AWS Security Agent adds threat modeling, Kiro power and Claude…

AWS Security Agent now ships STRIDE-based threat modeling, full repository and pull-request code scanning with remediation across major Git platforms, and IDE-side access through Kiro power, a Claude Code plugin, and MCP. The AWS News Blog positions the release as a way for developers to run security reviews and apply fixes without leaving their normal tools.

On the product side, threat modeling follows the STRIDE categories so findings map to spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege rather than free-form notes. Scanning covers both whole repos and individual PRs, with remediation guidance attached to the results. The same agent surface is reachable from the IDE via Kiro power, the Claude Code plugin, and MCP, so reviews and fixes stay in the editor instead of a separate console hop.

What happened

Read AWS News Blog's account next to the product docs, not instead of them. Names and figures in the lede are the ones we can stand behind; everything else below is how teams usually absorb a story like this. If a number, ship date, or quote is not in the source excerpt, it is not in this briefing. That is deliberate — day-one coverage is where invented specifics do the most damage.

AWS Security Agent now ships STRIDE-based threat modeling, full repository and pull-request code scanning with remediation across major Git platforms, and… The AWS News Blog positions the release as a way for developers to run security reviews and apply fixes without leaving their normal tools.

How it works

Under the hood this is a systems change, not a press-release adjective. Ask what surface area moved — API, policy, hardware, model behavior, or go-to-market — and which of those you actually ship against. A useful working question: if you had to draw the before/after on a whiteboard, which box would you erase? That is the mechanism. Everything else is packaging.

On the product side, threat modeling follows the STRIDE categories so findings map to spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege rather than free-form notes. Scanning covers both whole repos and individual PRs, with remediation guidance attached to the results.

Why it matters

If you build on or compete with the parties named in AWS Security Agent adds threat modeling, Kiro power and Claude…, the practical hit is on roadmap sequencing and risk reviews this quarter, not on a vague 'future of the industry'. Put one owner on the story, give them a day to read the primary material, and decide whether this is a this-sprint item, a this-quarter item, or noise.

The same agent surface is reachable from the IDE via Kiro power, the Claude Code plugin, and MCP, so reviews and fixes stay in the editor instead of a separate console hop. For engineers and builders, the useful change is workflow, not another dashboard.

Who is affected

Incumbents, customers, and adjacent open-source projects do not feel this equally. Map the change to your own stack: what you operate, what you buy, and what you will have to explain to a security, legal, or finance review. Partners and resellers often feel it before the end user does — check those contracts before you assume nothing moved.

Threat modeling and PR scanning land where code is written and reviewed; MCP and the plugin path mean existing agent-style coding setups can call security checks as part of the same session. That cuts context switching between design review, static findings, and the patch itself.

What to watch next

Treat the next two weeks as a verification window. Watch the vendor's own changelog, any regulator or standards follow-up, and whether a competitor ships a matching capability. Do not change production on day-one coverage alone. If nothing new is published in that window, the story was smaller than the headline.

In market terms, this puts AWS Security Agent closer to the IDE-and-agent stack many teams already use—Claude Code, MCP-based tools, and in-editor assistants—while tying those surfaces to AWS’s own security product. Competing offerings often split threat modeling, repo scanning, and IDE plugins across products; here the pitch is one agent covering modeling, scan, and fix across major Git hosts.