AWS Continuum fixes code vulnerabilities with AI: 200 dollars per million lines, but only in the US
AWS has made Continuum for code vulnerabilities generally available. The service proves which findings are exploitable and proposes fixes a person approves. Pricing is now published, but the service is only in two US Regions so far.
Amazon Web Services has made AWS Continuum for code vulnerabilities generally available. The service looks for vulnerabilities in an organisation's code, tries to prove which ones can actually be exploited, and delivers proposed fixes as pull requests. AWS published the announcement on Thursday 22 October at 22:33 Norwegian time (20:33 UTC).
Two things matter most for leaders. Pricing is now published, with a monthly fee per million lines of code and a fee for each unit of security work performed. And the service is so far only available in two US AWS Regions, which European organisations need to weigh before connecting source code and environment data.
What AWS is launching
According to AWS, Continuum builds a context graph from two sources: code repositories and the AWS environment. Code is connected through a GitHub integration or an Amazon S3 bucket. For the AWS environment, the customer sets up a collector in the account and Region where the code runs. It gathers resource details from AWS Config and network configuration, so the service can judge whether a vulnerability is reachable over the network and what an attacker could reach from it.
AWS says the service uses this picture to identify the highest-value systems, such as customer data stores, payment pipelines and authentication services. Each issue is ranked by how close its attack path runs to those systems, not by a generic severity score alone.
For findings it can reproduce, Continuum runs the exploit in an isolated sandbox and attaches proof-of-concept code with reproduction steps. Each confirmed issue gets a proposed fix: a code patch, a dependency upgrade or a configuration change.
A human approves, for now
According to AWS, every remediation starts in a mode where Continuum proposes and a person approves. The fix arrives as a pull request in the customer's repository, and the team reviews and merges it. AWS writes that the console is explicit that a generated patch does not mean the issue is fixed.
AWS also says customers will later be able to let Continuum apply specific classes of fixes on its own, within guardrails they define, once confidence gates such as test coverage, scope bounds and historical success rate pass. That is an announced capability, not something available today. The announcement gives no date.
Pricing and Regions
The service's pricing page describes two pricing dimensions. The first is a monthly context fee of 200 US dollars per million protected lines of code for the first ten million, with lower rates for larger codebases. The second is an inference fee of 10 dollars per Continuum inference unit, the unit AWS uses for the security work the service performs.
AWS's own worked example shows where the cost sits. A codebase of one million lines with 100 processed vulnerabilities comes to 200 dollars in context fees and 1,000 dollars in inference, an estimated 1,200 dollars a month. AWS stresses that actual usage per vulnerability varies. That means the volume of findings, not the size of the code, will often drive the bill.
The service is available in US East (N. Virginia) and US West (Oregon). The announcement does not say when it will reach European Regions. For an S3 source, the bucket must sit in the same account and Region as the service, and access is granted through an IAM role that Continuum assumes.
What leaders should look at
The first question is where code and environment data will be processed. With only US Regions available, organisations with data location requirements need to confirm whether source code, configuration and findings can be sent there, and what their data processing agreement with AWS covers.
The second is access. Continuum needs read access to code and visibility into network and resources in the AWS account. Security leads should limit which accounts and repositories are connected, and who can approve the fixes that come in.
The third is budget. The inference fee makes the cost variable. A pilot on one bounded codebase gives a better basis for estimates than AWS's examples.
AWS is the source of the features, prices and Regions above. hogby.ai has not tested the service. Earlier in October, AWS said its security agent had become part of Continuum. This launch covers the part of the service that handles code vulnerabilities.
Sources and media
- AWS News Blog: AWS Continuum for code vulnerabilities is now generally available
- AWS: AWS Continuum pricing
- AWS documentation: What is AWS Continuum?
Source: AWS.
Illustration: AI-generated with Grok Bot / hogby.ai
