AWS Continuum Adds Credential Checks Before It Attacks

AWS Continuum's penetration-testing agent can now log into a target application itself before a test begins, authenticating with credentials a customer supplies and mapping every domain that login reaches, AWS said Sept. 18.

Until now, security teams configuring a Continuum pentest listed target URLs by hand and discovered authentication failures only after a full test cycle had already run. The new step authenticates into the application exactly as a real user would, AWS said, and captures every URL that login reaches, whether the credential succeeds, fails or times out, surfacing each one as a suggested in-scope target before the real test starts.

The only capability that touches a login

"Penetration testing is the only capability in AWS Security Agent that can authenticate to a user's system at runtime," AWS says in its own FAQ for the product, still named AWS Security Agent in its documentation even as AWS markets it under the newer Continuum brand. Credentials arrive either as a static username and password stored in AWS Secrets Manager, or through a Lambda function AWS calls a credential vendor. AWS's own guidance is explicit about the risk that creates: "We encourage users to create new credentials with appropriately scoped permissions for the purposes of penetration testing," rather than reusing an administrator account.

Operational limit	Value, per AWS's documentation
Regions at general availability (March 31, 2026)	6
Concurrent penetration tests per account	5
Typical test runtime	Under 16 hours
Maximum Agent Spaces per account	100

What AWS says the agent will not do

AWS's FAQ states plainly that "AWS Security Agent is not a professional penetration testing service," and that its findings need a human to validate, explain or extend them before anyone acts on the results. The agent is instructed to use "intentionally minimal impacting payloads," AWS says, extracting a database's version string rather than dropping a table when it finds a SQL injection flaw. AWS also recommends running it only against pre-production environments, since its guardrails against denial-of-service behavior and unexpected traffic spikes are described as controls, not a guarantee that nothing will break.

Security research site Penligent, which reviewed the product independently, put the credential question more bluntly than AWS does: a "context-aware pentest engine with too much authority stops being a validator and starts becoming an unnecessary blast-radius multiplier." AWS's scoped-credential guidance is the same warning in gentler language. The tool is only as contained as the permissions a customer chooses to hand it, and the new credential-testing step does not change that; it just moves the moment of authentication earlier in the process.

A crowded, largely unproven category

AWS's penetration-testing capability reached general availability March 31, 2026, in six regions, after a preview AWS announced at re:Invent on Dec. 2, 2025, The Register reported at the time. The Register described AWS's initial rollout as "a little more subdued" than its two biggest cloud rivals: Microsoft had already fielded 11 separate Security Copilot agents, and Google had shipped several of its own. AWS is not the only company betting an AI agent can do a security job that used to require a specialist; Cloudflare's own security-audit-skill, a comparable open-source tool built the same way, gained more than 18,000 stars on GitHub since June, though it turns a coding agent into an auditor rather than authenticating into a running application the way Continuum does.

None of the three companies has published a track record that would settle whether any of these agents perform reliably outside a demo. Microsoft's own Project Ire prototype, a separate malware-detection agent rather than a penetration-testing one, caught only 26 percent of malware samples in real-world testing, The Register's report said, a reminder that a capable-sounding demo and a dependable production tool are not the same claim. AWS shipped its own AgentCore Runtime the same month, a separate product built for running agents at production scale rather than testing them, which suggests AWS sees agent infrastructure and agent-run security testing as two halves of the same bet.

A suggestion, not an automatic scope expansion

A domain surfacing in the new credential-testing step does not put it in scope automatically. AWS's FAQ says any target URL still needs proof of ownership before Continuum will test it, either a DNS TXT record or an HTTP route that returns a validation string the customer controls. Requests to URLs outside the confirmed target list are blocked at the network level, and AWS says it monitors for attempts to reach unauthorized endpoints, terminating any test in an account where that happens. Credential testing, in other words, only shortens the list of domains a customer has to think about; it does not let the agent decide on its own that a newly discovered domain is fair game.

Penetration testing is one of four capabilities under the Continuum name, alongside code security review, threat modeling and design security review, each aimed at a different stage of building software rather than testing it once it is live. AWS's documentation describes the four as complementary: threat modeling and design review run before code exists, code review runs on pull requests, and penetration testing runs against a deployed target, which is also why it is the only one of the four that needs a customer's login at all. The other three read source code and documents a customer uploads; only the pentesting agent has to act like a user to find what a static review would miss.

What would change that picture

AWS has not published a false-positive rate, a benchmark score, or any comparison against a professional penetration-testing firm's output for Continuum's findings, the kind of number that would let a customer weigh its actual accuracy against the weeks of manual testing time AWS says it replaces. Until AWS or an independent customer publishes one, credential testing is easier to evaluate as a workflow improvement, fewer wasted cycles configuring scope, than as evidence the underlying findings are any better than they were before Sept. 18.