Findings arrive faster than any security team can read them, and Amazon Web Services, known as AWS, made AWS Continuum for code vulnerabilities generally available on October 22 to address that volume. Large application estates produce thousands of findings a day, and attackers can turn a vulnerability disclosure into working exploit code in minutes, according to the AWS launch post (Kayabali, 2026). Continuum checks which findings can be exploited, ranks them by business impact, and opens a pull request with a fix for each one.

Each scan ends in a proven fix, and the next scan begins

The product follows the loop that security needs. You connect a code source, either GitHub or Amazon S3, and set a scan schedule. Continuum builds a context graph from your repositories and your AWS environment. For findings it can reproduce, it runs the exploit in an isolated sandbox and attaches proof-of-concept code with reproduction steps. Each confirmed issue ends as a fix delivered either as a pull request that your team reviews and merges or as a patch you can automate, and the next scheduled scan starts the loop again.

I have long held that security cannot be an afterthought added before launch. A cycle that scans on a schedule and proposes a proven fix puts that belief into the build process.

That is the right shape for the problem.

Andy Jassy, Amazon's chief executive, wrote on LinkedIn that IBM, Robinhood, Capital One, Infor, and Luminate ran Continuum in preview and saw a meaningful difference in their security efforts.

AWS prices Continuum on code size and on the work it does

Continuum for code vulnerabilities carries two charges. A monthly context fee starts at $200 per million protected lines of code and declines as volume grows, and an inference fee costs $10 per Continuum inference unit (Amazon Web Services, 2026). AWS's enterprise example protects 100 million lines of code, processes 10,000 vulnerabilities at two units each, and totals $218,200 a month. Inference accounts for $200,000 of that, about 92% by my calculation, so a chief information officer budgeting for Continuum should plan around finding volume more than codebase size.

Availability today covers US East (N. Virginia) and US West (Oregon). Every remediation starts in a mode where Continuum proposes the fix and a person approves it before it ships. AWS describes trust as graduated, and the launch post says teams will later be able to let Continuum apply selected fix types on its own once confidence gates such as test coverage and historical success rate pass. Chet Kapoor, the AWS vice president for search, security, and observability, framed the same path in June as a move from learn mode toward enforce mode.

The context graph holds answers your business leaders want too

AWS describes the graph as a record of which systems are business-critical, who owns them, how services depend on one another, and which data each one touches. That is a map of the company, assembled by a security product.

Security tools tend to stay isolated inside the network where they were installed, and that wastes what they know. In my view CISOs, the chief information security officers, should treat the knowledge as a shared resource and talk with their business counterparts about how to use it. Observability platforms show the pattern: the same telemetry serves engineering and finance teams that never open a security console, because each reads it for intelligence about its own work.

A practical first step is to ask AWS which parts of the graph and its ownership data can be shared with users outside security, and to bring the heads of engineering and finance into that conversation before the rollout.

A 360-degree view starts outside the network

Continuum ranks issues by how close an attack path runs to the highest-value systems, such as customer data stores and payment pipelines. That ranking rests on a judgment about value, and the judgment moves with events outside the company.

Expect the unexpected. An armed conflict can make a company with no connection to it a target, because attackers who want to make a statement choose visible brands. Some will work through your own people, such as a phished employee or a contractor's stolen credentials, so a 360-degree view covers outsiders who use insiders as well as insiders acting alone.

I would want every CISO to own a formal way of sensing the outside world: a scheduled briefing on geopolitical and threat developments, and a named person who decides which systems rise in priority as a result. Kapoor wrote that Continuum reasons over business priorities and documents as well as infrastructure, which suggests a standing outside-in briefing has a place to feed it.