Amazon launches a tool that tests software flaws before fixing them

Amazon Web Services (AWS) has made a security tool called Continuum for code vulnerabilities generally available. Instead of just listing software flaws, it tries to attack them in a sealed test space to see which ones are real. It then proposes fixes. It launched in two US regions, and the price depends on how many flaws it works on.

What it does

Security scanners often flag thousands of problems a day. AWS executives say most of that is noise that does not matter in a given company's setup. Continuum tries to cut it down. It runs the exploit in an isolated sandbox and attaches the proof, including the steps to reproduce it. Each finding gets an evidence level, plus an attack path and an estimate of how far damage could spread.

Fixes arrive as patches or as pull requests, which are proposed code changes, in the connected code repositories. An optional add-on collector can share details about where the code runs, which helps judge whether an attacker could actually reach the flaw.

What it costs

There are two charges. The first is $200 per million lines of code protected each month, falling to $100 above ten billion lines. The second is $10 per inference unit, a measure of work, used as flaws are processed.

• 1 million lines and 100 flaws at one unit each: $1,200
• 100 million lines and 10,000 flaws at two units each: $218,200
• In the large example, $18,200 is the code fee and $200,000 is the per-flaw fee

That works out to roughly $20 per validated finding. AWS did not mention the pricing in its announcement. It appears on the pricing page.

Open questions

One engineer who commented on the launch noted that proof in a sandbox shows the code can be exploited, not that the path exists in your own environment. Findings the tool cannot prove also need somewhere to go. AWS documents what happens to proven findings and says nothing about the rest.

For now, a person approves every fix before it ships. The console warns that a generated patch does not mean the issue is fixed. AWS plans to let Continuum apply some classes of fix on its own once criteria such as test coverage and past success rate are met. Critics want a clear test for that step. Google's CodeMender, a similar tool, checks that a patch does not change how the application behaves. AWS's own console caveat concedes that Continuum does not perform that check.

What is and is not included

Only the code vulnerability feature is generally available, in US East (N. Virginia) and US West (Oregon). AWS's penetration testing is separate and costs $50 per task-hour. Threat modeling, announced in preview in June, has no published price.

Who it affects

Companies that write their own software and drown in security alerts are the target. Fewer false alarms could save time. Because the bill grows with each flaw, a business with many findings should estimate costs before committing.