# AWS Makes Continuum Code-Vulnerability Service Generally Available

> Continuum validates code findings and proposes fixes for human review. It is available in two US regions, with charges tied to codebase size and findings processed.

Oossa · 2026-11-06 · https://oossa.com/en/aws-makes-continuum-code-vulnerability-service-generally-available

AWS has made Continuum for code vulnerabilities generally available in US East (N. Virginia) and US West (Oregon), four months after announcing a gated preview. The service checks vulnerability findings against code and environment context, then proposes a fix as a patch or a pull request in a connected repository. A person must review and approve each fix before it ships.

AWS says the service is meant to help teams sort through the volume of scanner alerts. Its executives say large application estates can produce thousands of findings a day, many of which may be unreachable, unexploitable or already blocked by existing controls. Continuum aims to show which issues are exploitable and how an attack could affect connected systems, rather than relying on a severity score alone.

## How does Continuum validate a finding?

The service builds a context graph from code repositories and AWS environment information. Teams can connect code through GitHub or an Amazon S3 bucket. They can also set up an AWS collector to supply resource and network details from the account and Region where the code runs; that context helps Continuum judge whether an attacker can reach a vulnerable path and what other systems may be exposed.

For findings it can reproduce, Continuum runs an exploit in an isolated sandbox and attaches proof-of-concept code and reproduction steps. It also provides supporting code analysis, an attack path and an assessment of the potential blast radius. AWS says the service can assess whether existing defenses would detect and stop the validated path.

Continuum generates code patches, dependency upgrades or configuration changes and can open them as pull requests. The console warns that a generated patch does not mean the vulnerability is fixed: someone still needs to review and merge it. AWS says it plans to let customers authorize categories of fixes to run automatically after confidence checks, including test coverage, scope limits and past success.

## What does it cost?

Pricing has two parts, according to the AWS pricing details cited by InfoQ: a monthly context charge based on lines of code protected, and an inference charge of $10 per Continuum inference unit as findings are processed. Context starts at $200 per million lines and falls to $100 per million above ten billion lines.

AWS’s pricing examples show how finding volume can drive the bill. Protecting one million lines with 100 vulnerabilities at one unit each costs $1,200. Protecting 100 million lines with 10,000 vulnerabilities at two units each costs $218,200, including $200,000 in inference charges. The examples make the per-finding cost important for teams with large backlogs, even when their codebase is not especially large.

## The facts

- Continuum is generally available in US East (N. Virginia) and US West (Oregon).
- Teams can connect code through GitHub or an Amazon S3 bucket.
- The inference fee is $10 per Continuum inference unit, in addition to the monthly code-context charge.
- AWS’s example for 100 million lines and 10,000 vulnerabilities totals $218,200.

## Why it matters

Security teams can use Continuum to get exploit evidence and proposed fixes alongside scanner findings, but a person still has to approve and merge every fix. The optional AWS collector supplies network and resource context; how Continuum handles findings it cannot prove remains unclear.

## Sources & references

1. [AWS Ships Continuum for Code Vulnerabilities](https://www.infoq.com/news/2026/11/aws-continuum-ga/?utm_campaign=infoq_content&utm_source=infoq&utm_medium=feed&utm_term=AI%2C+ML+%26+Data+Engineering) – InfoQ, 2026-11-06
2. [Amazon Web Services (AWS)](https://aws.amazon.com/blogs/aws/aws-continuum-for-code-vulnerabilities-is-now-generally-available/) – Amazon Web Services (AWS)

Last updated: 2026-11-06