AWS Continuum for Code Vulnerabilities Goes GA: Validate First, Then Fix

What happened

The service splits vulnerability handling into four steps: discover, validate, prioritize, remediate. Continuum builds a context graph from code repositories and the AWS environment (collecting AWS Config resources and network configuration) to judge whether a finding is reachable over the network and what an attacker could reach from it; reproducible findings are then exploited for real inside an isolated sandbox, with PoC code and reproduction steps attached — not just a risk score.

Ranking follows business impact: the closer a system sits to high-value assets like customer data stores, payment pipelines and authentication services, the higher its priority. AWS says scanners can emit thousands of findings a day, many needing no action — unreachable, unexploitable, or already mitigated by runtime controls; generic severity scores cannot tell a 'critical on a dev-only utility' from a 'medium one step from the payments database.'

Each confirmed issue gets a generated fix (code patch, dependency upgrade or config change) opened as a PR titled 'Continuum fix,' its description carrying the risk assessment, remediation summary and proof; review and merge stay human. AWS says confidence gates (test coverage, scope bounds, historical success rate) will later allow auto-applying certain fix classes; the service works alongside GuardDuty and Security Hub.

Key facts

1. Launch: generally available Oct 22, 2026; first regions US East (N. Virginia) and US West (Oregon)
2. Four-step flow: discover → validate → rank by business impact → deliver fixes as PRs
3. Validation: context graph (code repos + AWS environment collectors) judges reachability; exploits run for real in an isolated sandbox with PoC attached; attack path, source analysis and blast-radius assessment included
4. Remediation: each confirmed issue gets a patch PR requiring human review and merge; auto-apply for some fix classes comes later once confidence gates pass
5. Integrations: works with Amazon GuardDuty and AWS Security Hub; see the AWS pricing page (no prices in the announcement)
6. Benchmark (AWS-reported, early October): 89% on the CyberGym-E2E end-to-end code-vulnerability benchmark, covering C/C++ memory-safety flaws