According to Amazon Web Services (AWS), artificial intelligence is now allowing developers to build software at a faster pace, but security processes will need to evolve alongside it as AI coding and coding agents take on increasingly complex development tasks.
Joel Garcia, Head of Technology, Singapore Enterprise, AWS, explains how agentic systems can move beyond coding assistance
During a media workshop on building and securing applications with AI agents, the cloud giant demonstrated how agentic systems can move beyond simple coding assistance and take on work spanning requirements, system design, implementation and security testing.
The message from the company was not that developers are being removed from the process. Instead, the company argued that as AI handles more execution, human involvement increasingly shifts toward judgment, evaluation and governance.
AI coding moves beyond autocomplete
AWS used Kiro, its agentic development environment, to demonstrate the shift.
Kiro uses what the cloud giant calls “spec-driven development,” where an initial prompt can be turned into structured requirements, technical design and implementation tasks before code is written. Its agents can then work through those tasks while developers review and refine the direction of the project.
AWS’s current Kiro documentation similarly describes the platform as an agentic coding service that turns prompts into detailed specifications and then into working code, documentation and tests.
Kiro also supports checkpoints that allow developers to restore earlier workspace states when an agent’s changes need to be reversed.
The approach reflects one of the workshop’s main themes: AI coding tools are becoming capable of doing more than completing individual lines of code, but greater autonomy also increases the need for developers to define what should be built and evaluate whether the result is correct.
Security has to move earlier
The challenge is that faster software development can put additional pressure on security teams.
A 2026 Checkmarx survey of 2,350 CISOs, application security managers and developers across 14 countries found that 96% of developers reported having AI tools in their development environments, while only 18% said they continuously apply application security as they write code. The same research found that 75% of organizations knowingly deploy vulnerable code at least some of the time.
AWS’s workshop therefore positioned security as something that should run alongside development rather than being left primarily for the end of the software lifecycle.
AWS brings agents into security testing
AWS demonstrated this approach through AWS Security Agent, which is now part of AWS Continuum.
AWS says Continuum can bring security checks into different stages of software development, including threat modeling, code scanning and penetration testing. Its current product information lists Continuum penetration testing as an available capability, while code scanning and threat modeling remain in preview.
AWS says its penetration-testing capability can identify and validate vulnerabilities through multi-step attack scenarios and produce reproducible evidence and remediation guidance.
The company previously made on-demand penetration testing generally available in March 2026, with support for applications across AWS, other cloud environments and on-premises infrastructure.
The broader takeaway from the workshop is that the next phase of AI-assisted software development may involve agents on both sides of the process: agents helping developers build applications and agents continuously examining what they build for security weaknesses.
However, AWS’s presentation kept one boundary clear: even as these systems become more autonomous, developers and security teams remain responsible for directing, reviewing, and governing their work.
