[{"data":1,"prerenderedAt":29},["ShallowReactive",2],{"nr-en-aws-continuum-ai-finds-and-fixes-code-vulnerabilities":3},{"slug":4,"title":5,"dek":6,"date":7,"time":8,"publishedAt":9,"updated":10,"updatedAt":10,"dateFmt":11,"updatedFmt":10,"kind":12,"tier":13,"author":14,"authorName":15,"topics":16,"tracker":21,"trackerLabel":22,"headlineStat":23,"image":24,"ogImage":25,"imageAlt":5,"csv":10,"minutes":26,"words":27,"html":28},"aws-continuum-ai-finds-and-fixes-code-vulnerabilities","AWS Continuum: AI finds and fixes code vulnerabilities","Amazon Web Services makes AI-assisted detection and remediation of code vulnerabilities in its AWS Continuum security service generally available. The service is meant to help filter the truly relevant issues out of scanner findings.","2026-10-23","09:20","2026-10-23T09:20:00+02:00","","October 23, 2026","news","standard","ideal-syka","Ideal Syka",[17,18,19,20],"Cybersecurity","Cloud","AI agents","Software development","\u002Fki-skills-report","AI skills report","Two regions at launch (US East, US West)","\u002Fnewsroom\u002Fimg\u002Faws-continuum-ai-finds-and-fixes-code-vulnerabilities.webp","\u002Fog-nr\u002Faws-continuum-ai-finds-and-fixes-code-vulnerabilities.en.png",2,468,"\u003Ch2>What AWS announced\u003C\u002Fh2>\n\u003Cp>Amazon Web Services has made the function for detecting and fixing code vulnerabilities in its AWS Continuum security service generally available. According to the AWS announcement, the service checks findings for their actual exploitability, prioritises them by possible business impact and suggests fixes.\u003C\u002Fp>\n\u003Cp>The aim is to filter the truly relevant security issues out of numerous scanner findings. A vulnerability may, for example, be unreachable over the network or already mitigated by existing protective measures. According to AWS, a general severity rating alone does not reflect such differences.\u003C\u002Fp>\n\u003Ch2>How prioritisation works\u003C\u002Fh2>\n\u003Cp>Continuum links information from code repositories and the AWS environment in a context graph. Among other things, this maps dependencies between services, responsibilities and access to data. An optionally configured collector gathers resource information and network configuration in the AWS account and region of the application.\u003C\u002Fp>\n\u003Cp>This is meant to let the service assess whether attackers could reach a vulnerability and which further resources would be accessible to them from there. It also considers how close a possible attack path comes to business-critical systems, such as customer databases, payment processes and authentication services. A vulnerability in an isolated development tool may therefore be less urgent than a lower-rated finding in a service with access to sensitive data.\u003C\u002Fp>\n\u003Ch2>Evidence and fixes\u003C\u002Fh2>\n\u003Cp>For each result, Continuum states which kind of evidence exists, for example a static analysis of the vulnerable code path. Where the service can reproduce a vulnerability, it reportedly runs the exploit in an isolated sandbox and provides proof-of-concept code along with reproduction steps. Not every confirmed finding is therefore based on an executed exploit.\u003C\u002Fp>\n\u003Cp>For confirmed problems, Continuum generates fix proposals such as code patches, dependency updates or configuration changes. In a connected GitHub repository, the service provides them as pull requests. However, human owners must review and apply the changes. AWS only holds out the prospect of the service applying certain fixes autonomously in the future. Users should then be able to set limits, for example based on test coverage, scope of change and past success rate.\u003C\u002Fp>\n\u003Ch2>Availability\u003C\u002Fh2>\n\u003Cp>GitHub and Amazon S3 are supported as code sources. For S3, the bucket must be in the same AWS account and region in which Continuum is enabled. At launch, the function for code vulnerabilities is available in the AWS regions US East (N. Virginia) and US West (Oregon).\u003C\u002Fp>\n\u003Ch2>Assessment\u003C\u002Fh2>\n\u003Cp>For companies in Germany, it may be relevant that prioritisation spans code and infrastructure and that fixes are integrated into existing development workflows as pull requests. The available sources leave open how the results hold up in practice and what role data residency in the named US regions plays for European customers.\u003C\u002Fp>\n\u003Ch2>Sources\u003C\u002Fh2>\n\u003Cp>\u003Cem>Editorially owned by \u003Ca href=\"\u002Fen\u002Fautor\u002Fideal-syka\">Ideal Syka\u003C\u002Fa>. Sources and method: \u003Ca href=\"\u002Fen\u002Fredaktion\">Newsroom & method\u003C\u002Fa>. Tips and corrections: \u003Ca href=\"mailto:ai@i6eal.de\">ai@i6eal.de\u003C\u002Fa>.\u003C\u002Fem>\u003C\u002Fp>\n",1792747286343]