AWS DevOps Agent and Security Agent: Autonomous Operations at Scale
AIDevOpsSecurityawsdevops-agentsecurity-agentautonomousincident-responsepen-testing
Loading…
On 31 March 2026, AWS announced general availability for two agents that represent a concrete bet on autonomous infrastructure operations. The DevOps Agent is an always-on site reliability engineer that correlates telemetry across observability platforms, CI/CD pipelines, and ticketing systems to diagnose and resolve incidents. The Security Agent is an autonomous penetration tester that ingests source code and architecture documentation to find vulnerabilities at a fraction of the cost of manual assessments. Both emerged from a five-month preview that started at re:Invent 2025.
The DevOps Agent is not a chatbot that answers questions about your infrastructure. It is an autonomous operator that maintains a live model of your application topology and acts on incidents without human prompting.
The agent connects to the tools teams already use:
The agent automatically builds an application topology map by correlating deployment events, service meshes, and observability data. When an incident occurs, it traces the blast radius across services, identifies the root cause, and executes remediation actions. Customers report 75% lower mean time to recovery, 80% faster investigations, and 94% root cause accuracy.
The DevOps Agent bills at approximately 300 per month. AWS offers support credits: 100% for Unified Ops support tier, 75% for Enterprise, and 30% for Business+.
The Security Agent takes a different approach. Rather than monitoring for anomalies, it performs autonomous penetration testing by reading your source code, architecture documentation, and infrastructure configuration, then probing for vulnerabilities.
The agent ingests the full application context: source code repositories, API specifications, infrastructure-as-code templates, and architecture diagrams. It then tests against the OWASP Top 10 and, critically, against business logic flaws that automated scanners typically miss.
Pricing is structured around task-hours at 1,200. For comparison, a manual penetration test of equivalent scope typically runs between 50,000.
The agent supports cross-account VPC configurations, making it suitable for organisations with complex multi-account AWS environments. It integrates into CI/CD pipelines for continuous security validation, and multicloud support extends coverage to Azure and on-premises infrastructure.
Both agents support AWS, Azure, and on-premises environments, available across six regions: us-east-1, us-west-2, eu-west-1, eu-central-1, ap-southeast-2, and ap-northeast-1. The multicloud positioning is deliberate. AWS recognises that most enterprises operate hybrid environments and has designed the agents to correlate data across provider boundaries rather than locking teams into a single platform.
Microsoft's Azure SRE Agent reached general availability on 10 March 2026, with 1,300 internal agents having mitigated 35,000 incidents. Google has not yet announced a direct competitor. The field of autonomous operations is still forming, and the AWS announcement establishes a clear pricing benchmark: 50 per task-hour for security.
United Airlines, T-Mobile, and WGU are among the public reference customers. SmugMug, LG CNS, HENNGE, and Wayspring round out the announced cohort. AWS is offering a two-month free trial for new customers.
The practical question for engineering teams is whether autonomous agents reduce enough toil to justify the cost, and whether the accuracy rates hold under the adversarial conditions of production. The five-month preview data is encouraging. The next six months of production deployments will determine whether autonomous operations agents become standard infrastructure, or remain a premium add-on for large enterprises.