AWS uses AI to fix code vulnerabilities, easing the security burden on businesses

[Financial News] Amazon Web Services (AWS) has launched a service that uses artificial intelligence (AI) to identify security vulnerabilities in software code and suggest ways to fix them. Rather than simply detecting vulnerabilities, it verifies whether they could be exploited in real-world attacks and helps businesses address the highest-risk issues first. The aim is to shorten companies’ security response times and reduce the workload of development and security staff.
According to industry sources on the 5th, AWS officially launched an AI-powered code security service called “AWS Continuum for Code Vulnerabilities.”
AWS Continuum analyzes companies’ software code and cloud operating environments to detect security vulnerabilities and assess the possibility of real-world attacks. When a vulnerability is found, the service evaluates its potential impact on a company’s key systems, sets priorities for addressing it, and suggests remedies such as code changes or security configuration updates.
Existing security assessment tools could detect numerous vulnerabilities, but determining whether they might be exploited in real-world attacks required separate verification. Companies operating large-scale services may receive thousands of vulnerability findings a day, but only some may require action.
To address this problem, AWS Continuum analyzes companies’ code repositories alongside information about their cloud infrastructure. It determines whether a vulnerability is accessible from outside and whether hackers could exploit it to reach critical services, including customer information and payment systems.
The service also verifies whether discovered vulnerabilities could actually be exploited. AWS Continuum recreates attacks in a test environment isolated from external systems and provides the attack path and the basis for its analysis. It also assesses whether the company’s existing security systems can detect or block the attack.
Once a vulnerability is confirmed, AI generates proposed code changes, related software updates, or changes to security settings. The proposed changes are submitted to the code repository used by developers as a request for review. They are incorporated into the actual code after the person in charge reviews and approves them.
However, the AI does not modify code on its own. At present, every change requires review and approval by the person in charge. AWS plans to expand the service so that it can automatically carry out some changes in line with the security standards and scope set by each customer.
AWS expects the service to reduce the time needed for vulnerability verification, which previously took several hours, as well as the time security and development teams spend coordinating fixes.

[email protected] Jang Min-kwon Reporter