AWS Continuum reaches general availability, ranking vulnerabilities by business impact

Amazon Web Services' new security service, Continuum, reached general availability on October 22, 2026, in the US East (N. Virginia) and US West (Oregon) regions, according to a report on dev.to. The product targets the gap between what vulnerability scanners emit and what teams can act on: it validates each finding, ranks only the confirmed ones by business impact, and drafts a remediation for every issue that survives validation. AWS, quoted by dev.to, frames the underlying problem as manual effort, saying that confirming whether a finding was exploitable historically took hours of investigation and that shipping a confident fix required days of coordination across security, infrastructure and application teams.

A context graph drives the ranking

Continuum's judgement rests on a context graph assembled from two inputs: the customer's repositories and their AWS environment. A collector installed in the AWS account and Region where the code runs pulls in resource details, including AWS Config resources and network configuration, which lets the service answer whether an attacker could actually reach a target. The graph also records service ownership, dependencies between services and the data each service touches. Ranking then follows attack-path proximity: findings whose paths run close to a customer data store, a payment pipeline or an authentication service outrank those that do not, regardless of what a generic severity label claims. AWS, as quoted by dev.to, argues that standard severity scores cannot show which resources a threat actor is genuinely able to reach, describing the familiar scenario in which a critical rating on a developer-only utility looks the same as a medium rating on a service one step from a payments database.

Evidence packages and human-approved fixes

Each validated finding ships with an evidence package a security team can audit. Continuum reproduces the exploit in an isolated sandbox and attaches proof-of-concept code with reproduction steps, alongside the attack path, the analysis behind the verdict, a blast-radius assessment and an evaluation of whether existing defences would detect or stop the path. In one worked example described by dev.to, an issue was rated High severity, marked Exploitable with an evidence level of Static proven, given High likelihood because the affected service was reachable without authentication or user interaction, Moderate impact, and a blast radius covering other users in the same tenant.

Remediation arrives as a pull request in the connected repository, taking the form of a code patch, a dependency upgrade or a configuration change. The demonstration's pull request modified four files in a cart service, adding 50 lines and removing 24, with the risk assessment and proof carried into the description a reviewer reads. Every remediation begins with a person approving the change before it ships, and the console notes that a generated patch still requires review and a merge before the issue counts as fixed. AWS signalled that teams will eventually be able to designate remediation classes the service may apply on its own once confidence gates such as test coverage, scope bounds and historical success rate are met.

Metered pricing on two dimensions

There is no upfront cost. A monthly context fee, which pays for building and maintaining the graph, is tiered per million lines of protected code, starting at $200 and stepping down through $180, $160 and $130 to $100 at the largest tier. The variable dimension is $10 per Continuum inference unit, with the units required per vulnerability depending on the work involved. AWS's own worked examples show the shape of the bill: one million lines with 100 vulnerabilities comes to roughly $1,200 a month, ten million lines with 1,000 vulnerabilities to $12,000, and a hundred million lines with 10,000 vulnerabilities at two units each to $218,200, of which $18,200 is context and $200,000 is inference. As dev.to points out, the inference charge dominates at enterprise scale, turning vulnerability volume into a direct budget line.

Open questions

The launch material leaves several things unanswered, according to dev.to: no independent benchmark has been published, no accuracy figure exists for the proposed remediations, and AWS has not stated how the service treats findings in code it cannot build.

Why it matters

Scanner output has long outpaced human review capacity, and generic severity scores do a poor job of separating genuinely dangerous flaws from theoretical ones. Continuum is AWS's attempt to productise the expensive parts of vulnerability management, validation, prioritisation and first-draft remediation, and to ground ranking in a customer's actual topology rather than industry-wide scores. The two-part pricing makes the trade explicit: each confirmed vulnerability consumes inference units, so at scale the cost of the service tracks how many real problems it finds. For AWS-native organisations, it consolidates a workflow that today spans multiple tools and teams, but with no published accuracy numbers and every patch requiring a human merge, buyers will need to test the claims against their own codebases before trusting machine-authored fixes at volume.