What is AWS Security Agent?
AWS Security Agent is an AI agent (frontier agent) that acts as a virtual security engineer and secures applications throughout the development lifecycle. The service bundles three tasks that previously required manual specialist work: security reviews of architecture and design documents, security reviews of source code, and context-aware automated penetration testing. Security teams define their organization-wide requirements once in the AWS Console, such as approved authentication libraries, logging standards and data access policies, and AWS Security Agent enforces these requirements automatically in every review.
The problem AWS Security Agent addresses: in most organizations, security reviews and penetration tests are a bottleneck. External pentests happen periodically, manual code reviews do not scale with development velocity, and architecture flaws are often caught late, when fixing them is expensive. AWS Security Agent turns these point-in-time checks into a continuous, on-demand capability. For penetration testing, the agent builds a deep understanding of the application by analyzing source code, architecture diagrams and documentation, then executes multi-step attack chains that traditional automated scanners cannot find.
Core Features
- Design Security Review: You upload architecture and design documents to the web application and receive real-time feedback on compliance with your organization-wide security requirements before the first line of code is written. This reduces late-stage architectural rework.
- Code Security Review: Full scans of source code from GitHub, GitLab, Bitbucket, GitHub Enterprise Server, Confluence or S3 buckets, plus automated pull request analysis. Findings appear as PR or MR comments, and the agent can generate fixes as pull requests.
- On-Demand Penetration Testing: Specialized AI agents discover vulnerabilities, validate them through proof-based exploitation, chain them into higher-severity attack paths, and document reproducible attack paths with impact analysis.
- Threat Modeling (STRIDE): Generates threat models from design documents or codebases using the STRIDE framework to surface architectural risks early.
- Actionable Fixes with CVSS Scoring: Confirmed vulnerabilities are documented with a CVSS risk score, a reproducible attack path and a ready-to-implement code fix as a pull request. The focus on validated findings minimizes false positives.
Typical Use Cases
Shift-Left Security in Architecture Review: Teams validate design documents against centrally defined security requirements before implementation. Architecture-level risks are caught early, when fixing them is cheapest.
Continuous Code Review in the Pipeline: Through automated pull request analysis, every code change receives a security review directly in the repository. Findings and fix suggestions land where developers already work, with no separate tooling.
On-Demand Penetration Testing Before Release: Instead of waiting for the next periodic pentest window, teams start tests whenever needed. The agent chains vulnerabilities into realistic attack paths and delivers validated, fixable findings.
Benefits
- Security checks scale with development velocity instead of slowing it down.
- Organization-wide security requirements are defined once and enforced automatically in every review.
- Proof-based exploitation and CVSS scoring reduce false positives and prioritize real risks.
- Availability in EU regions (Frankfurt, Ireland) supports data residency requirements for European customers.
Integration with innFactory
As an AWS Reseller, innFactory supports you with the adoption and operation of this service.
Typical Use Cases
Frequently Asked Questions
What is AWS Security Agent?
AWS Security Agent is an AI agent that works like a virtual security engineer. It performs design security reviews, code security reviews and context-aware penetration testing. Security teams define their organization-wide requirements once in the AWS Console, and the agent automatically validates architecture documents and code against those standards.
When should I use AWS Security Agent?
Use AWS Security Agent when you want to shift security checks left in the development lifecycle and match them to your teams' velocity. Concrete scenarios: architecture reviews before coding, automated pull request analysis across multiple repositories, and on-demand penetration testing before a release without waiting for periodic external pentest windows.
How much does AWS Security Agent cost?
Penetration testing is billed on a pay-per-use basis at USD 50.00 per task-hour, metered per second. New customers get a 2-month free trial with up to 400 pentesting task-hours per trial month. Design reviews and code reviews are included within a defined monthly allowance at no separate additional charge; check the official pricing page for the current exact limits.
Which repositories and environments does AWS Security Agent support?
Code reviews work with GitHub, GitLab, Bitbucket, GitHub Enterprise Server, Confluence and S3 buckets. Findings are posted as pull request or merge request comments, and the agent can automatically generate fix PRs. Penetration testing operates across AWS, on-premises, hybrid, multicloud and SaaS environments.
What is AWS Continuum and how does it relate to Security Agent?
AWS Security Agent is part of AWS Continuum, a broader AWS security product family. In addition to design reviews, code reviews and penetration testing, Security Agent now also offers threat modeling using the STRIDE framework and IDE integrations that trigger reviews directly from the development environment.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of AWS (official documentation). This page does not represent an offer by AWS.