AWS Ships Continuum for Code Vulnerabilities

AWS has made its Continuum service for identifying and addressing code vulnerabilities generally available in US East (N. Virginia) and US West (Oregon) regions, four months after its initial gated preview. The pricing model charges based on the number of findings and the codebase, with a context fee per million lines of code protected and an inference fee per Continuum inference unit consumed when working through findings.

Principal solutions architect Esra Kayabali explains that Continuum builds a context graph from repositories and the surrounding AWS environment and validates code vulnerabilities by running exploits in isolated sandboxes to confirm reachability and generate proof-of-concept code with reproduction steps. The service provides an attack path and blast radius assessment rather than just a risk score.

Continuum's pricing structure consists of a context fee based on lines of code protected, starting at $200 per million lines and decreasing to $100 above ten billion lines, and an inference fee of $10 per Continuum inference unit consumed. For instance, one million lines with 100 vulnerabilities at one inference unit each would cost $1,200, while 100 million lines with 10,000 vulnerabilities at two inference units each would amount to $218,200.

The context fee contributes $18,200, while inference fees account for the remaining $200,000 or roughly $20 per validated finding.

While the service effectively addresses the volume of daily findings, the per-finding fee highlights the importance of validating the relevance of each finding in specific environments. Amazon VP of Agentic AI Swami Sivasubramanian and Lead AI Security Go-to-Market Christopher Rae frame the problem as one of dealing with thousands of findings daily, with most being noise that does not matter in the given environment. Continuum's validation step is meant to distinguish between real vulnerabilities and mere noise.

AWS's pricing tiers and inference fees reflect the cost of identifying and validating code vulnerabilities on a large scale. Despite the improvements Continuum offers in confirming the exploitability of vulnerabilities, the product still lacks the ability to apply fixes autonomously, as it currently requires human approval for each remediation. This limitation highlights the need for additional acceptance tests to ensure that fixes resolve vulnerabilities without altering the intended behavior of the application.