AWS Continuum for code vulnerabilities reaches general availability

Continuum's main idea is context. Rather than flagging every CVE in a dependency tree, it maps the customer's actual AWS environment: which resources exist, how IAM identities relate to them, and what is reachable from the network. A flaw in code that is internet-reachable and runs with broad permissions ranks far higher than the same flaw in an isolated batch job.

The workflow then closes the loop. Continuum validates that a vulnerability is exploitable in context, prioritizes it, and generates a fix as a pull request for human review. AWS pitches this as replacing hours of manual triage and days of cross-team coordination between security and application owners.

The launch fits the week's dominant security theme: AI is now finding bugs faster than humans can patch them. OpenAI's Patch the Planet coalition used its models to find critical flaws in PHP, which runs an estimated 70% of websites. Anthropic's Frontier Red Team published work on using Claude to formally verify software at large scale. On HN, practitioners argue that automated discovery makes defensive automation mandatory, and some are already shipping AI-generated WAF proxies as stopgaps.

Caveats: auto-generated fixes still need careful review, since a plausible patch can introduce regressions. The value of the context graph depends on how completely Continuum can see multi-account and hybrid setups. Pricing and coverage of non-AWS workloads are worth checking before adoption.