Skyhawk Security integrates AWS Continuum to rank exploitable cloud flaws

UPDATED 09:00 EDT / JULY 28 2026 SECURITY Skyhawk Security integrates AWS Continuum to rank exploitable cloud flaws by Duncan Riley Cloud detection and response company Skyhawk Security (CNP) Ltd. today said its AI Red Team now ingests vulnerability findings from AWS Continuum and ranks them by whether an attacker could weaponize them as part of a broader cloud breach. The integration lands ahead of Black Hat USA 2026 in Las Vegas. Amazon Web Services Inc. launched Continuum in June as a machine-speed answer to vulnerability backlogs. The service is model-agnostic, running on whichever frontier model performs best at a given step, and it moves findings through discovery, prioritization, validation and remediation. AWS Security Agent, the code review, threat modeling and penetration testing tool AWS built for agentic development, is now part of it. Skyhawk treats those application-layer findings as starting points for simulated attacks. Its AI Red Team runs continuously against a digital twin of a customer’s live cloud environment, so the simulations do not disrupt production systems. From a flagged vulnerability, the software works through cloud configurations, identities and permissions, network paths and the controls already deployed, hunting for a viable route to sensitive data or other critical assets. The output is evidence of which flaws sit on a path an attacker could actually walk. Chief Executive Chen Burshan said the volume of findings has become the core problem. “Frontier models are finding more vulnerabilities than any team can remediate, while the time to exploit is collapsing,” Burshan said. “Enterprises need to move beyond trying to fix everything faster and prioritize remediation based on true risk. Weaponization is the new priority signal.” Skyhawk has a recent demonstration to point at. In June, the company disclosed that its AI Red Team seized full control of a financial services company’s production AWS organization in seconds after starting from a low-privilege position. The environment had no misconfigurations and no excessive permissions, a leading cloud-native application protection platform was deployed and every dashboard indicator was green. The takeover worked by chaining legitimate, correctly configured identity and access management permissions together. Static attack graph analysis had shown no viable route to takeover at all. Attackers are pushing harder at cloud generally. CrowdStrike Holdings Inc.’s 2026 Global Threat Report found cloud-conscious intrusions rose 37%, with a 266% jump in cloud targeting by state-linked actors. The Continuum work builds on an existing relationship with AWS. Skyhawk already reasons over telemetry from Amazon GuardDuty, Amazon Inspector and Amazon Macie, which gives it more context than the findings surfaced through AWS Security Hub alone. Skyhawk was spun out of Israeli cybersecurity and application delivery vendor Radware Ltd.’s cloud native protection business in 2022. Photo: Skyhawk Security A message from John Furrier, co-founder of SiliconANGLE: Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities. 15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more 11.4k+ theCUBE alumni — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network. Are you AWS customer?  Support SiliconANGLE Financially by buying your AWS services from our Marketplace portal page and links.   https://siliconangle.com/aws-marketplace/ About