A security finding only matters if it can be exploited in your environment. That is the premise of AWS Continuum for code vulnerabilities, generally available since October 22, 2026. When it can, the service runs the exploit in an isolated sandbox, attaches the proof of concept and opens the pull request with the fix.
What it does with your code
Continuum builds a context graph that joins the code in your repositories with your AWS account. An optional collector, deployed in the account and Region where the code runs, gathers AWS Config resources and network configuration. That lets it go further than listing whatever the scanner flags:
- It confirms whether each finding is exploitable and assigns an evidence level, such as "static proven" when static analysis proves the vulnerable path.
- It reproduces what it can: it runs the exploit in a sandbox and attaches proof-of-concept code and reproduction steps.
- It describes the impact: attack path, source analysis, blast radius, and whether your current defenses would detect and stop that path.
- It proposes the fix as a code patch, a dependency upgrade or a configuration change, and opens it as a pull request in the repository.
In the console, the Findings tab keeps raw scanner output, while Issues holds only what has been validated and ranked by business impact. Anyone who has triaged a SAST report with hundreds of alerts will appreciate that split.
Every fix goes through a human today: someone reviews and merges the PR. AWS says it will later let Continuum apply changes on its own, gated by criteria such as test coverage, scope bounds and historical success rate.
What it costs
There are no upfront costs or minimum fees, and no free tier for this part of the service (the two-month trial only covers penetration testing). You pay a tiered monthly fee per protected line of code, plus $10 per Continuum inference unit (CIU) the analysis uses.
| Monthly protected lines of code | Price per million lines |
|---|---|
| First 10 million | $200 |
| Next 90 million | $180 |
| 100 million to 1 billion | $160 |
| 1 billion to 10 billion | $130 |
| Over 10 billion | $100 |
An organization with 2 million lines pays $400 a month in context fees. At 150 million lines the bill is $26,200: $2,000 for the first 10 million, $16,200 for the next 90 and $8,000 for the last 50. CIUs come on top, and neither the announcement nor the pricing page says how many a scan consumes. That is the number you need before budgeting: run a pilot on one well-scoped repository and read the actual usage off the bill.
Turning it on
The announcement has no CLI commands; everything happens in the AWS Continuum console, under Code vulnerabilities:
- Connect a code source: a GitHub integration or an Amazon S3 bucket. The bucket must live in the same account and Region where you enable Continuum, which reads it by assuming an IAM role.
- Create an environment that scans that source on the schedule you choose.
- Optionally, deploy a collector in the account and Region where the code runs and authorize the environment to use it. Without it, Continuum loses the AWS context it uses to prioritize.
For now it is only available in US East (N. Virginia) and US West (Oregon). The announcement lists no supported languages and no Git hosts besides GitHub.
How it stacks up against Claude Security
The obvious comparison is Claude Security, which Anthropic offers in public beta to Claude Enterprise customers. Both validate before raising an alert and both leave the fix to a person, but they start from different places.
| AWS Continuum | Claude Security | |
|---|---|---|
| Status | Generally available | Public beta (Claude Enterprise) |
| Scanning | Scheduled per environment | Continuous as code changes |
| Validation | Sandbox exploit and evidence level | Adversarial verification of each finding |
| Context | Code plus your AWS account | Code and an editable threat model |
| Fix | Pull request in the repository | Recommended patch for review |
| Sources | GitHub or S3 | Connected repositories |
If your code runs on AWS, Continuum's edge is knowing whether the vulnerable path actually reaches an exposed resource and whether your defenses stop it, something a tool that only sees the repository can't infer. If your services span several clouds or your code lives outside GitHub, that context is gone, and what's left is another scanner with validation, priced by lines of code.
Sources
- AWS Continuum for code vulnerabilities is now generally available, AWS News Blog, October 22, 2026.
- AWS Continuum pricing, Amazon Web Services.
- Claude Security, Anthropic.