Amazon Web Services (AWS) has announced a significant expansion of its AWS Security Agent capabilities, introducing a suite of features designed to embed proactive security deeply into the entire software development lifecycle. These updates, unveiled in June 2026, deliver enhanced code review, automated threat modeling, and groundbreaking integrations with AI-powered Integrated Development Environments (IDEs) through the Kiro power and a Claude Code plugin. The move solidifies AWS Security Agent’s position as a frontier agent within the broader AWS Continuum initiative, aiming to provide comprehensive, "agentic" security from an application’s design phase through to its deployment and ongoing operation.
The latest enhancements mark a pivotal moment in the evolution of DevSecOps, addressing the industry’s pressing need for integrated security tools that can keep pace with rapid development cycles. At the heart of these advancements is a commitment to "shifting left," empowering developers and security teams to identify and remediate vulnerabilities earlier, where the cost and effort of correction are significantly lower.
The Evolution of AWS Security Agent: A Chronology of Proactive Security
The journey of AWS Security Agent began at re:Invent 2025, where AWS first previewed the innovative service. The initial vision was to offer a proactive security solution that could secure applications throughout their development lifecycle across all environments. A key differentiator highlighted from the outset was its ability to perform on-demand penetration testing, customized to specific applications, and to verify discovered security risks through exploitability testing. This capability moved beyond mere theoretical identification to practical validation of potential attack vectors.
Following its initial preview, AWS progressively rolled out components of the Security Agent. General availability for on-demand penetration testing was announced in March 2026, providing organizations with a powerful tool for runtime security validation. This was closely followed by the preview of full repository code review in May 2026, which promised deep, context-aware security analysis of an entire codebase, moving beyond individual file scans.
The current announcement in June 2026 represents a comprehensive rollout of features, building upon customer feedback and expanding the agent’s reach across critical phases of the development process. These updates are strategically designed to create a unified security posture, connecting design, development, and deployment security under a single, intelligent framework. This chronological progression underscores AWS’s deliberate approach to building a robust, integrated security offering that evolves with the dynamic demands of modern software development.
Deep Dive into Enhanced Capabilities
The new features introduced by AWS Security Agent are structured to provide layered protection and integrated intelligence across the development pipeline.
Comprehensive Code Review Updates: Expanding Reach and Intelligence
One of the most significant updates lies in the AWS Security Agent’s code review capabilities, which now extend far beyond its initial scope. Recognizing the diverse tooling environments within enterprises, AWS Security Agent now supports connection to GitLab and Bitbucket, in addition to GitHub. This expanded compatibility includes both SaaS and self-hosted versions of these popular Source Code Management (SCM) platforms, ensuring that organizations can trigger scans regardless of where their code resides. This broad integration is crucial for enterprises managing complex, multi-repository development landscapes, facilitating a consistent security posture across all projects.
Furthermore, the agent can now integrate with Confluence, allowing security reviews to reference existing documentation as contextual information. This capability ensures that security analysis is not performed in a vacuum but considers architectural decisions, design specifications, and existing security policies, leading to more accurate and relevant findings.
A hallmark of the enhanced code review is its introduction of deep, reasoning-based analysis. Unlike traditional static application security testing (SAST) tools that often rely on pattern-matching to identify known vulnerabilities, AWS Security Agent employs advanced techniques to understand the intricate logic and data flows within an application. This allows it to identify complex vulnerabilities that might otherwise evade detection, such as logical flaws, multi-step attack chains, or subtle misconfigurations that violate organizational security requirements. By checking against both common security risks and custom enterprise policies, the agent is designed to catch what other tools miss, significantly elevating the quality of security findings.
The integration of security directly into developer workflows is also a key focus. Developers will receive fix commits and remediation guidance directly within their GitHub, GitLab, or Bitbucket environments. This immediate, in-workflow feedback loop minimizes context switching, a notorious productivity drain, and empowers developers to address security issues as they write code. For security teams, the agent allows for centralized configuration of monitored repositories and provides the necessary visibility to intervene on critical issues. Critically, AWS Security Agent validates findings in simulated environments to demonstrate proof of exploitability, transforming theoretical vulnerabilities into actionable, verified risks. This approach embeds security expertise across all repositories, drastically reducing security-related delays in the development pipeline by providing developers with precise, actionable intelligence rather than generic warnings.
Proactive Design Review and Compliance: Security from Conception
Security is most effective when considered at the earliest stages of design, before a single line of code is written. AWS Security Agent’s design review updates cater precisely to this principle, enabling continuous validation of security requirements across every design and code review. The introduction of managed compliance packs is a game-changer for organizations operating in regulated industries or striving for robust security postures. These packs include the widely recognized AWS Well-Architected Framework, NIST Cybersecurity Framework (CSF), and Payment Card Industry Data Security Standard (PCI DSS), alongside AWS’s own best practices.
Organizations can leverage these pre-defined compliance checks to automatically assess their designs against industry standards. Moreover, the flexibility to import custom organizational requirements directly from internal documents or platforms like Confluence ensures that the agent aligns perfectly with unique enterprise policies and risk appetites. Every finding generated by the design review is meticulously mapped back to the organization’s overall compliance posture. This continuous mapping ensures that teams remain audit-ready throughout the development process, significantly reducing the burden and risk associated with compliance reporting and external audits. By shifting compliance validation left, organizations can proactively address potential deviations, thereby mitigating future compliance failures and associated penalties.
Automated Threat Modeling for Early Risk Identification
A new, powerful feature is the AWS Security Agent’s ability to generate comprehensive threat models. Leveraging either design documentation or the code repository itself, the agent builds a deep contextual understanding of the application. This includes mapping out data flows, architectural components, and trust boundaries. By doing so, it can accurately identify potential threat actors and their associated attack vectors. The agent then determines where weaknesses may exist within the application’s design or implementation, prioritizing these threats based on their potential impact and likelihood.
Automated threat modeling represents a significant leap forward in proactive security. Traditionally a manual, labor-intensive process, threat modeling often becomes a bottleneck or is skipped entirely due to resource constraints. By automating this crucial step, AWS Security Agent enables development teams to systematically identify and prioritize security risks at the earliest possible stage. This allows for the integration of mitigation strategies into the design, which is vastly more cost-effective and less disruptive than retrofitting security measures into an already built application. For instance, discovering a critical data leakage vulnerability during the design phase can prevent costly redesigns, emergency patches, and potential data breaches further down the line.
Revolutionizing Developer Workflow with AI: Kiro Power and Claude Code Plugin
Perhaps the most forward-looking aspect of these updates is the integration with AI-powered IDEs through the new Kiro power and a Claude Code plugin for Security Agent. This innovative integration aims to seamlessly weave security analysis into the developer’s everyday coding environment, leveraging the power of generative AI. The AWS Security Agent can now be integrated with any AI IDE through an open MCP (Multi-Agent Communication Protocol) integration, signaling a strategic move towards a truly "agentic" development and security ecosystem.
With the Kiro power and Claude plugin, developers can trigger threat models and code reviews directly from their IDEs. The results of these analyses surface inline, eliminating the need for context switching—a major boon for developer productivity. This means vulnerabilities are highlighted, and remediation suggestions are provided precisely where and when they are most relevant: as the code is being written or reviewed.
The Kiro power, accessible through simple prompts like "Set up AWS Security Agent" or "Run a full security scan on this repo," streamlines the security workflow. It checks for existing Agent Spaces or assists in creating new ones, then executes comprehensive scans. An "Agent hook" ensures that code review diff scans are initiated automatically after the Kiro agent completes its turn, ensuring continuous scrutiny of changes. For pre-deployment validation, developers can run penetration tests directly from their CLI, leveraging Security Agent’s capability to find issues that traditional scanners often miss. The agent closes the loop by validating every finding and generating ready-to-implement code fixes, reducing the burden on developers to craft solutions from scratch.
Furthermore, the Kiro power empowers developers to remediate findings efficiently. By asking "help me remediate my findings," the power downloads critical findings to the local workspace, prioritizes the most impactful ones, and offers to initiate a "bugfix spec session." This allows developers to iterate on fixes within their familiar IDE environment, leveraging their existing tooling and other AI powers, ensuring a highly integrated and productive security remediation process. Similarly, threat models can be generated within the IDE by prompting "Build a threat model for this application," with the output saved locally for easy access and review. This deep integration of AI into DevSecOps workflows marks a significant paradigm shift, making security an intrinsic, invisible part of the development process rather than an external, often disruptive, gate.
Industry Context and Strategic Imperatives
These comprehensive updates to AWS Security Agent arrive at a critical juncture in cybersecurity. The escalating threat landscape, characterized by sophisticated attacks and a growing surface area due to rapid cloud adoption, places immense pressure on organizations to enhance their security posture. The average cost of a data breach continues to rise, exceeding $4 million globally, according to recent industry reports. This economic reality underscores the imperative for proactive, preventative security measures.
AWS’s vision for "agentic" security, epitomized by AWS Security Agent and the broader AWS Continuum, represents a strategic response to these challenges. By providing a unified, intelligent agent that spans the entire software development lifecycle, AWS aims to democratize advanced security practices, making them accessible and actionable for all developers and security professionals. This approach moves beyond disparate point solutions, which often lead to security blind spots and operational overhead, towards a holistic, integrated platform. The integration with AI-powered IDEs is particularly significant, aligning with the broader industry trend of AI-assisted development and recognizing that the future of secure coding lies in intelligent, in-workflow guidance.
Broader Implications for Businesses and Development Teams
The enhancements to AWS Security Agent carry profound implications for various stakeholders within an organization.
- For Developers: The most immediate impact will be a streamlined and less disruptive development experience. By embedding security analysis, recommendations, and even fix commits directly into their workflows, developers can write secure code faster, with fewer delays caused by late-stage security findings. The elimination of context switching, facilitated by AI IDE integrations, significantly boosts productivity and reduces the friction often associated with security processes.
- For Security Professionals: These updates elevate security teams from reactive firefighters to strategic partners. With automated threat modeling, continuous design reviews, and sophisticated code analysis, security professionals gain earlier visibility into risks, allowing them to focus on high-impact strategic initiatives rather than manual, repetitive tasks. The agent’s ability to validate exploitability and map findings to compliance frameworks also provides a clearer, more defensible security posture.
- For Organizations: The overarching benefit is a substantial reduction in operational risk and cost. Proactive security, especially at the design and development phases, drastically lowers the cost of remediation compared to addressing vulnerabilities found in production. By accelerating the secure delivery of applications, businesses can maintain agility, innovate faster, and enhance their competitive edge. Furthermore, the built-in compliance validation strengthens an organization’s ability to meet regulatory requirements, avoiding potential fines and reputational damage. The unified nature of AWS Security Agent simplifies vendor management and reduces tool sprawl, leading to more efficient security operations.
Availability and Next Steps
The newly announced features for AWS Security Agent are now available in AWS commercial Regions where AWS Security Agent is supported. AWS encourages customers to explore the capabilities, which cover design-time security (design reviews and threat modeling in preview), development-time security (code review in preview), and deployment-time security (penetration testing in general availability).
For organizations interested in adopting this comprehensive security solution, detailed pricing information, including a 2-month free trial offer, is available on the AWS Security Agent pricing page. Customers can begin leveraging these advanced features directly from the Security Agent console. AWS also invites feedback through AWS re:Post for Security Agent or via existing AWS Support channels, emphasizing its commitment to continuous improvement based on user experience.
These updates solidify AWS’s commitment to empowering customers with advanced, integrated security solutions, marking a significant stride towards a future where security is not an afterthought but an inherent, intelligent component of every stage of the software development lifecycle.
