managing the ongoing workflow:

- Scans: Shows scan history, status, origin, and request and completion times. Users can change scan frequency or queue a scan on demand.
- Configuration: Manages code and context sources, integrations, environment settings, remediation patch settings, and AWS collectors.
- Security evidence: Provides supporting analysis and proof alongside the risk assessment and remediation proposal.

Together, these features are designed to help teams review issues in priority order while keeping evidence and proposed changes available within the same workflow.

![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1792749268313-info-3--199-.webp)

## Availability and Pricing

AWS Continuum for code vulnerabilities is generally available in two AWS Regions:

- US East (N. Virginia)
- US West (Oregon)

AWS directs customers to its [Continuum pricing page](https://aws.amazon.com/continuum/pricing) for pricing details.

Organizations can learn more through the [AWS Continuum product page](https://aws.amazon.com/continuum) and the [AWS Continuum User Guide.](https://docs.aws.amazon.com/continuum/latest/userguide/what-is-continuum.html)

## 
What This Means for Security and Development Teams

The announcement highlights a broader industry shift from collecting vulnerability findings toward validating which issues matter in a specific environment and helping teams act on them.

For organizations managing large application estates, combining code analysis with infrastructure context may help teams focus on vulnerabilities with demonstrable attack paths and meaningful business impact. Providing evidence alongside proposed fixes may also help security and development teams make remediation decisions with more context.

The human approval requirement is an important part of the current workflow. Continuum can prepare a proposed fix, but the team retains control over whether that change is merged and shipped. Planned automation could change that workflow for selected remediation classes, but AWS has not announced that this is generally available today.

The service's regional availability is another practical consideration. Organizations should confirm whether the currently supported Regions meet their deployment requirements before adopting it.

## 
Conclusion

AWS Continuum for code vulnerabilities is now generally available in the US East (N. Virginia) and US West (Oregon) Regions. The service combines code analysis, optional AWS infrastructure context, exploitability validation, business-impact prioritization, and proposed remediation in one workflow.

Its main distinction is that it aims to provide evidence about exploitability and potential impact rather than presenting scanner findings as an undifferentiated backlog. Remediation is delivered through proposed fixes and repository pull requests, with human review and approval required before changes ship.

## Original source

https://aws.amazon.com/blogs/aws/aws-continuum-for-code-vulnerabilities-is-now-generally-available/

## Tags

`#AWS` · `#AWSContinuum` · `#Cybersecurity` · `#CloudSecurity` · `#ApplicationSecurity` · `#VulnerabilityManagement` · `#DevSecOps` · `#SoftwareSecurity`

---

## About this content

This Markdown news article is the citation-grade twin of [AWS Makes Continuum for Code Vulnerabilities Generally Available](https://www.xcademia.com/news/aws-makes-continuum-for-code-vulnerabilities-generally-available). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite.

When citing or quoting, please attribute *Xcademia* and link back to the source URL above.

- Source: https://www.xcademia.com/news/aws-makes-continuum-for-code-vulnerabilities-generally-available
- Publisher: Xcademia, https://www.xcademia.com
- Catalogue index: https://www.xcademia.com/llms-full.txt