AWS Security Agent does not replace manual penetration testing for regulated organisations — AWS says so itself. The agent runs autonomous testing 24/7 at $50 per task-hour, and AWS cites customer reports of 70–90% savings against manual testing. But organisations with strict compliance requirements still need manual tests conducted by certified professionals to satisfy auditors.
That is not a limitation to work around. It is the line that determines which control you actually need, and most teams above a certain size need both. This guide covers what the agent genuinely does well, where it stops, and how to combine the two without paying twice for the same coverage.
What AWS Security Agent Actually Is
AWS Security Agent went generally available on 31 March 2026, having been previewed at re:Invent 2025. AWS describes it as a "frontier agent" — an autonomous system that works independently for hours or days rather than responding to individual prompts.
The verified specifics:
| Attribute | Detail |
|---|---|
| Pricing | $50 per task-hour; a typical 24-hour evaluation costs up to $1,200 |
| Trial | Two-month free trial for new customers |
| Regions | Six — N. Virginia, Oregon, Ireland, Frankfurt, Sydney, Tokyo |
| Coverage | Multicloud: AWS, Azure, GCP, other providers and on-premises |
| Capabilities | Design security reviews, code security reviews, on-demand penetration testing |
| Output | CVSS scores, application-specific severity, reproduction steps, remediation suggestions |
| Integration | GitHub connection for context, PR-based code review, automated remediation pull requests |
Note the region list. There is no India region. For Indian organisations with data residency requirements, that is a real constraint worth resolving before you build a process around the agent.
Where the Agent Genuinely Wins
The economics are not marketing. Manual testing is priced per engagement and scheduled weeks in advance; the agent is priced per task-hour and available on demand. That changes what is possible:
- Frequency. Testing moves from an annual event to something you can run per release, or continuously.
- Scale. An agent can run concurrent tasks across an entire application portfolio. A human tester cannot.
- Application context. Connecting a GitHub repository lets the agent understand the application rather than probing it blind, which is a meaningful advantage over traditional DAST scanners.
- Remediation velocity. Automated pull requests to fix findings close the loop faster than a PDF handed to an engineering team.
If your current position is annual testing and nothing in between, the agent fills an eleven-month gap that was previously filled by hope.
Where It Stops
Auditor acceptance is the big one. AWS itself acknowledges that regulated organisations may still need manual tests by certified professionals. If your SOC 2 control description says "annual penetration testing by a qualified third party", an autonomous agent run by your own team does not obviously satisfy either "third party" or "qualified" as an auditor reads them. Check your control wording before assuming the agent substitutes.
Business logic remains hard. Autonomous testing is a nascent category. Chained privilege escalation across services, flaws in a pricing or approval workflow, and abuse cases that depend on understanding what your business actually does are still where human testers earn their fee.
New attack surface. AWS notes that custom Model Context Protocol server connections can introduce prompt injection risks, and that authorised users with access to data sources the agent consumes could embed malicious instructions. Any agent with credentials and VPC access is itself part of your threat model.
Independence. A test you run against yourself is not an independent assessment. For customer security reviews and audits, that distinction matters regardless of the tooling's quality.
Cost Compared Honestly
At $50 per task-hour, a 24-hour evaluation is roughly $1,200 — about ₹1,00,000. A comparable manual web application pentest in India runs ₹1,50,000 to ₹3,50,000, and a compliance-grade engagement more. On a per-test basis the agent is clearly cheaper.
But the comparison is misleading if you stop there, because you are not buying the same thing. The honest framing:
- Running the agent monthly across a portfolio costs meaningfully more per year than one annual manual test, while covering far more ground.
- Running one manual test annually satisfies a compliance control the agent may not, while leaving eleven months uncovered.
- Running both costs more than either and is what most regulated organisations above a certain size actually need.
Our guide to VAPT cost in India sets out the manual side of that equation in detail.
How to Combine Them
The pattern that works:
- Agent for continuous coverage. Run it against every significant release, and on a schedule between releases. Treat findings as engineering work, not audit evidence.
- Manual testing for the audit cycle. One certified engagement per year — or per framework requirement — scoped against your control wording, with a retest producing the evidence package.
- Feed agent findings into the manual scope. If the agent keeps flagging a class of issue, tell the human testers. They can spend their time on what the agent cannot reach rather than rediscovering what it already found.
- Put the fixes in the pipeline. Recurring findings are a DevSecOps problem, not a testing problem. Both controls get cheaper when the pipeline stops shipping the same issue.
Getting the Agent Set Up Properly
The agent will not produce useful results without configuration. Setup involves creating an agent space per application, verifying target domains via DNS or HTTP, configuring VPC access if you are testing private applications, wiring CloudWatch logging, storing test credentials in Secrets Manager or a Lambda function, and connecting GitHub for application context.
The credential and VPC configuration is where most teams stall, and it is also where getting it wrong has consequences — you are granting an autonomous system authenticated access to your environment. As an AWS security partner we implement and operate this alongside the rest of the account, which is generally safer than bolting it on separately.
The Practical Answer
If you are not regulated and currently test annually or never, the agent is a straightforward upgrade — cheaper, more frequent, and better than the scanner you are probably running instead.
If you are pursuing SOC 2, ISO 27001 or PCI-DSS, treat the agent as a continuous control that improves your posture between audits, and keep certified manual testing for the evidence your auditor will accept. Read your control wording before deciding — it, not the tooling, determines what you can substitute.
If you want AWS Security Agent implemented and tuned for your environment, or manual testing scoped against a compliance deadline, explore our VAPT services or talk to our team. We will tell you honestly which of the two you actually need — and when the answer is only one of them.
Related reading: what a VAPT audit covers and the OWASP Top 10:2025, where access control and insecure design remain the categories automation struggles with most.
