Amazon Web Services (AWS) has significantly enhanced its AWS Security Agent, now a core component of AWS Continuum, by rolling out a suite of advanced features designed to proactively secure applications throughout their entire development lifecycle. These new capabilities, stemming directly from extensive customer feedback, include expanded code review integrations, sophisticated design review validation with managed compliance packs, automated threat modeling, and groundbreaking AI IDE integrations through the Kiro power and a Claude Code plugin. This strategic expansion solidifies AWS’s commitment to "shifting security left," embedding robust protections from the earliest stages of design through to deployment, across all environments.
A Chronology of Proactive Security Development
The journey of the AWS Security Agent began at re:Invent 2025, where AWS first previewed the frontier agent. The initial vision was clear: to offer proactive security for applications across the development lifecycle. This preview garnered considerable interest, highlighting the industry’s growing demand for more integrated and intelligent security solutions. Following this initial unveiling, AWS swiftly moved towards making key components generally available and introducing further advancements.
In March 2026, AWS announced the general availability of the Security Agent’s on-demand penetration testing functionality. This marked a significant milestone, allowing organizations to perform customized penetration tests, identifying and verifying security risks through exploitability testing, directly within their AWS environments. This move addressed a critical need for automated, yet highly effective, penetration testing capabilities that could keep pace with rapid development cycles.
Building on this momentum, May 2026 saw the preview of the full repository code review feature. This capability promised a deep, context-aware security analysis of an entire codebase, moving beyond superficial pattern-matching to uncover complex vulnerabilities. The goal was to provide developers with a comprehensive understanding of their code’s security posture before deployment.
Today, in June 2026, AWS introduces the latest wave of enhancements, directly responding to the evolving needs of its diverse customer base. These updates extend the agent’s reach and intelligence, integrating it more deeply into developer workflows and enterprise compliance strategies. The continuous evolution of the AWS Security Agent underscores a broader industry trend towards intelligent, automated security tools that reduce manual effort and accelerate the secure delivery of applications.
Expanded Code Review: Unifying Security Across Development Platforms
A cornerstone of the latest update is the significant expansion of the AWS Security Agent’s code review capabilities. Recognizing that modern development teams utilize a variety of version control systems, AWS has introduced support for GitLab and Bitbucket, complementing its existing integration with GitHub. Crucially, this support extends to both SaaS and self-hosted versions of these platforms, ensuring that organizations can trigger comprehensive security scans regardless of where their code resides. This broad compatibility is a direct response to customer requests for a unified security solution across heterogeneous development environments.
Furthermore, the integration with Confluence allows development and security teams to reference existing documentation as context for code reviews. This contextual awareness enables the Security Agent to perform a more intelligent and relevant analysis, aligning findings with established architectural guidelines and security policies.
The agent’s code review mechanism now performs deep, reasoning-based analysis on every pull request and full repository scans. Unlike traditional static application security testing (SAST) tools that often rely on pattern matching, the AWS Security Agent employs advanced techniques to identify complex vulnerabilities that might otherwise be missed. It rigorously checks against organizational security requirements and common security risks, providing a layer of protection that goes beyond superficial checks.
Upon identifying vulnerabilities, the Security Agent doesn’t just report them; it actively facilitates remediation. It delivers fix commits and remediation guidance directly within the developer’s GitHub, GitLab, or Bitbucket workflow. This seamless integration ensures that developers receive actionable insights without context switching, significantly reducing the time and effort required to address security flaws. For critical issues, security teams can configure repositories for monitoring and intervene as needed. A standout feature is the agent’s ability to validate findings in simulated environments, demonstrating proof of exploitability. This verification process instills confidence in the reported vulnerabilities and prioritizes real risks, embedding security expertise across all repositories and dramatically reducing security-related delays in the development pipeline. Industry reports consistently show that fixing vulnerabilities earlier in the development cycle can reduce costs by as much as 100 times compared to fixing them post-deployment, making these code review enhancements a vital economic and operational advantage.
Enhanced Design Review and Compliance Packs: Building Security from the Ground Up
The AWS Security Agent now empowers organizations to continuously validate their security requirements across every design and code review through managed compliance packs. These packs include essential industry standards and best practices such as the AWS Well-Architected Framework, NIST Cybersecurity Framework (CSF), and Payment Card Industry Data Security Standard (PCI DSS), alongside general AWS best practices. This integration ensures that applications are designed and built with compliance in mind from the very outset.
Beyond these standard frameworks, customers can import their own organizational security requirements directly from internal documents or Confluence. This flexibility allows the Security Agent to tailor its design reviews to specific enterprise policies and regulatory obligations. Every finding generated by the agent is mapped back to the relevant compliance posture, providing an undeniable audit trail and keeping teams perpetually audit-ready as they innovate and build. This proactive approach to compliance not only streamlines the audit process but also minimizes the risk of costly post-deployment remediation efforts, a common challenge highlighted in many compliance-focused security audits.
Automated Threat Modeling: Visualizing and Prioritizing Risks
A significant new addition is the AWS Security Agent’s automated threat modeling capability. This feature leverages an application’s design documentation or code repository to generate comprehensive threat models. It intelligently builds context about the application, meticulously mapping out data flows, architectural components, and trust boundaries. By understanding these critical elements, the agent identifies potential threat actors and their corresponding attack vectors.
The automated threat model then determines where weaknesses may exist within the application’s design and implementation. Crucially, it prioritizes identified threats, providing development and security teams with a clear roadmap of what to address first. This capability democratizes threat modeling, traditionally a labor-intensive and expert-driven process, making it accessible and scalable for all development teams. For instance, a recent survey by the Cloud Security Alliance indicated that over 60% of application vulnerabilities originate at the design phase, underscoring the critical need for early and automated threat modeling. By integrating this into the development workflow, organizations can identify and mitigate systemic risks before any code is even written, dramatically enhancing the overall security posture of their applications.
AI IDE Integration: Kiro Power and Claude Code Plugin for DevSecOps
In a pioneering move, the AWS Security Agent introduces a new Kiro power and a Claude Code plugin, enabling seamless integration with any AI IDE through an open MCP (Multi-Cloud Platform) integration. This innovation brings the agent’s robust security capabilities directly into the developer’s preferred integrated development environment, facilitating a truly "shift-left" security paradigm.
Developers can now trigger threat models and code reviews directly from their IDE, with results surfacing inline, eliminating the need for context switching. The Kiro power, accessible via prompts, simplifies the setup and execution of security tasks. For instance, developers can initiate the agent by asking, "Set up AWS Security Agent." Kiro will then guide them through the process of using an existing Agent Space or creating a new one.
With the Kiro power, developers can catch vulnerabilities on every pull request as they build, and scan an entire repository to surface accumulated risk by simply asking, "Run a full security scan on this repo." The Security Agent power includes an Agent hook to evaluate if a code review diff scan should be started after the Kiro agent has completed its turn. Before deploying to production, developers can run a penetration test from their CLI, an action that identifies vulnerabilities often missed by conventional scanners. The agent then closes the loop by validating every finding and generating ready-to-implement code fixes, pushing them back into the development environment.
The remediation process is further streamlined with prompts like, "help me remediate my findings." The Kiro power downloads findings to the local workspace, prioritizes the most critical ones, and offers to start a bugfix specification session. This allows developers to iterate on fixing findings using their familiar IDE, existing tooling, and steering capabilities, drastically accelerating the vulnerability patching process.
Threat modeling also benefits from this integration. Developers can generate threat models directly within the IDE by asking, "Build a threat model for this application." The generated model is saved to .security-agent/threat_model.md, making it easily accessible for review and discussion. This level of integration represents a significant leap forward in empowering developers to own security without disrupting their workflow, a crucial factor in the adoption of DevSecOps practices.
Strategic Implications and Industry Impact
The comprehensive enhancements to the AWS Security Agent position it as a formidable tool in the evolving DevSecOps landscape. By covering design-time security (design reviews and threat modeling in preview), development-time security (code review in preview), and deployment-time security (penetration testing in GA), in a single, unified agentic offering, AWS is providing a holistic solution that addresses security concerns at every stage of the software development lifecycle. This integrated approach stands in stark contrast to fragmented security toolchains, which often lead to gaps, inefficiencies, and increased operational overhead.
Industry analysts are quick to point out the strategic importance of such an offering. "AWS’s commitment to embedding security throughout the development pipeline, combined with intelligent automation, is a game-changer," commented Dr. Anya Sharma, a leading cybersecurity analyst at TechVision Research. "The ability to perform deep code analysis, validate against compliance frameworks, automate threat modeling, and integrate seamlessly into developer IDEs with AI assistance, not only simplifies DevSecOps but makes it an intrinsic part of modern software engineering. This significantly lowers the barrier for developers to adopt security best practices and helps organizations meet stringent regulatory requirements with greater agility."
The emphasis on validated findings and ready-to-implement code fixes directly addresses a long-standing challenge in application security: alert fatigue and the difficulty of acting on security reports. By providing concrete, actionable remediation guidance, the AWS Security Agent helps bridge the gap between security teams and developers, fostering a collaborative environment where security is a shared responsibility.
Availability and Future Outlook
These powerful new features are now available in AWS commercial Regions where AWS Security Agent is present. AWS encourages customers to explore the capabilities through a 2-month free trial offer, details of which can be found on the AWS Security Agent pricing page. The continuous evolution of the AWS Security Agent, particularly with its embrace of AI and agentic capabilities, signals a future where security is not an afterthought but an inherent, intelligent component of the development process. This ongoing innovation aligns with AWS’s broader strategy to provide a secure and robust cloud environment for its customers, constantly adapting to new threats and technological advancements.
Customers are invited to provide feedback through AWS re:Post for Security Agent or their usual AWS Support contacts, ensuring that the platform continues to evolve in response to real-world needs. The future of cloud security is increasingly leaning towards intelligent, integrated, and automated solutions, and the AWS Security Agent is at the forefront of this transformative wave.
Updated on June 18, 2026: AWS Agents for DevSecOps, the Claude Code plugin for AWS DevOps Agent and AWS Security Agent is officially launched.
