# AWS Launches Continuum for Automated Code Vulnerability Remediation AWS introduces Continuum to validate and patch code vulnerabilities using automated sandbox testing. - **Source:** [InfoQ](https://brifing.si/source/68ac18af-a4f3-4f7c-9c2c-44d4af8f89dd) - **Published:** 2026-11-06 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/afba287e-cfff-435a-a90d-fc3b2132719a ## General Availability Announcement AWS has officially launched Continuum, a service designed to identify and remediate code vulnerabilities, following a four-month gated preview period. The tool is currently available in the US East (N. Virginia) and US West (Oregon) regions. It aims to streamline security workflows by moving beyond simple detection toward automated patch generation. ## Contextual Vulnerability Validation Continuum differentiates itself by validating findings through isolated sandbox execution rather than relying solely on severity scores. It generates proof-of-concept code and attack path assessments to confirm reachability. By analyzing the surrounding AWS environment and repository context, the service attempts to filter out noise that typically overwhelms security teams daily. ## Pricing and Cost Structure The service employs a two-tier pricing model consisting of a context fee and an inference fee. The context fee scales based on lines of code protected, while the inference fee charges per validated finding. For example, processing 100 million lines with 10,000 vulnerabilities results in costs exceeding 200,000 dollars total. ## Operational Workflow Mechanics Continuum integrates directly with connected repositories to deliver patches as pull requests. While currently requiring human approval for every merge, AWS intends to enable autonomous application of fix classes in the future. This transition depends on meeting specific confidence criteria, including historical success rates and robust test coverage metrics. ## Addressing Reachability Concerns Engineers have noted that sandbox proof does not guarantee an exploit path exists within a specific production environment. While an optional collector gathers network configuration data to judge reachability, the product documentation remains silent on how unproven findings are managed. This leaves potential gaps in comprehensive security coverage for complex architectures. ## Industry Comparison and Validation Competitors like Google’s CodeMender utilize LLM-as-a-judge frameworks to verify that patches resolve root causes without altering application behavior. AWS currently lacks this specific validation layer, as noted by console caveats. Experts argue that rigorous acceptance testing is necessary before moving from manual review to fully autonomous patch merging processes. ## Product Boundary Ambiguity Documentation reveals ongoing confusion regarding the overlap between Continuum and the AWS Security Agent. While Continuum focuses on code vulnerabilities, other capabilities like penetration testing and threat modeling remain separately priced and managed. This fragmentation creates uncertainty for architects trying to determine which specific tools are required for their security. ## Future of Autonomous Security The shift toward agentic security tools reflects a broader industry trend of managing high-volume alerts through automation. Success for Continuum will likely depend on its ability to prove fix reliability and maintain application integrity. Organizations must balance the desire for speed with the risks inherent in automated code modification processes. ## Sources covering this story - https://www.infoq.com/news/2026/11/aws-continuum-ga/?utm_campaign=infoq_content&utm_source=infoq&utm_medium=feed&utm_term=global — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._