security
May 1, 2026
By Teun
AWS pushes security baselines as AI adoption speeds up
AWS says organizations need stronger security basics as AI accelerates vulnerability discovery and changes how systems are built and defended. The company is promoting its free Security Health Improvement Program, or SHIP, to help customers assess gaps and build a prioritized improvement plan.
AWS is urging customers to tighten their security fundamentals as AI changes both cyber defense and the pace of vulnerability discovery. In a security blog post, the company said organizations need to be able to react quickly to new threats, which is harder if basic controls are not in place.
The post comes weeks after Anthropic announced the Claude Mythos Preview model and launched Project Glasswing with AWS and other organizations. AWS CISO Amy Herzog said in that announcement that the company builds defenses before threats emerge and treats security as continuous, not a separate phase.
⚡ New to this?
This matters because AI is speeding up both software development and security testing, which means weaknesses can surface faster than before. A security baseline is the basic set of protections an organization has in place, such as access control, logging, and encryption.
SHIP stands for Security Health Improvement Program. In plain terms, it is a structured review that helps AWS customers find gaps in their cloud security and make a prioritized fix list.
🦞 OpenClaw angle
If you run self-hosted AI agents, treat this as a reminder to harden the platform before you expand the workflow. Check that the agent runtime has least-privilege credentials, logging turned on, and encrypted storage for prompts, secrets, and outputs.
Build a recurring security review into your automation pipeline, not a one-time setup. For example, run config and access checks before deploying a new agent, and keep a prioritized backlog for patching, secrets rotation, and permission cleanup as your AI stack changes.
AWS said the same principle applies as AI tools spread through business and infrastructure. The company argued that security hygiene gaps are common because basic controls such as identity management, threat detection, vulnerability management, data protection, and network security can be inconsistently applied across cloud environments.
The list of fundamentals AWS says every organization should maintain includes consistent patching, least-privilege access, logging and monitoring, encryption at rest and in transit, and regular reviews of security configurations. AWS said those basics matter whether or not a company is using AI.
To help customers identify gaps, AWS pointed to its Well-Architected Framework and a free program called the Security Health Improvement Program, or SHIP. According to AWS, SHIP is available at no cost to every AWS customer, regardless of support tier.
AWS said SHIP uses data from a customer’s AWS environment to assess current security posture, identify opportunities for improvement across 10 core security use cases, build a prioritized action plan, and support continuous improvement. Those use cases include threat detection, cloud security posture management, application security testing, configuration management, access governance, vulnerability management, application protection, network security, encryption, and secrets management.
The program is led by AWS Solutions Architects and Technical Account Managers, who walk customers through a personalized report, explain the findings in context, and help build the roadmap. AWS said the goal is to give organizations a security baseline that can support AI workloads, including models deployed on Amazon Bedrock and agentic workflows built with Amazon Bedrock AgentCore.
AWS also said the point is not just to respond to current issues but to be ready for faster change. The company said AI-driven vulnerability discovery tools are becoming more widely available, which means organizations with stronger baselines will be able to act on new findings more quickly.
Customers can get started by contacting their AWS account team, requesting a SHIP engagement, attending a SHIP Activation Day workshop, or using the AWS Well-Architected Framework - Security Lens for documentation and implementation guidance. AWS said the broader aim is to help customers strengthen security foundations so they can adopt AI tools with more confidence.
