Adopt AWS Security Agent (and eventually AWS Continuum) to provide AI-driven penetration testing, vulnerability validation, and automated remediation across all repositories in the GitHub org — complementing existing Datadog code analysis with exploit-validated findings and context-aware attack chain discovery.
Current state:
- Datadog code analysis (SAST, SCA, secrets detection) deployed across the GitHub org — provides broad static coverage and dependency scanning.
- AWS GuardDuty deployed across the AWS org — runtime threat detection at the infrastructure layer, no source code integration.
- Amazon Inspector deployed across the AWS org — infrastructure and workload vulnerability scanning (EC2, ECR images, Lambda), no application-layer testing.
- Gap: No dynamic application security testing (DAST), no penetration testing at scale, no exploit validation of static findings. Datadog flags vulnerabilities but cannot prove exploitability or chain findings into attack paths. Manual pen testing is periodic and limited to critical apps.
AWS Security Agent fills this gap by acting as an autonomous pen tester that ingests source code and documentation, validates exploitability, chains findings, and generates remediation PRs. AWS Continuum (gated preview) extends this into a continuous lifecycle — discover, prioritize, validate, remediate — with graduated autonomy.
AWS Security Agent (GA) — on-demand penetration testing, SAST, DAST, code scanning, remediation PR generation. Now positioned by AWS as part of AWS Continuum rather than a wholly separate product
AWS Continuum (gated preview → GA when available) — continuous vulnerability lifecycle management (discover → prioritize → validate → mitigate), with Security Agent as its pen-testing, code-scanning, and threat-modeling component
Metered per second, no upfront cost or minimum fee. The ~$1,200-per-app figure is our own estimate (≈24 task-hours) and is not an AWS-published number — validate against real runs during the trial
Security Agent code scanning
TBD
Preview, pricing not yet published
Continuum
TBD
Gated preview, pricing not yet published
Free trial
$0
2 months for new Security Agent customers, starting at the first pen test run; each trial month includes up to 400 pen-testing task-hours
All production-deployed repositories connected to Security Agent agent spaces
On-demand pen tests runnable against any application endpoint
Validated findings (with exploit proof) surfaced for at least top-10 critical applications
Automated remediation PRs generated and flowing through standard review
Clear delineation documented between Datadog findings and Security Agent findings (who triages what)
Continuum access obtained (gated preview or GA) and an adoption decision recorded, or a documented decision to defer — the criterion is met by reaching a decision, not by Continuum reaching GA
AWS now describes Security Agent as part of Continuum rather than a standalone product. Does that change the plan's sequencing — adopt Security Agent now and evaluate Continuum later — or does Continuum's gated preview gate access to Security Agent features we want?
Does Security Agent's GitHub integration support GitHub Enterprise (our tier), or only github.com?
What IAM permissions/roles are required in our AWS org to operate Security Agent?
Can Security Agent test applications behind VPN/private endpoints via VPC connector, and do we need that?
How do we handle domain ownership validation for internal-only applications?
What's the right triage boundary between Datadog findings and Security Agent findings — severity threshold, exploitability, or something else?
Status active → planned: the product is registered but adoption has not started
2026-07-24
planned
Review pass: corrected STRIDE threat modeling attribution to AWS Security Agent (preview) per AWS documentation, resolving a contradiction with the capability table; noted that AWS now positions Security Agent as part of Continuum, with a matching open question on sequencing; recorded Amazon Inspector as an existing org-wide tool; cited the $50/task-hour rate and flagged the ~$1,200-per-app figure as our own estimate; made the Continuum evaluation criterion decision-bounded rather than dependent on a GA date; added References