AWS announces general availability of AWS Continuum platform

Amazon Web Services has announced the general availability of AWS Continuum, an integrated security platform designed to automate the discovery, enforcement, and remediation of security issues across codebases, dependencies, and applications. The platform launches with four core capabilities targeting the entire vulnerability lifecycle: penetration testing, code review, threat modelling, and code vulnerabilities.

According to Chet Kapoor, vice president of search, security, and observability at AWS, Continuum is built on lessons learned from running security across AWS and Amazon. com. The penetration testing and code review features originated in AWS Security Agent, which was previously introduced during AWS re:Invent 2025. These specific tools allow teams to run on-demand penetration testing sessions within continuous integration and continuous deployment workflows, alongside on-demand code reviews to flag vulnerabilities and enforce organizational compliance standards.

AWS Continuum Manages Vulnerabilities Through Four Continuous Phases

AWS Continuum functions across four continuous phases: discovery, prioritization, validation, and mitigation or remediation. During the discovery phase, the system evaluates corporate backlogs and scans the environment to generate a comprehensive list of vulnerabilities and attack paths. The prioritization and validation phases then assess potential exploit business impacts to highlight the most critical security flaws. The final mitigation phase supplies recommendations for addressing the validated issues—such as code patches, policy adjustments, or network changes—while offering visibility into their potential operational impacts.

Additional features include a threat-modelling capability that enables developers to analyze application architectures, yielding a system overview alongside a prioritized list of threats paired with actionable recommendations. The platform utilizes a graduated trust model that lets security and product teams configure how much autonomy the tool holds when analyzing and remediating vulnerabilities.

AWS Launches Capabilities Amid Competition from Google and Microsoft

At launch, the penetration testing and code review capabilities are generally available. However, the threat-modelling feature is currently in preview, and the code-vulnerabilities component remains in a gated preview requiring users to sign up for access.

The release arrives alongside competing developments in agentic security remediation, such as Google AI Threat Defense and Microsoft’s MDASH. While Google pursues a cloud-agnostic model, AWS and Microsoft have developed solutions deeply integrated into their respective ecosystems. At the same time, industry observers like AWS serverless hero Yan Cui have raised questions regarding potential service overlaps between Continuum and pre-existing AWS offerings, which could create user confusion over service selection.