Inside AWS Security Agent: Architecting Autonomous AppSec on Bedrock AgentCore

A technical breakdown of AWS Security Agent’s architecture, and what it means to build a productized AppSec practice around it as an AWS partner.

Application security has run on a fixed cadence for two decades: design review at kickoff, code review in CI, a penetration test before launch and once a year after. That cadence assumed releases were infrequent enough for a human-scheduled process to keep pace. They no longer are. AWS Security Agent, generally available since 31 March 2026, is AWS’s answer: a system of purpose-built agents that runs all three checkpoints continuously, not on a calendar.

1. What Security Agent Actually Does

Security Agent ingests source code, architecture diagrams, API specifications, and threat models to build application context once, then reuses that context across three checkpoints: design review, automated code review on every pull request, and on-demand penetration testing. It combines static analysis (SAST), dynamic analysis (DAST), and active exploitation into a single context-aware pipeline, chaining individual findings into multi-step attack paths rather than reporting them as isolated vulnerabilities — the difference between “this endpoint lacks input validation” and “this endpoint lacks input validation, which combined with the over-permissioned IAM role three services downstream, allows full account takeover.”

Two operational details matter for how a partner sells this. First, findings on pull requests can open remediation PRs directly rather than just filing a ticket. Second, pentest runs are downloadable as structured reports as of March 2026 — the artifact a compliance-driven Enterprise buyer actually needs to hand to an auditor.

Technical deep-dive — how attack-chain correlation actually works. Security Agent’s differentiator over a conventional SAST/DAST pipeline is that findings are correlated against the same application-context graph across all three checkpoints, not scored in isolation. A representative chain looks like this: the code-review checkpoint flags an endpoint accepting unvalidated input (a CWE-20 class finding, moderate severity in isolation); separately, the design-review checkpoint had already logged an IAM role three services downstream as over-permissioned (an iam:PassRole wildcard against a data-plane resource); the pentest checkpoint then chains the two by demonstrating that the unvalidated input reaches a code path capable of assuming that role. The reported finding is not two moderate items — it is one critical finding with a proof-of-concept exploitation path, which is what materially changes the triage conversation with a client’s engineering lead from “add to backlog” to “patch before next release.”

{
  "finding_id": "SA-2026-04-0192",
  "severity": "CRITICAL",
  "chain": [
    { "checkpoint": "code_review",  "cwe": "CWE-20",  "component": "svc-orders/api/checkout" },
    { "checkpoint": "design_review","finding": "iam_overpermission", "role": "orders-worker-role" },
    { "checkpoint": "pentest",      "verified": true, "impact": "full account takeover via assumed role" }
  ],
  "remediation_pr": "opened",
  "task_hours_billed": 0.9
}

2. The AgentCore Substrate

Security Agent is not a standalone product bolted onto the console — it runs on Amazon Bedrock AgentCore, the same platform underpinning DevOps Agent and FinOps Agent. Two AgentCore primitives matter specifically for a security-sensitive workload. AgentCore Runtime isolates each agent session in its own Firecracker microVM, so one agent’s code execution cannot read another session’s data — a materially stronger boundary than container isolation, and part of why AWS positions frontier agents as usable in regulated industries. And AgentCore Gateway, the interface layer through which agents call external tools, is now protected by AWS WAF as of June 2026, closing the obvious objection that an autonomous pentesting agent is itself a new attack surface.

Coverage extends beyond AWS: Security Agent supports multicloud and on-premises environments, which is the detail that makes it relevant to this series specifically — an SI partner running a hybrid estate does not need a separate tool for the on-prem half.

3. Productizing the Practice

The commercial shift is pricing. Security Agent bills at $50 per
task-hour with a two-month free trial for new customers — consumption
pricing, not a project fee. That maps cleanly onto three partner-side
SKUs:

Enterprise — Security Agent embedded directly in the
CI/CD pipeline, triggering on every merge to a protected branch, with
pentest runs before every production release. Billed as a continuous
AppSec subscription, priced against the client’s release frequency
rather than a once-a-year statement of work.

SMB — a managed baseline: scheduled design and code
reviews on a fixed cadence, on-demand pentest before major releases,
delivered as a fixed monthly retainer that absorbs the task-hour
variability.

DNB — self-serve, API-triggered: the client’s own CI
pipeline calls Security Agent directly, and the partner’s value is in
the guardrail configuration, findings triage dashboard, and quarterly
attestation report — not in running the pipeline itself.

What changes for the SI partner

The traditional pentest sales motion — a six-week engagement sold
once or twice a year — does not survive this. The replacement motion
sells continuous coverage against a release cadence, competes on
hours-not-weeks turnaround, and prices on agent-consumption economics
rather than consultant-day rates. Partners who keep selling
point-in-time pentests against a competitor offering pentest-per-release
are pricing against a shrinking market.

Business Value Mapping

Continuous AppSec is not a faster version of the old pentest. It is a different product, sold on a different cycle, to a buyer who no longer accepts an annual answer to a weekly question.

Sources: AWS launches frontier agents for security testing and cloud operations (AWS Machine Learning Blog) · AWS Security Agent on-demand penetration testing GA (AWS What’s New, March 2026) · AWS Security Agent now supports downloading penetration testing reports (AWS What’s New) · AWS WAF adds support for Amazon Bedrock AgentCore Gateway (AWS What’s New, June 2026).