Security teams can have more vulnerability findings than they can credibly investigate, while developers are under pressure to fix the issues that pose the most immediate operational risk. A scanner can identify a potentially insecure code pattern, but it does not always show whether that pattern is reachable, exploitable or connected to a business-critical workload. The manual work needed to establish that context can delay remediation.
Amazon Web Services, part of Amazon.com Inc. (Nasdaq: AMZN), has made AWS Continuum for code vulnerabilities generally available. The service uses AI to find, validate and prioritize code vulnerabilities in an organization’s repositories and AWS environment, then creates remediation pull requests intended for human review.
AWS said Continuum builds a context graph from source repositories and the customer’s cloud environment. It assigns an evidence level to a finding and can reproduce exploitable issues in an isolated sandbox with proof-of-concept code. The stated goal is to replace a severity-only list with an investigation that shows why a particular weakness matters, how an attack path can reach an application and whether the affected workload is important to the business.
The service also ranks findings according to the proximity of an attack path to business-critical systems, according to AWS. That could help teams distinguish a theoretical issue in an unused component from one connected to an internet-facing service or sensitive data. Organizations will still need to determine how those rankings fit their own asset classifications, compensating controls and incident-response priorities.
AWS said Continuum can open a proposed fix as a pull request after validating an issue. The company has kept a human approval boundary around remediation: users review and merge the pull request, while AWS described autonomous classes of fixes as a future capability that would be constrained by confidence thresholds. That design matters for enterprises because a code change can affect availability, compliance and application behavior even when the underlying vulnerability is real.
The launch arrives as the available time between vulnerability disclosure and active exploitation continues to narrow. In its weekly roundup, AWS cited its own MadPot honeypot telemetry showing an attempted PHP2Shell exploitation before the related CVEs were publicly disclosed, followed by proof-of-concept activity on the disclosure day. AWS also published WAF mitigations for the affected vulnerabilities. The telemetry does not establish a timetable for every flaw, but it underscores why organizations increasingly need to prioritize based on exposure and exploitability rather than only a vulnerability score.
At general availability, Continuum is offered in US East (N. Virginia) and US West (Oregon), according to AWS. Availability, data residency and repository integration requirements will matter to buyers with regulated workloads or distributed development organizations. Teams should also assess what source code, infrastructure metadata and evidence artifacts the service can access, as well as how generated fixes move through their existing code-review and deployment controls.
The useful measure for customers will not be the number of findings produced but whether the service reduces time spent proving which findings deserve action while maintaining engineering quality. Legacy vulnerability-management processes often hand developers long lists that require separate security analysis, infrastructure tracing and remediation work. AWS Continuum is trying to compress those steps into a governed review flow; enterprises will need to validate its findings, generated changes and operating boundaries before relying on it for production remediation decisions.