AWS Continuum Pricing Explained: Code Vulnerabilities, Pen Testing, Costs
AWS Continuum costs $200 per 1M lines of code monthly plus $10 per inference unit. How it works, cost estimates by codebase size, and regions.
AWS Continuum for code vulnerabilities is an AI security service. It scans your code, checks whether each vulnerability can actually be exploited in your AWS environment, and opens a pull request with a fix that a human must approve. It became generally available on October 22, 2026, in US East (N. Virginia) and US West (Oregon). There are two charges: $200 per million protected lines of code per month (less at higher volumes) and $10 per "Continuum inference unit" used on each vulnerability. That makes it cheap to switch on, but potentially expensive if you have a large backlog.
This guide explains what Continuum does and how its pricing works, with our own cost table for codebases of different sizes. We have not used Continuum ourselves. Everything below comes from AWS's documentation and named press coverage.
What is AWS Continuum?
AWS Continuum is the brand for AWS's AI-driven security services. The product page describes it as a system that discovers, prioritizes, validates and remediates security risks "at machine speed" within guardrails that customers set. It currently has two parts that you pay for separately:
| Part | What it does | Status |
|---|---|---|
| Continuum for code vulnerabilities | Finds, validates and ranks vulnerabilities, then proposes code patches, dependency upgrades or config changes as pull requests | Generally available since Oct 22, 2026 |
| Continuum for penetration testing | On-demand AI pen tests of deployed apps and source code, with threat models and reproducible proof | Formerly AWS Security Agent, now part of Continuum |
According to the AWS News Blog GA announcement, Continuum builds a "context graph" from your repositories and your AWS environment. A collector running in the account and Region where your code is deployed gathers details such as AWS Config resources and network configuration. Continuum uses that context to work out which systems are business-critical, who owns them, and what data they touch.
How does Continuum for code vulnerabilities work?
The GA post describes this workflow:
- Connect code. Supported sources are a GitHub integration or an Amazon S3 bucket in the same account and Region, read through an IAM role that Continuum assumes.
- Scan. Scans run on a schedule or on demand.
- Validate. Each finding gets an evidence level (for example "Static proven") and a reachability check. If a finding can be reproduced, Continuum runs the exploit in an isolated sandbox and attaches proof-of-concept code and reproduction steps.
- Prioritize. Issues show severity plus a risk assessment covering exploitability, likelihood and impact, along with the attack path and "blast radius".
- Fix. Continuum opens a GitHub pull request titled "Continuum fix" with the patch, the risk assessment and the proof.
- Human approval. A person must approve and merge every fix. AWS says customers will later be able to let Continuum act on its own within guardrails, gated on factors such as test coverage, scope and past success rate.
Continuum is model-agnostic. AWS's product page says it uses multiple frontier models and picks the best one for each task. The GA post does not list supported programming languages, so check the user guide before you budget.
How much does AWS Continuum cost?
These figures come from the official Continuum pricing page, in US dollars, pay-as-you-go with no minimum fee.
Code vulnerabilities, part 1: monthly context fee (billed as ContinuumContext-Code), based on protected lines of code:
| Protected lines of code per month | Price per 1M lines |
|---|---|
| First 10 million | $200 |
| Next 90 million | $180 |
| 100 million to 1 billion | $160 |
| 1 billion to 10 billion | $130 |
| Above 10 billion | $100 |
Code vulnerabilities, part 2: inference fee (billed as ContinuumInference): $10 per Continuum inference unit (CIU). AWS's own examples assume 1–2 CIUs per vulnerability and note that actual usage "varies with the work each vulnerability requires".
AWS's worked examples:
| AWS example | Lines of code | Vulnerabilities | CIUs each | Monthly total |
|---|---|---|---|---|
| Small | 1M | 100 | 1 | $1,200 |
| Mid-size | 10M | 1,000 | 1 | $12,000 |
| Enterprise | 100M | 10,000 | 2 | $218,200 |
Penetration testing: $50.00 per task-hour, metered per second. A task-hour is the combined time of every testing task running at once, so it usually adds up to more than the wall-clock length of the test. The first three revalidations of each finding are free. New AWS customers get a two-month free trial with up to 400 task-hours per month, and pen testing is included in the AWS Free Tier plan for new customers. The pricing page says the free trial applies to penetration testing only. There is no free trial for code vulnerabilities.
How much would Continuum cost for my codebase? (estimate table)
AWS's examples bundle the context fee and the inference fee together. In practice you can control the inference fee (how many findings you send through) but not the context fee. This table separates them, using the published tiers. These are our estimates using list prices, not AWS quotes.
| Codebase size | Context fee / month | + 50 vulns × 1 CIU | + 500 vulns × 1 CIU | + 500 vulns × 2 CIU |
|---|---|---|---|---|
| 500K lines | $100 | $600 | $5,100 | $10,100 |
| 2M lines | $400 | $900 | $5,400 | $10,400 |
| 15M lines | $2,900 | $3,400 | $7,900 | $12,900 |
| 50M lines | $9,200 | $9,700 | $14,200 | $19,200 |
(15M lines = 10M × $200 + 5M × $180. 50M lines = $2,000 + 40M × $180.)
The key point: for most teams, the inference fee will be the bigger part of the bill. In AWS's own mid-size example, inference is $10,000 against a $2,000 context fee, five times as much. The tool is also built to keep finding new issues, so the meter doesn't stop after month one.
Is AWS Continuum worth it? A checklist
Continuum is likely to make sense if most of these are true:
- Your code lives in GitHub or can be synced to S3 (no GitLab or Bitbucket integration is named in the GA post)
- Your workloads run in us-east-1 or us-west-2, the only two launch Regions
- You already have a scanner backlog you can't get through, and false positives are the main pain point
- Developers will review AI-written pull requests. Every fix requires human approval today
- You can budget for inference on every finding Continuum takes on, or limit which repos it protects
- Sandboxed exploit validation fits your security policy and your auditors' expectations
If you are outside those Regions, or most of your code sits outside GitHub, it's probably best to wait for expansion news. AWS re:Invent (our dates and livestream guide) starts November 30 and is a likely venue for it, though AWS hasn't announced anything.
When did AWS Continuum launch? Timeline
| Date | Event | Source |
|---|---|---|
| Jun 18, 2026 | Continuum for code vulnerabilities enters gated preview. AWS Security Agent's pen testing and code scanning become Continuum pen testing and Continuum code scanning, and Continuum threat modeling (STRIDE-format) is added | Help Net Security |
| Oct 22, 2026 | Continuum for code vulnerabilities generally available in N. Virginia and Oregon | AWS News Blog |
At the preview, Help Net Security reported that AWS's Chet Kapoor (VP of Search, Security and Observability) said newer cybersecurity frontier models, naming Claude Mythos, can find vulnerabilities and map attack paths quickly. According to that report, he said this is producing a fast-growing vulnerability backlog. That is the problem Continuum is meant to solve.
What are customers and developers saying about Continuum?
Every testimonial we could find is curated by AWS on its product page, so treat it as marketing:
- IBM's Matt Lewis (AWS EMEA CTO at IBM) is quoted praising "finding vulnerabilities and remediations our team could trust and act on."
- HENNGE K.K.'s Muhammad Furqan Habibi credits the pen-testing tool with "reducing the typical testing duration by more than 90%."
We found no independent community reactions on Reddit or Hacker News. The GA post was submitted to Hacker News but drew no comments at the time of writing. These are the questions people are searching:
- How does Continuum compare with the older AWS Security Agent? (Pen testing is Security Agent, renamed.)
- How many CIUs does a typical vulnerability use? (AWS doesn't say beyond its 1–2 CIU examples.)
- Which languages are supported? (Not listed in the GA announcement.)
- Does it work with GitLab or Bitbucket? (Not named. Only GitHub and S3 are.)
Editor's take
Continuum is a different kind of product from a traditional scanner: it proves a finding is exploitable before anyone spends time on it. If it delivers on that, it attacks the real cost in application security, which is the hours engineers lose to false alarms. The pricing makes us cautious, though. A context fee that's cheap to start with, combined with an open-ended $10-per-CIU meter, makes forecasting hard. Start with one or two critical repositories, watch the ContinuumInference line in Cost Explorer for a month, and only then expand. Tagging and cost-allocation discipline helps here, as we covered in our RDS per-snapshot billing explainer. Continuum also complements runtime detection rather than replacing it: see our piece on GuardDuty runtime monitoring threat rules.
AWS shipped another AI launch in the same month: read our GPT-6.1 Terra on Bedrock pricing comparison.
FAQ
What is AWS Continuum?
An AWS security service that uses AI to find, validate, prioritize and fix security risks. It has two parts: code vulnerabilities (GA October 22, 2026) and penetration testing (formerly AWS Security Agent).
How much does AWS Continuum cost?
For code vulnerabilities, $200 per million protected lines of code per month for the first 10M lines (dropping to $100 at the highest tier), plus $10 per Continuum inference unit. Pen testing costs $50 per task-hour.
What is a Continuum inference unit (CIU)?
It is the metering unit for the AI work Continuum does on each vulnerability. AWS's pricing examples assume 1–2 CIUs per vulnerability, at $10 each, and say actual usage varies.
Is there an AWS Continuum free tier?
Only for penetration testing: new customers get a two-month trial with up to 400 task-hours per month. AWS doesn't list a free trial for code vulnerabilities.
Which Regions is AWS Continuum available in?
At GA, Continuum for code vulnerabilities is available in US East (N. Virginia) and US West (Oregon).
Does AWS Continuum automatically fix code?
Not yet. It opens pull requests, and a human must approve and merge every fix. AWS says configurable autonomous actions will come later.
Is AWS Continuum the same as AWS Security Agent?
Partly. Security Agent's penetration testing became Continuum for penetration testing. Continuum for code vulnerabilities is a separate, newer capability.
Does AWS Continuum support GitLab?
The GA announcement names only GitHub and Amazon S3 as code sources.
Sources
- AWS News Blog: AWS Continuum for code vulnerabilities is now generally available
- AWS Continuum pricing
- AWS Continuum product page
- Help Net Security: AWS Continuum brings AI models to code vulnerability management (June 18, 2026)
- Hacker News submission of the GA post
Featured image: A technician running cabling in an Amazon data center, photo published by Amazon (illustrative; AWS Continuum is a software service). Source