AI Penetration Testing with AWS Security Agent by Assembly

AI penetration testing, run by Assembly on AWS Security Agent

Assembly is an AWS Advanced Tier Services Partner. Our engineers set up, run and monitor AWS Security Agent, the AI penetration testing agent built by AWS and now part of AWS Continuum (Continuum for penetration testing), against your application, then walk your team through the report it generates. The agent is AWS's; the delivery is ours.

Relation to AWS services This professional service directly supports applications and workloads deployed on AWS. Assembly sets up and operates AWS Security Agent (now part of AWS Continuum) in your AWS account to penetration test web applications and APIs running on AWS services such as Amazon EC2, Amazon ECS, Amazon EKS and AWS Lambda, exposed through Amazon API Gateway, Elastic Load Balancing (Application Load Balancer) or Amazon CloudFront, with data in Amazon RDS, Amazon DynamoDB or Amazon S3. CI/CD integration also uses AWS Identity and Access Management (IAM), AWS Secrets Manager, AWS CloudTrail and AWS Budgets.

Why AI-driven penetration testing

• Code-aware analysis: unlike scanners that only probe from the outside, AWS Security Agent reads your source code and design docs to map endpoints, data flows and trust boundaries before it attacks.
• Validated findings, not noise: each finding is proven through real exploitation, which keeps false positives out of your report.
• Combined attack paths: the agent runs real attack chains, such as cross-site scripting (XSS), insecure direct object references (IDOR) and privilege escalation, and surfaces combined attack paths that scanners often miss.
• Built for your AWS environment: AWS Security Agent runs from your AWS account against the staging environment of your application.

Who it's for Technology companies with an application in production that want a code-aware penetration test of a staging environment that mirrors production.

How it runs

1. Qualification call: a short agreement on responsibilities, including the maximum run time.
2. Readiness checklist and setup call: an Assembly engineer works through access, the test user and guardrails with your team.
3. Agent run: AWS Security Agent runs against your staging environment, monitored by Assembly until it completes or reaches the agreed maximum run time.
4. Results walkthrough: we walk your team through the report, including the fixes AWS Security Agent recommends.

What the AWS Security Agent report includes

• Ranked findings with CVSS severity scores
• Proof through real exploitation
• Steps to reproduce each vulnerability
• The affected endpoint and code location
• Recommended fixes
• Combined attack paths that scanners often miss

The report is yours to keep.

What we need from you

• A staging environment that mirrors production (the agent never runs against production) and a way to restore it after the run
• A test user, with MFA switched off for that user if needed
• Access to your source code and design docs (repository or Amazon S3 bucket); an OpenAPI or Swagger spec helps

Guardrails

• Maximum run time: agreed before every run; Assembly stops the run when it reaches it.
• CI/CD integration adds: least-privilege IAM scoped to what the agent needs, AWS Secrets Manager for test logins, AWS CloudTrail audit logging, and AWS Budgets alerts that notify you of unexpected charges.

After the first report Assembly can set up runs triggered from GitHub Actions after major releases and re-test fixed findings, so security testing keeps pace as your application changes. Ongoing runs are scoped and agreed separately.

Important

• AWS Security Agent performs the testing and generates all findings. Assembly configures and operates the Service; it doesn't author, verify or warrant the findings.
• The agent actively attacks the target and may make irreversible changes to data in the tested environment. Use a non-production environment you can restore.
• A run sends a high volume of requests over a long period. You are responsible for any AWS infrastructure and service charges incurred in your AWS account, billed separately from your AWS Marketplace transaction.
• Eligible companies may qualify for AWS funding programs, subject to AWS approval.