AWS Security at Machine Speed

Ram Ramani of Amazon Web Services explained what security at machine speed means as AI coding agents multiply the code and changes reaching production. The session introduced AWS Continuum, covering continuously updated threat models, agentic penetration testing on every deploy, and context-driven vulnerability management that proves exploitability in an isolated sandbox before proposing fixes. At Security Field Day 16, Ramani argued that security teams still triage at human speed while threat models go stale and pen tests happen once a year.

Ramani’s answer is shared security agents at every development phase, drawing on common context like the threat model, code repository, and deployment details. Agents update the threat model as pull requests land and feed it into design reviews, coding agents, scans, and pen tests. AWS Security Agent places a pen test gate before staging, scoped to changes since the last deploy, which teams can schedule, trigger manually, or cap by agent hours. Continuum ingests findings from existing scanners alongside its own, uses a collector built on AWS Config to understand network, container, and security group settings, then validates each finding in a sandbox and opens a remediation pull request. In the demo, Continuum confirmed an insecure direct object reference in an invoices API by exfiltrating three customer PDFs from an unprivileged account.

Rather than raw CVSS scores, Continuum rates issues on likelihood factors like reachability and authentication and impact factors like blast radius and data value, so the same flaw might rate critical when internet-facing or low inside a private VPC. Teams set thresholds that route critical findings to human review. Addressing trust in agentic tools, Ramani warned that models can memorize public benchmarks, and cited Continuum exploiting 33 of 37 live-application targets end to end on vulnerabilities disclosed after model training. He noted that CISOs are already shifting hiring toward high-judgment security engineers, because when exploitable proof replaces noisy findings, the debate moves from whether a flaw is real to whether it matters. His closing point was that findings are now easy and validation is where the value lies.