AWS Continuum sells code vulnerability fixes by the line

A security team drowning in daily alerts now has one more vendor saying it can cut the pile. AWS made Continuum generally available in US East (N. Virginia) and US West (Oregon) on 6 November 2026. InfoQ reports the service does three things. It scans code for vulnerabilities. It tries to exploit each finding in a sandbox. It writes a patch or a pull request when the exploit works.

Continuum has two products. The code vulnerability product reads a company's repositories and AWS environment. It then builds what AWS calls a context graph. It ranks findings by business impact, not by raw severity score. The penetration testing product analyses design documents and infrastructure. It runs tests that AWS says take hours instead of weeks. The service spent four months in gated preview before this release.

What it costs

AWS charges in two parts for the code product. A monthly context fee covers the lines of code it watches. The fee is $200 per million lines for the first 10 million. It falls to $180 for the next 90 million. It ends at $100 above 10 billion. A separate inference fee of $10 per Continuum inference unit covers the work on each finding. InfoQ gives one worked example from AWS. One hundred million lines with 10,000 vulnerabilities runs $218,200 in a month. That is about $20 per validated finding.

The pentest product is priced at $50 per task-hour, with per-second billing. New customers get two months free of up to 400 task-hours. The first three revalidations per finding are free.

What AWS says about the fix step

The InfoQ piece quotes AWS on the alert-fatigue problem. "Most organizations running large application estates see thousands of findings a day" and "most becomes noise". That is a vendor framing of the problem Continuum sells against. AWS says the service attaches proof-of-concept code and reproduction steps to each confirmed finding. A future release will apply fixes on its own once confidence passes a threshold the customer sets.

An engineer evaluating this should still read the fine print. AWS has not published a public benchmark of Continuum against Snyk, GitHub Advanced Security, Checkmarx or Semgrep. The context-graph claim and the exploit-in-sandbox claim both rest on AWS's own description. A buyer can run the same codebase through two tools and count the agreed finds. That is the real comparison.

The cost to try it is small for a small codebase and large for a big one. One million lines with 100 vulnerabilities is $1,200 a month. A hundred-million-line estate with ten thousand findings is $218,200 a month. A team signing a yearly contract for the second number should ask one thing first. How does the inference unit count scale with the kind of code they write?

Source

• AWS Ships Continuum for Code Vulnerabilities, InfoQ
• AWS Continuum pricing, Amazon Web Services