AWS Security Agent adds Kiro Power, Claude Code, simulated validations and new integrations support
Security scans now prove exploitability via sandbox simulation—cutting false positives and bringing findings directly into Kiro, Claude Code, and major SCM platforms.
View original announcement →Visual Summary
graph TD
A{{AWS Security Agent}}:::announced
B((Developer IDE)):::external
C([Simulated Validation]):::feature
D([Threat Modeling STRIDE]):::feature
E(Kiro / Claude Code):::compute
F([Security Requirements]):::feature
G((Source Control)):::external
H([Pull Request Scanning]):::feature
B ==>|"triggers scans"| E
E ==>|"invokes"| A
A -->|"executes exploits"| C
A -->|"generates models"| D
G -->|"connects"| A
A -->|"enforces"| F
A -->|"analyzes PRs"| H
H -->|"posts fixes"| G
C -.->|"proof of exploit"| B
classDef announced fill:#ff9900,stroke:#ec7211,color:#fff,font-weight:bold
classDef compute fill:#e3f2fd,stroke:#1565c0,color:#1565c0
classDef storage fill:#e8f5e9,stroke:#2e7d32,color:#2e7d32
classDef feature fill:#fff3e0,stroke:#e65100,color:#e65100
classDef external fill:#f5f5f5,stroke:#616161,color:#616161
What's New
AWS Security Agent, now part of AWS Continuum, has expanded with several major capabilities: IDE-native security workflows via Kiro and Claude Code plugins, simulated exploit validation that proves vulnerabilities are real before surfacing them to developers, and new source control integrations spanning GitLab.com, GitLab Self Managed, GitHub Enterprise, Bitbucket, and Confluence. The simulated validation feature executes detected findings in an isolated sandbox and returns proof-of-exploit evidence, eliminating the manual triage burden caused by false positives. Additionally, threat modeling using the STRIDE framework is now available in preview, allowing teams to analyze design documents or source code to identify architectural threats before writing a single line of production code.
How It Works
- IDE Integration (Kiro & Claude Code): Developers install the AWS Security Agent plugin for Kiro or Claude Code, connect their source control platform, and can trigger code scans, generate threat models, and remediate findings inline without leaving their IDE or switching context.
- MCP Integration: An open Model Context Protocol (MCP) integration allows any AI-powered IDE or CLI to surface Security Agent results, broadening compatibility beyond specific IDE plugins.
- Pull Request Scanning: On every pull request, the agent performs deep, reasoning-based analysis against organizational security requirements and common vulnerability patterns, then posts fix commits and remediation guidance directly into the GitHub, GitLab, or Bitbucket workflow.
- Simulated Validation: When a vulnerability is detected, the agent executes the finding in an isolated sandbox environment, generates proof-of-exploit evidence, and attaches that evidence to the finding so teams receive only confirmed, exploitable issues.
- Threat Modeling (STRIDE): Teams provide technical design documents, source code, or both; the agent generates a system overview covering architecture, trust boundaries, and data flows, then classifies threats by STRIDE category with severity levels and actionable mitigations.
- Confluence Integration: Existing Confluence documentation can be referenced as context during code reviews, allowing the agent to align findings with documented architectural decisions and organizational standards.
- Security Requirements Packs: Security teams define approved libraries, logging standards, and data access policies once in the AWS Console; the agent enforces these requirements automatically across all connected repositories.
Why It's Important
- Eliminates false-positive triage overhead: By providing sandbox-proven exploit evidence, security teams no longer spend cycles investigating unverified alerts, dramatically reducing alert fatigue and accelerating remediation prioritization.
- Shifts security left into the developer workflow: IDE plugins for Kiro and Claude Code mean developers encounter security feedback at the moment of coding rather than after a separate pipeline stage, reducing the cost and friction of fixing vulnerabilities late.
- Scales application security across large organizations: Automated enforcement of centrally defined security requirements across all repositories removes the bottleneck of manual security reviews keeping pace with multiple development teams.
- Enables continuous, on-demand penetration testing: Moving pen testing from a periodic, scheduled activity to an always-available capability means vulnerabilities can be discovered and validated at any point in the development lifecycle.
- Reduces context switching and tool sprawl: Consolidating threat modeling, code scanning, and remediation into a single agent accessible from existing IDEs and SCM platforms reduces the number of tools developers must learn and maintain.
- Improves prioritization confidence: Proof-of-exploit evidence gives security and engineering teams the context needed to make defensible, risk-based prioritization decisions rather than relying on CVSS scores alone.
How It's Different
- Proof-of-exploit vs. detection-only: Unlike traditional SAST/DAST tools that report potential vulnerabilities, AWS Security Agent actively simulates exploits in a sandbox and only surfaces findings it can demonstrate are real, a capability rarely found in integrated developer tooling.
- Reasoning-based analysis vs. pattern matching: The agent performs deep, context-aware analysis of the entire codebase rather than relying on signature or pattern-matching rules, enabling it to catch complex, multi-step vulnerabilities that conventional scanners miss.
- Native IDE remediation vs. external dashboards: Competing tools typically surface findings in a separate security portal; AWS Security Agent delivers fix commits and guidance directly inside the developer's existing IDE and SCM pull request workflow.
- Unified lifecycle coverage: Most tools specialize in either design review, code scanning, or penetration testing; AWS Security Agent covers all three phases—threat modeling, code review, and pen testing—within a single agent and consistent interface.
- Organizational policy enforcement as first-class feature: Security requirements (approved libraries, logging standards, access policies) are defined once and automatically enforced across all teams and repositories, rather than relying on ad hoc rule configurations per project.
- Open MCP integration: The open MCP interface allows any AI-powered IDE to connect, avoiding vendor lock-in to specific editor ecosystems and future-proofing the integration as the AI IDE landscape evolves.
When to Prefer It
- When security teams are overwhelmed by false positives: Organizations where engineers spend significant time triaging unverified scanner alerts will benefit immediately from simulated validation's proof-of-exploit filtering.
- When development velocity is constrained by security review bottlenecks: Teams that wait days or weeks for manual security reviews before merging PRs can use pull request scanning and automated remediation to maintain pace without sacrificing security rigor.
- When using Kiro or Claude Code as the primary IDE: Developers already working in these AI-native environments gain the most seamless experience, with security feedback surfaced inline without any workflow disruption.
- When operating across heterogeneous SCM platforms: Organizations using a mix of GitHub Enterprise, GitLab (SaaS or self-hosted), and Bitbucket can unify security scanning under a single agent rather than managing separate integrations per platform.
- When threat modeling is inconsistent or infrequent: Teams that lack dedicated security architects to produce STRIDE threat models can use the automated threat modeling capability to embed this practice into every design phase.
- When compliance requires documented security requirements enforcement: Regulated industries needing auditable evidence that organizational security policies were checked against every code change benefit from the centralized requirements pack and automated enforcement model.
- When preparing for or replacing periodic penetration tests: Teams that rely on annual or quarterly pen tests can supplement or replace those with on-demand, continuous penetration testing tied directly to deployment cycles.
Availability
- Code Review Updates (Pull Request Scanning, Simulated Validation, Security Requirements Packs): Currently in Preview.
- Threat Modeling: Currently in Preview.
- Kiro Power, Claude Code Plugin, and MCP Integration: Generally available as part of this release.
- New SCM Integrations (GitLab.com, GitLab Self Managed, GitHub Enterprise, Bitbucket, Confluence): Available now as part of this release.
- Regional Availability: All features are available in every AWS region where AWS Security Agent is currently supported; no region-specific exclusions were announced.
- Pricing: Specific pricing details were not disclosed in the announcement; refer to the AWS Security Agent pricing page or documentation for current information.
- Prerequisites: Users must have AWS Security Agent enabled via the AWS Console; SCM integrations require connecting source control platforms through the Security Agent console settings.
