The AWS Continuum security architecture flips everything you thought you knew about vulnerability management on its head — instead of the traditional “find it in prod, panic, and file a Jira ticket nobody looks at” approach, it reasons, validates, and acts across the full code vulnerability lifecycle at machine speed. Announced at AWS Summit New York on June 17, 2026, and currently in gated preview, Continuum is AWS’s bet that AI agents belong not just in your application code, but inside the security layer of your entire delivery pipeline.
What AWS Continuum Actually Does
At its core, AWS Continuum is an AI-native security service that ingests findings from across your environment — static analysis, runtime detection, dependency scanners, the works — and does something your existing SIEM absolutely cannot do: it reasons about them. It prioritizes by business impact, proves which vulnerabilities are actually exploitable (not just theoretically scary), and then drives fixes through your existing process. Not a parallel process. Not another dashboard nobody checks. Your process.
The service is built around three capability pillars:
- Threat Modeling via STRIDE (preview): Automated threat modeling using the STRIDE framework — Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege. Continuum analyzes your architecture and surfaces the threats your team would have found in a whiteboard session that never got scheduled.
- Pull-Request Code Scanning with Remediation: Scans PRs across major Git platforms (GitHub, GitLab, Bitbucket) and proposes inline remediations — not vague “fix this CWE” suggestions, but actual code changes.
- IDE and CI Integration: Via Kiro Power plugin, Claude Code plugin, and MCP server support, Continuum meets developers where they already are.
Worth noting: AWS Security Agent is now part of AWS Continuum. If you were already tracking Security Agent, it’s been folded into this larger offering.
The Trust Escalation Model: Learn Mode → Supervised → Autonomous
This is where the architecture gets genuinely interesting, and where AWS made a smart call that most AI security vendors fumble. Continuum starts in learn mode. It watches, it observes, it builds a model of your environment. It does not touch anything. It earns the right to act.
From there, trust escalation happens on a per-category basis. You might grant Continuum autonomous action on dependency updates — the lowest-risk category — while keeping it supervised for authentication-layer changes. That graduated permission model looks like this in practice:
- Learn mode: Observes findings, builds baselines, generates reports. Zero writes. Zero actions.
- Supervised mode: Proposes actions (PRs, config changes, remediation patches) for human approval before execution. Human is the final gate.
- Autonomous mode: Acts independently within explicitly granted categories. Every action is logged with full reasoning chain for audit.
This is the right architecture. “Agentic systems acting on your infrastructure without a trust ladder” is a sentence that should make any reasonable engineer nervous. AWS built the trust ladder in from day one.
STRIDE Threat Modeling Integration
The STRIDE integration is not a checkbox feature. Continuum analyzes your service graph, data flows, and trust boundaries against the STRIDE taxonomy and produces a threat model that maps directly to findings it’s already tracking. The output is actionable: each threat maps to a mitigation, and each mitigation can be linked to an existing PR scan or remediation workflow.
For teams that have historically done threat modeling as a quarterly Word document that immediately goes stale, this is a pretty significant upgrade. The model stays current because it’s derived from your actual running architecture, not a snapshot someone drew in Lucidchart during the original design review.
PR Scanning: What the Integration Looks Like
Pull-request scanning integrates with GitHub, GitLab, and Bitbucket via OAuth app or AWS CodeConnections (formerly CodeStar Connections). When a PR is opened, Continuum analyzes the diff for security findings and, depending on your configured trust level, either comments with findings and proposed fixes or opens a companion remediation PR automatically.
Findings include severity, CWE classification, exploitability assessment (this is where the AI reasoning layer genuinely adds value — it’s not just pattern matching), and a proposed code change. The proposed change is context-aware: it knows what language you’re in, what framework you’re using, and what the surrounding code looks like.
Kiro Power Plugin and Claude Code MCP Setup
Getting Continuum into your IDE requires either the Kiro Power plugin (Kiro is AWS’s new AI IDE, also announced at Summit NY) or the Claude Code plugin. For teams already on Claude Code, the MCP integration is the fastest path. Here’s the configuration:
# ~/.claude/claude_code_config.json
{
"mcpServers": {
"aws-continuum": {
"command": "aws",
"args": [
"continuum",
"start-mcp-server",
"--region", "us-east-1",
"--profile", "your-sso-profile"
],
"env": {
"AWS_REGION": "us-east-1"
}
}
}
}
For the IAM side, the Continuum service role needs these minimum permissions to operate in supervised mode. Autonomous mode adds write permissions per category as you grant them:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ContinuumReadAccess",
"Effect": "Allow",
"Action": [
"continuum:GetFinding",
"continuum:ListFindings",
"continuum:GetThreatModel",
"continuum:StartScan",
"securityhub:GetFindings",
"inspector2:ListFindings",
"codestar-connections:UseConnection"
],
"Resource": "*"
},
{
"Sid": "ContinuumSupervisedActions",
"Effect": "Allow",
"Action": [
"continuum:ProposePullRequest",
"continuum:CreateRemediationDraft"
],
"Resource": "arn:aws:continuum:us-east-1:ACCOUNT_ID:workspace/*"
}
]
}
Enabling Continuum via CLI for an existing repository connection:
# Enable Continuum on an existing CodeConnections connection
aws continuum create-workspace \
--name "my-app-security" \
--repository-connection-arn "arn:aws:codestar-connections:us-east-1:ACCOUNT_ID:connection/CONNECTION_ID" \
--repository-url "https://github.com/your-org/your-repo" \
--initial-mode "LEARN" \
--region us-east-1
# Check workspace status
aws continuum get-workspace \
--workspace-id "ws-XXXXXXXXXX" \
--region us-east-1
When Continuum Acts Autonomously vs. Escalating to a Human
The autonomy decision tree is worth understanding explicitly. Continuum will act autonomously when:
- The action category has been explicitly granted autonomous permission
- The finding’s exploitability score exceeds your configured threshold
- The proposed remediation has a confidence score above the autonomous-action floor you set
- The change is within the blast radius limits you’ve defined (lines of code changed, files affected, services touched)
It escalates to a human when any of those conditions aren’t met, when it encounters a conflict with existing code patterns it doesn’t understand with high confidence, or when the remediation would touch a file or service explicitly flagged as requiring human review. Every escalation includes the full reasoning chain: what it found, what it wanted to do, and exactly why it stopped.
That last part — the reasoning chain — is worth paying attention to during your learn-mode period. It’s telling you what the agent would have done. Review those logs before you start granting autonomous permissions, and you’ll have a much clearer picture of where to trust it and where to keep a human in the loop.
How This Fits the Broader Architecture Pattern
AWS Continuum at the security layer, paired with AWS DevOps Agent at the release layer, creates something that hasn’t really existed before: an AI-augmented delivery pipeline where security and release readiness are active participants in the process, not speed bumps bolted on at the end. The security findings Continuum surfaces and remediates during PR review are the same signals the DevOps Agent’s release readiness review can consume when deciding whether a release is safe to ship.
This is the architecture pattern to start designing toward. Agents embedded at each critical gate of the SDLC, operating with explicitly scoped trust, and handing off context between stages rather than dropping it on the floor between tools. If you’ve been waiting for AI to do something genuinely useful in your pipeline beyond “autocomplete but for shell scripts,” this is the answer.
At Enkompass (enkompass.net), this is our home turf. We design AWS architectures that survive contact with production — and the 3 AM page that comes with it. If you’d rather have seasoned cloud people handle it instead of learning the hard way at 2 AM, let’s talk. Reach out through our contact page or call us directly at +1-828-436-5667 — we’ll help you turn this from a someday-project into a done-deal.