# AWS Security Agent can now hard-cap autonomous pentest spend and revalidate individual fixes

AWS Security Agent now lets teams cap an autonomous penetration test at a maximum number of billable task-hours and retest individual findings after remediation, adding deterministic cost control and a cheaper verification loop to its $50-per-task-hour pentesting model.

AWS’s agentic pentesting service can run multiple security tasks in parallel, so billable task-hours may exceed wall-clock test duration. New per-run task-hour limits stop a test gracefully at the ceiling and preserve findings, while targeted revalidation checks specific fixes without rerunning the entire pentest.

- Status: Active
- Published: 2026-08-27T08:57:10+12:00
- Updated: 2026-08-27T08:57:10+12:00
- Categories: Artificial Intelligence, Web Development, Cloud & Infrastructure, AI Agents, Cloud Platforms, Developer Tools
- Tags: AI agents, AWS, penetration testing, security testing, usage pricing
- Canonical HTML: https://beyondthe.news/dossiers/aws-security-agent-task-hour-budget-revalidation-autonomous-pentesting

## What changed

On August 19, 2026, AWS added two operational controls to AWS Security Agent, now part of AWS Continuum. Penetration tests can be created with a maximum billable task-hours limit using a preset, custom value or no limit; when cumulative agent work reaches the ceiling, the test stops gracefully and preserves findings discovered so far. Teams can also select findings from a completed test and revalidate only those issues against the live application after deploying a fix, receiving an Active or Resolved result with revalidation history tied to the original finding. AWS prices autonomous penetration testing at $50 per task-hour, metered per second, and task-hours represent cumulative parallel agent work rather than elapsed test duration.

## Why it matters

Autonomous security testing creates a particularly awkward usage-pricing risk because the agent decides how much exploration is needed and can execute several tasks concurrently. A four-hour pentest can therefore consume far more than four billable task-hours. The new ceiling turns that uncertain exploration budget into an enforceable run-level boundary instead of relying only on monitoring or manually stopping the job. Finding-level revalidation changes the post-fix workflow as well: teams can verify a remediation without paying for and waiting on another full application test. The trade-off is coverage—setting a ceiling too low can stop a test before the agent finishes exploring the intended attack surface.

## Task-hours measure agent work, not how long you wait

AWS bills penetration testing by cumulative task-hours. If the agent performs multiple tasks in parallel, those task-hours add together, so billable usage can exceed wall-clock duration. AWS’s own pricing example shows a four-hour test consuming 24 task-hours, which would cost $1,200 at the current $50 rate. This makes an execution ceiling materially different from an ordinary elapsed-time timeout.

## The new maximum is a hard run-level cost boundary

A penetration test can now specify `maxTaskHours`. AWS supports preset or custom limits, and when cumulative usage reaches the configured maximum the job is gracefully stopped. Findings already discovered remain available. A higher ceiling does not itself cost more unless the agent actually consumes the extra task-hours, so teams can choose a risk budget that reflects the application and test scope rather than purchasing capacity upfront.

## Revalidation avoids repeating the whole test after a fix

Completed findings can now be selected for a targeted revalidation run. AWS Security Agent retests the specific vulnerability against the live application and records whether it remains Active or is Resolved, with the revalidation history linked back to the original issue. AWS says the first three revalidations per finding are currently free; additional revalidation work is charged by task-hour.

## Budgeting and scope still need to work together

A task-hour ceiling protects spend, but it does not tell the agent which parts of an application matter most. AWS recommends narrowing URL scope and selecting only the relevant risk types to reduce work. Teams should treat the budget as a last-line guardrail and use representative previous runs to choose a realistic limit; there is no precise pre-run cost estimator because the agent adapts its testing plan as it explores the application.

## A stopped run is a partial security assessment

Gracefully stopping at a cost limit preserves useful findings, but it does not mean the intended test coverage was completed. Security teams should record whether a run stopped because testing finished or because the budget was exhausted, and avoid presenting a capped partial run as equivalent to a completed penetration test. Where coverage is mandatory, the response to an exhausted budget may be to narrow scope, raise the ceiling deliberately or complete the work with another testing path.

## Key details

- AWS announced penetration-test budget controls and finding revalidation on August 19, 2026.
- AWS Security Agent penetration testing costs $50 per task-hour and is metered per second.
- Task-hours measure cumulative active agent work across parallel tasks and can exceed wall-clock test duration.
- A penetration test can set a maximum task-hours value; reaching it gracefully stops the run and preserves findings found so far.
- The API exposes the ceiling as `maxTaskHours`.
- Completed findings can be selectively revalidated against the live application rather than requiring another full penetration test.
- Revalidation records Active or Resolved status and keeps history linked to the original finding.
- AWS currently says the first three revalidations per finding are free; further revalidation is billed by task-hour.

## Builder takeaways

- Set a task-hour ceiling on every unattended penetration test unless there is a deliberate reason to leave spend unbounded; parallel tasks make wall-clock duration a poor cost proxy.
- Use previous runs of the same test configuration as the best available baseline for choosing a cap, then add explicit headroom rather than guessing from elapsed time.
- Narrow target paths and risk types before increasing the budget. A larger cap should not replace sensible test scoping.
- After fixing a vulnerability, use finding-level revalidation before paying for another full test when the goal is simply to confirm that specific remediation.
- Make budget exhaustion visible in security reports so a partially completed capped run is not mistaken for full coverage.
- Track cost per useful finding and revalidation outcome over time; an autonomous pentest is only economical if additional task-hours produce enough security value.

## What to watch

- Whether AWS adds pre-run task-hour estimates or recommended budgets based on application scope and historical tests.
- Whether the $50 per task-hour rate, free revalidation allowance or free-trial structure changes as AWS Continuum matures.
- More granular budget controls by risk type, task, URL area or organization rather than only a job-wide maximum.
- Independent evidence on finding quality, false positives and coverage achieved at different task-hour ceilings.
- Whether AWS exposes policies that automatically escalate, pause for approval or narrow scope when a test approaches its budget.

## Uncertainties

- There is no precise pre-run cost estimate because task-hours depend on the application, selected risks and the agent’s adaptive exploration.
- A capped run may terminate before full intended coverage, so the cost ceiling trades financial certainty against possible testing depth.
- AWS’s pricing and product documentation establish the billing model and controls, but independent evidence on autonomous pentest quality and the value of additional task-hours remains limited.
- The first-three-revalidations-free policy is current pricing and may change.

## Sources

- [AWS Security Agent now supports budget controls and finding revalidation](https://aws.amazon.com/about-aws/whats-new/2026/08/aws-security-agent/) — AWS · primary announcement · 2026-08-19T00:00:00+12:00. Primary launch source for maximum task-hours limits, graceful stopping and finding-level revalidation.
- [AWS Security Agent Penetration Testing Pricing](https://aws.amazon.com/security-agent/pricing/) — AWS · primary pricing documentation. Current $50/task-hour price, cumulative parallel-work definition, free revalidation allowance and worked examples.
- [Pricing and billing — AWS Security Agent](https://docs.aws.amazon.com/securityagent/latest/userguide/pricing.html) — AWS Documentation · primary technical documentation. Explains task-hours versus elapsed duration, cost-control guidance and the absence of precise pre-run estimation.
- [PentestJob — AWS Security Agent API](https://docs.aws.amazon.com/securityagent/latest/APIReference/API_PentestJob.html) — AWS Documentation · primary API documentation. Confirms `maxTaskHours`, graceful-stop semantics and REVALIDATION job fields.