AWS Launches Continuum for Code Vulnerabilities in Two Regions
AWS recently announced the general availability of Continuum for code vulnerabilities in the US East (N. Virginia) and US West (Oregon) regions. This launch follows a gated preview that began four months earlier.
Continuum is designed to identify and validate code vulnerabilities, providing fixes either as automated patches or as pull requests in connected repositories. The service constructs a context graph from these repositories and the surrounding AWS environment, with an optional collector that supplies resource and network context from the code’s runtime environment.
According to Esra Kayabali, a principal solutions architect at AWS, the service addresses the challenge of managing the high volume of vulnerability findings that organizations face. Swami Sivasubramanian, VP of Agentic AI, emphasized that many organizations encounter thousands of findings daily, which can overwhelm teams.
Rather than merely ranking vulnerabilities by severity, Continuum validates findings by executing exploits in an isolated sandbox. This process provides proof-of-concept code along with reproduction steps. The findings are categorized by their evidence level, which includes assessments of attack paths and potential impact.
Continuum’s pricing structure consists of two components: a context fee based on the lines of code protected per month, starting at $200 per million lines, and an inference fee of $10 per Continuum inference unit for processed findings. For example, a scenario with one million lines of code and 100 vulnerabilities would cost approximately $1,200, while a larger codebase of 100 million lines with 10,000 vulnerabilities could reach around $218,200.
Feedback from the community has raised questions about the service’s ability to confirm that a vulnerability is exploitable in a specific environment. Bernardo Meireles Correa, an engineer at Avatier, noted that while the sandbox validation indicates exploitability, it does not guarantee that the vulnerability exists in the user’s environment.
Continuum’s optional collector can help assess reachability by gathering AWS resource and network configurations, although this requires additional setup. However, the handling of unproven findings remains a concern, as AWS documentation does not clarify the fate of such findings.
Source: InfoQ