AWS Partner Network (APN) Blog

Announcing 2026 AWS Partner Award Nominations

Andrew Somera — Fri, 10 Jul 2026 13:26:03 +0000

By Andrew Somera, Head of Partner Experiences – AWS

The 2026 AWS Partner Awards honor partners who have demonstrated outstanding results and innovation with the use of Amazon Web Services (AWS) products and solutions. These awards are an acknowledgment of exceptional partner success and innovations.

AWS Partner Awards recognizes a wide range of born-in-the-cloud and traditional services, software, and hardware partners whose business models have embraced specialization and collaboration.

Nomination-Based Award Categories

For the fifth year in a row, AWS Partners can self-nominate themselves to be considered across a select number of AWS Partner Award categories, related to partner focus areas, technologies, and the significant impact partners are making in delighting our customers.

Award submissions will be reviewed by a third-party, Canalys, and selected with special emphasis placed on customer success use cases presented in the nomination form. All winners will be informed by October 31, 2026, and will be recognized and celebrated at this year’s AWS re:Invent.

All nominations must be submitted by 11:59 PM PDT on August 14, 2026.

Nomination Categories and Forms

AWS Partners can apply to more than one award, but they may not submit multiple nominations per any given category. A list of the five categories accepting nominations with specific eligibility requirements and details is featured below. A separate application is required for each category.

We’ve also created PowerPoint versions of the nomination form to help prepare your submission. AWS Partners are encouraged to review and prepare this form alongside their Partner Development Manager (PDM) and/or Partner Marketing Manager (PMM).

Note that access to the PowerPoint version of the nomination forms requires an AWS Partner Central login.

Category Descriptions and Judging Criteria

Innovation Partner of the Year

Requirement to applying: Open to partners enrolled in the Services Partner Path.

Recognizes organizations that deliver innovative consulting, professional, managed, and value-added resale services. Recipients will have demonstrated proof in delivering outstanding customer experience via an integrated lifecycle of services, from initial assessments, architecting, developing, and deployment of cloud environments to ongoing migration and management of cloud infrastructure and applications.

Design Partner of the Year

Requirement to applying: Open to partners enrolled in the Hardware or Software Partner Path.

Recognizes organizations that develop software or hardware devices that runs on or is integrated with AWS. Recipients will have achieved a design win in either a software and/or hardware product built on or with AWS. Selected based on impact software/hardware has had on the regional market (e.g., applicability, size of audience, public status).

Social Impact Partner of the Year

Requirement to applying: Partner-nominated category covering all partner types.

Recognizes AWS Partners committed to giving back to society through their people, resources, and technology, and that are leading initiatives to change our world for the better.

Sustainability Partner of the Year

Requirement to applying: Partner nominated category covering all partner types.

Recognizes AWS Partners committed to achieving sustainability goals. Solutions may cover, but are not limited to, capabilities in Agentic AI, machine learning (ML), Internet of Things (IoT), data analytics, and computing to reach your organization’s or customer’s sustainability goals.

Collaboration Partner of the Year

Requirement to applying: Partner nominated category covering all partner types. Nomination will be submitted and distributed to the partner leading the collaborative efforts.

Recognizes situations where a partner has collaborated with one (1) or more AWS Partners in helping address customer problems. Awarded to a partner organization that collaborates with other AWS Partners to work on solving the same customer challenge with their skills and ability to deliver valuable customer solutions based on services and technology offered across multiple AWS Partners.

Don’t Miss Out!

We encourage all partners to participate in submitting a nomination to be considered for an AWS Partner Award.

View our 2025 AWS Partner Award winners, and watch the video below to see highlights from last year’s Awards Gala and Appreciation Event at re:Invent.

Video: 2025 AWS Partners of the Year Gala and Appreciation Event

Say Hello to 184 New AWS Competency, Service Delivery, and MSP Partners Added in June

Nick Paris — Mon, 06 Jul 2026 17:09:06 +0000

By Nick Paris, APN Marketing Manager – AWS Partner Network

The AWS Partner Network (APN) is a global community that leverages Amazon Web Services (AWS) technologies, programs, expertise, and tools to build solutions and provide services for customers.

The APN has more than 130,000 partners from over 200 countries, with 70% headquartered outside of the United States. Together, partners and AWS provide innovative solutions, solve technical challenges, win deals, and deliver greater customer value.

To achieve APN specializations such as AWS Competency, AWS Service Delivery, AWS Service Ready, and AWS Managed Service Provider (MSP), organizations must undergo rigorous technical validation and assessment of their AWS solutions and practices.

NEW! AWS Competency Partners

To succeed with cloud adoption in today’s complex IT environment and continue to advance in the future, customers can team up with an AWS Competency Partner.

The AWS Competency Program validates and promotes AWS Partners with demonstrated technical expertise and proven customer success in specialized areas across industries, use cases, and workloads. Guidance from these skilled professionals can lead to better business and bigger results.

Team up with our newest AWS Competency Partners:

AWS Advertising and Marketing Technology Competency

ZiMetrics | APAC | Ad Intelligence & Measurement

AWS AI Competency

北京聚云立方科技有限公司 (Marshotspot) | China | Agentic AI Consulting Services
Aeonx Digital | EMEA | Agentic AI Consulting Services
Aivar Innovations | APAC | Agentic AI Consulting Services
Beijing Ultrapower Software | China | Agentic AI Consulting Services
Cambrian Technologies | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Cecure Intelligence | EMEA | Generative AI Consulting Services
Cloud TechOn | APAC | Generative AI Consulting Services
cloudvests | NAMER | Generative AI Consulting Services
cloudvests | NAMER | Agentic AI Consulting Services
Cumulus HQ | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
DataEconomy Inc. | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
dataRain Consulting | LATAM | Agentic AI Consulting Services
Dedalus | LATAM | Agentic AI Consulting Services
develeap | EMEA | Agentic AI Consulting Services
DFX5 | NAMER | Agentic AI Consulting Services
Directeam | EMEA | Agentic AI Consulting Services
DIRMOD | NAMER | Agentic AI Consulting Services
Doosan Corporation Digital Innovation | APAC | Generative AI Consulting Services
Fuama Technologies | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
G-Asiapacific | APAC | Generative AI Consulting Services
GFT Technologies SE | NAMER | Agentic AI Consulting Services
Going Cloud | APAC | Agentic AI Consulting Services
Hanjin Information Systems & Telecommunication | APAC | Generative AI Consulting Services
Inferdat | | Agentic AI Consulting Services; Generative AI Consulting Services
INIT | APAC | Agentic AI Consulting Services
Intelligence Cloud Sphere (Intel-CS) | EMEA | Generative AI Consulting Services
Intuitive.ai | NAMER | Generative AI Consulting Services
JetSweep | NAMER | Generative AI Consulting Services
KnackForge | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Logicalis Latin America | NAMER | Generative AI Consulting Services
Mindware | EMEA | Generative AI Consulting Services
NIX | NAMER | Generative AI Consulting Services
Nous Infosystems | NAMER | Agentic AI Consulting Services
Nova | NAMER | Agentic AI Consulting Services
Nuage It´s Everywhere | LATAM | Generative AI Consulting Services
Nuage It´s Everywhere | LATAM | Agentic AI Consulting Services
OMNYS | EMEA | Agentic AI Consulting Services
Openstack Business Consulting | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Rackspace Technology | NAMER | Agentic AI Consulting Services
Registfy | EMEA | Generative AI Consulting Services
SEC AND DEVOPS AI | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
SK Inc. | APAC | Generative AI Consulting Services
SoftwareOne | EMEA | Agentic AI Consulting Services
Tennex | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
Version 1 | EMEA | Generative AI Consulting Services
Vertical Relevance | NAMER | Generative AI Consulting Services
VeUP Limited | NAMER | Agentic AI Consulting Services
脉络洞察 | China | Generative AI Applications
侠客行传媒（智耘贰零） | China | Generative AI Applications
福州领克狐科技有限公司 | China | Agentic AI Applications
杭州分叉智能科技有限公司 | China | Generative AI Applications
成都潜在人工智能科技有限公司 | China | Generative AI Applications
4MindsAI | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications; Infrastructure and Data
BMC SOFTWARE | NAMER | Agentic AI Applications
CloudHound | APAC | Generative AI Applications
DevRev | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications; Infrastructure and Data
Kaltura | NAMER | Generative AI Applications
LaunchDarkly | NAMER | Agentic AI Tools
Mechanized AI | NAMER | Generative AI Applications
Mechanized AI | NAMER | Agentic AI Applications
Postman | NAMER | Agentic AI Tools
Rescale | NAMER | Agentic AI Applications
Safe Securities Inc. | NAMER | Agentic AI Applications; Generative AI Applications
Sembix | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications
SensorsData | China | Generative AI Applications
SHAREit-PayerMax | China | Generative AI Applications
SmartBear Software | NAMER | Agentic AI Applications
Solodev | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications; Infrastructure and Data
SUPER 8 Studio | Japan | Agentic AI Applications
TextQL | NAMER | Agentic AI Applications
Thinking Data Information Technology (Shanghai) | NAMER | Generative AI Applications
Wiv | NAMER | Agentic AI Applications
Zixun Info Tech | China | Agentic AI Applications

Amazon Connect Customer Services Competency

Accenture | NAMER | Contact Center Transformation
Caylent | NAMER | Contact Center Transformation
Deloitte | EMEA | Contact Center Transformation
Genpact | NAMER | Contact Center Transformation
Infosys | APAC | Contact Center Transformation
NeuraFlash | NAMER | Contact Center Transformation
NTT DATA | EMEA | Contact Center Transformation
PricewaterhouseCoopers | NAMER | Contact Center Transformation
Salesforce | NAMER | Contact Center Transformation
TTEC Digital | NAMER | Contact Center Transformation
USAN | NAMER | Contact Center Transformation
Zendesk | NAMER | Contact Center Transformation

AWS Automotive Competency

o9 Solutions | NAMER | Supply Chain

AWS Business Value Realization Competency

Boston Consulting Group | NAMER | Business Value Realization
Compass UOL | NAMER | Business Value Realization
Deloitte | EMEA | Business Value Realization
DoiT | NAMER | Business Value Realization
Persistent Systems | NAMER | Business Value Realization
Quantiphi | NAMER | Business Value Realization
Reply | EMEA | Business Value Realization
SoftwareOne | EMEA | Business Value Realization
tecRacer | EMEA | Business Value Realization

AWS Cloud Operations Competency

Arvato Systems | EMEA | Operations Management
Digitspot Solutions | EMEA | Cloud Governance
Digitspot Solutions | EMEA | Cloud Governance; Compliance & Auditing; Monitoring & Observability; Operations Management
Meyi Cloud | APAC | Operations Management
QyrosCloud | NAMER | Compliance & Auditing
ScaleCapacity | NAMER | Operations Management
SkyGRID Global Technologies | EMEA | Cloud Governance
World Wide Technology | NAMER | Cloud Financial Management; Cloud Governance; Monitoring & Observability
ClickHouse | NAMER | Monitoring & Observability
Cloudchipr | NAMER | Cloud Financial Management

Consumer Goods Competency

Orange Logic | NAMER | Marketing

AWS Data & Analytics Competency

Codex | APAC | Consulting Services
MadeinWeb | LATAM | Consulting Services
NuVista AI | NAMER | Consulting Services
OpsGuru, a Carbon60 Company | NAMER | Consulting Services
Aklivity | NAMER | Data Integration and Preparation
Hydrolix | NAMER | Data Analytics Platforms

AWS DevOps Competency

Cybage | APAC | Consulting Services
Digitspot Solutions | EMEA | Consulting Services
SoftGEM Global Technologies | EMEA | Consulting Services

AWS Digital Sovereignty Competency

Atomic Computing | EMEA | Consulting Services
N-iX | EMEA | Consulting Services
SoftServe | NAMER | Consulting Services

AWS Education Competency

Blend | NAMER | Consulting Services
CloudZone | EMEA | Consulting Services

AWS Financial Competency

Anthropic | NAMER | Banking; Capital Markets; General Financial Services; Insurance
Camunda Services | EMEA | Banking; Capital Markets; General Financial Services; Insurance; Payments
Feedzai | NAMER | Banking; General Financial Services; Payments

AWS Healthcare Competency

Process Street | NAMER | Compliance Services
Proximie | EMEA | Clinical Information Systems

AWS High Performance Computing Competency

Invisibl Cloud Solutions | NAMER | HPC Management

AWS Life Sciences Competency

UsefulBI Corporation | NAMER | Consulting Services

AWS Mainframe Modernization Competency

Fujitsu | Japan | Mainframe Workload

AWS Media & Entertainment Competency

Cloudfirst.io | NAMER | Archive; Media Supply Chain and Archive
Cloudmates | EMEA | Broadcast
Flatiron Software Corporation | NAMER | Publishing
Tape Ark | APAC | Archive
Wizeline | LATAM | Data Science and Analytics

AWS Migration and Modernization Competency

Mechanized AI | NAMER | Business Case Analysis; Discovery, Planning, and Recommendation; Infrastructure Automation
Skylift Solutions | EMEA | Data Mobility
奇墨科技（广州）有限公司 – Qimo Technology (Guangzhou) | China | Migration Services
adesso | EMEA | Migration Services; Modernization Services
Aivar Innovations | APAC | Migration Services; Modernization Services
apser | EMEA | Migration Services; Modernization Services
msg group | EMEA | Migration Services
Orion Innovation | NAMER | Migration Services
SEIDOR | LATAM | Migration Services
slashTEC | EMEA | Migration Services; Modernization Services
Tactical Edge | NAMER | Migration Services

AWS MSSP Services Competency

zeb | NAMER | Application Security; Cyber Recovery; Data Protection; Identity and Access Management; Incident Response; Infrastructure Security; Workload Security

AWS Resilience Competency

Applogika | NAMER | Resilience Design
SnapSoft | EMEA | Resilience Design
N2W Software | NAMER | Resilience Recovery

AWS Retail Competency

XalDigital | NAMER | Consulting Services

AWS SAP Competency

SHINRAI TECHNOLOGIES | EMEA | Consulting Services

AWS Security Competency

F6S Advisors | EMEA | Identity and Access Management
Netrix Global | NAMER | Identity and Access Management
Docker | NAMER | Application Security
DTEX.AI | NAMER | Data Protection
Elastic | NAMER | AI Security
Varonis | NAMER | Compliance and Privacy; Data Protection
XBOW | Autonomous Pentesting Platform | NAMER | Application Security

AWS Small and Medium Business (SMB) Competency

Fuama Technologies | EMEA | Small and Medium Business
gabia | APAC | Small and Medium Business
Lightedge | NAMER | Small and Medium Business
Teleglobal International | APAC | Small and Medium Business
Trek2Summit | EMEA | Small and Medium Business
V2G Systems | EMEA | Small and Medium Business
Verycloud | China | Small and Medium Business
WH1 Cloud | LATAM | Small and Medium Business
Arctic Wolf | NAMER | Small and Medium Business
ClickHouse | NAMER | Small and Medium Business
Cyber Security Cloud | Japan | Small and Medium Business
Grafana Labs | NAMER | Small and Medium Business

AWS Storage Competency

Maximyz Cloud | APAC | Consulting Services
Applied Cloud Computing | APAC | Archive; Backup and Restore; Business Continuity/Disaster Recovery; Primary Storage

AWS Telecom Competency

Infosys | APAC | Business Support Systems (BSS); Operation Support Systems (OSS)

NEW! AWS Managed Service Providers (MSPs)

The AWS Managed Service Provider (MSP) Program validates AWS Partners with a proven track record and experience providing end-to-end AWS solutions to customers at any stage of the cloud journey, including planning and design, building and migration, operations and support, and automation and optimization.

To achieve this level of specialization, AWS MSP Partners must complete an extensive independent audit to ensure business health and technical capabilities meet a high bar, and they must maintain this status through annual audits.

NEW! AWS Service Delivery Partners

The AWS Service Delivery Program validates AWS Partners that have deep technical knowledge, experience, and proven success in delivering specific AWS services to customers.

To achieve this specialization, AWS Partners must undergo service-specific technical validation by AWS Partner Solutions Architects, including review of architecture, customer documentation, and customer case study details to ensure they follow AWS best practices for each AWS service.

Work with our newest AWS Service Delivery Partners:

AWS Database Migration Service (DMS) Delivery Partners

Info Services | NAMER

AWS Lambda Delivery Partners

Sumitomo Electric System Solutions | Japan

More Value, Greater Profitability for AWS Partners

Our mission is to make the AWS Partner Network (APN) with AWS Marketplace your preferred route to market and empower partners to deliver differentiated value to millions of AWS customers, helping you to win more, win bigger, and win faster.

We’re aligning the AWS Partner experience—including programs, incentives, and enablement—around AWS services and the partner business models: business outcome solutions, technology solutions, managed services, services, and resell.

These enhancements provide you with more relevant and prescriptive guidance, where you need it, and in a consistent and predictable manner. Your profitability, along with helping you drive new business, is our number one goal.

In 2026, we’ll continue to ensure that AWS Marketplace and our AWS Partner programs provide demonstrated pathways to success—helping you drive greater customer value and profitability. There’s an exciting journey ahead, and we’re thrilled to be on it together!

How InterWiz reduced AI costs by 90% with Amazon Bedrock

Ore Okebukola — Thu, 02 Jul 2026 22:45:43 +0000

By: Syed Sabih ur Rehman, Pre-Sales Solutions Architect – Emumba
By: Ore Okebukola, Partner Solutions Architect – AWS

Emumba

If you’re building an AI-powered software as a service (SaaS) product, you’ve likely watched your AI infrastructure costs grow faster than your revenue. What starts at $500 per month during prototyping can reach $50,000 per month in production. In this post, you’ll learn how Emumba, an AWS Advanced Tier Services Partner, helped InterWiz cut AI costs by 90%, improve response times by 55%, and maintain 99.9% uptime with no service disruption by migrating their AI workloads to Amazon Bedrock.

When you’re locked into a single AI provider, rising costs limit growth and compress margins. You lose the ability to evaluate better-performing models. You can’t tune costs independently per workload. When competitors adopt newer models, you’re left waiting on your provider’s release schedule. The result is a difficult tradeoff: raise prices and risk losing customers or absorb costs and sacrifice profitability. Migrating to Amazon Bedrock resolved that tradeoff for InterWiz. InterWiz is an AI-powered recruitment company conducting more than 1,000 interviews monthly. Rising AI costs were blocking their path to profitable growth, and they had a tight window to address it.

The InterWiz story: From cost crisis to competitive advantage

InterWiz automates candidate screening through structured, AI-driven interviews at scale, so recruiters can focus on higher-value work. The system asks contextual follow-up questions, probes for deeper insights, and generates comprehensive candidate evaluations. InterWiz was gaining strong customer traction but faced two business constraints, a cost constraint and an architecture limitation, that limited their growth. At $0.25 per interview using GPT-4 Turbo, AI expenses consumed 40% of per-interview revenue. This made aggressive growth unprofitable. InterWiz was losing deals to competitors with lower AI costs who offered better pricing. They needed to scale to achieve venture-backed growth targets, but their infrastructure costs made scaling unsustainable. Different interview functions have different requirements. Question generation needs strong reasoning and creativity. Real-time interviews require low latency and reliable adherence to instructions. Candidate evaluation demands consistency and cost efficiency at scale. With access to only one model family, InterWiz couldn’t tune each function independently. Response latency averaging 850 milliseconds created noticeable pauses during live interviews, affecting candidate experience.

Why Emumba

InterWiz chose to work with an AWS Partner Network member rather than attempting direct implementation, a decision that proved valuable. InterWiz engaged Emumba, an AWS Advanced Tier Services Partner with the AWS Generative AI Services Competency, to lead the migration. Three factors drove this decision:

AWS Partner Network benefits – As an AWS Advanced Tier Services Partner, Emumba unlocked direct access to AWS funding programs, including proof-of-concept (POC) credits and Well-Architected reviews, plus dedicated support from AWS technical account teams and solutions architects. This reduced migration risk, kept the work aligned with AWS best practices, and lowered upfront costs.
Proven migration framework – Emumba’s systematic seven-phase methodology covered assessment, model evaluation, prompt optimization, progressive rollout, and multi-provider redundancy. Each phase included defined checkpoints and rollback controls, so InterWiz had a structured path to production with minimal disruption risk.
Amazon Bedrock expertise – Emumba’s deep experience with Amazon Bedrock helped InterWiz run a comprehensive evaluation of Claude by Anthropic in Amazon Bedrock and Meta’s LLama in Amazon Bedrock, identifying the most suitable fit for each interview function.

The migration approach

The goal was clear: reduce AI costs by at least 60%, improve response times to under 500 milliseconds, and maintain or improve interview quality while conducting thousands of live interviews without service disruption. Emumba’s seven-phase migration framework guided the transition from model assessment through full production deployment:

Collect information
Select candidate models
Prompt optimization
Model evaluation
Compare and select model
Migrate
Optimize

The following diagram illustrates this framework.

Figure 1: Emumba’s systematic seven-phase migration framework

Emumba conducted comprehensive model assessments using Amazon Bedrock, which provides access to high-performing foundation models (FMs) through a single API, with built-in capabilities for building generative AI applications with security, privacy, and responsible AI. Emumba’s team evaluated Anthropic’s Claude and Meta’s LLama models against InterWiz’s specific requirements.

Emumba designed a specialized architecture that assigned each interview function to the FM best suited for it. Anthropic’s Claude 3.5 Sonnet, a reasoning-focused FM, powered intelligent question generation. Meta’s LLama 3.3 70B, a cost-efficient FM optimized for speed, handled real-time interviews, contextual follow-ups, and candidate evaluation.

Migrating from GPT-4 Turbo introduced prompt compatibility challenges. Because Anthropic’s Claude and Meta’s LLama follow different instruction patterns, Emumba’s team rewrote and tested prompts for each model using Amazon Bedrock prompt optimization tooling, including prompt caching (which can reduce costs by up to 90% and latency by up to 85%) and Amazon Bedrock Intelligent Prompt Routing (which can reduce costs by up to 30% by automatically directing requests to the most cost-effective FM). To validate quality, Emumba’s team applied a large language model (LLM)-as-a-judge evaluation approach, using an FM to score outputs against a defined quality rubric and confirming that outputs met or exceeded baseline standards before each module moved to production.

The results

The migration followed a structured 3-month timeline. Month 1 focused on model assessment and architecture design. Month 2 prioritized progressive rollout of low-risk modules. Month 3 completed full migration with optimization. Emumba measured these outcomes over a 90-day post-migration period across production interview workflows:

90% cost reduction – AI expenses dropped from $0.25 to $0.025 per interview. As InterWiz scales from 1,000 to a projected 10,000 monthly interviews by year-end 2026, this migration will save $27,000 annually, transforming the cost-to-revenue ratio from barely sustainable to highly profitable at scale.
55% latency improvement – Response times decreased from 850 ms to 450 ms. Candidate feedback improved noticeably, with interviewees specifically mentioning the conversation felt “more natural” and “less robotic.”
99.9% uptime – The multi-provider architecture with automatic fallback maintained continuous service availability, even when primary or secondary providers experienced regional issues.

The following graphic summarizes the measurable business outcomes InterWiz achieved.

Figure 2: Business outcomes from InterWiz’s migration to Amazon Bedrock (measured over 90-day post-migration period)

“Migrating our AI stack from Azure OpenAI to Amazon Bedrock was a complex undertaking, but AWS CoE at Emumba handled it with precision and engineering depth. They built the abstraction layers, tuned our prompts, and managed rollout risks so thoroughly that we experienced no disruption, only improvement. The new setup is faster, cheaper, and far more scalable. We couldn’t have asked for a smoother transition.”

— Zishan Iqbal, CEO, InterWiz AI

The competitive impact

Beyond immediate cost savings, the migration created measurable strategic advantages. InterWiz can now profitably serve market segments previously off-limits due to pricing constraints and can invest in advanced features such as role-specific question strategies and industry-tailored evaluation criteria.As AWS adds new FMs to Amazon Bedrock, InterWiz can evaluate and integrate them within days, not months, without waiting on a provider’s roadmap. This architectural flexibility compounds as model innovation accelerates.

Three strategic takeaways for AI-powered SaaS leaders

Architectural decisions made during prototyping often become strategic liabilities at scale, and this post highlights three beneficial outcomes of the InterWiz migration:

Cost predictability at scale – The transparent pricing and multi-model flexibility of Amazon Bedrock provide a path to managing FM costs as you grow. By systematically evaluating which models deliver the most suitable cost-performance balance for specific functions, InterWiz reduced AI costs by 90% without sacrificing quality. You can apply the same approach to your own workloads.
Model choice as strategic advantage – Amazon Bedrock provides access to multiple leading FMs, including Anthropic’s Claude, Cohere Command in Amazon Bedrock, Meta’s LLama, Amazon Nova, and Amazon Titan, through a single API, so you can select the most suitable model for each job. When new FMs emerge, you can adopt them immediately.
AWS Partner Network benefits for regulated industries – For companies in regulated industries, Amazon Bedrock is in scope for System and Organization Controls 1, 2, and 3 reports and is a Health Insurance Portability and Accountability Act (HIPAA) eligible service. AWS also supports customers’ General Data Protection Regulation (GDPR) compliance efforts through data residency controls and contractual commitments.

Under the AWS Shared Responsibility Model, your organization is responsible for implementing the controls required to meet your specific compliance obligations. Working with an AWS Advanced Tier Services Partner such as Emumba provides validated expertise backed by AWS quality assurance, access to funding programs that lower financial barriers, and a path to continuous model innovation through the expanding FM catalog of Amazon Bedrock.

Looking forward

InterWiz’s journey demonstrates what is possible when an AWS Partner Network member guides a production generative AI migration: 90% cost reduction, 55% latency improvement, and a zero-downtime transition completed in 3 months. Building for multi-model flexibility from the start is one of the most consequential infrastructure decisions you can make as an AI-powered SaaS company.Companies that migrate to Amazon Bedrock are positioned to take advantage of FM innovation as it happens. Those locked into single-provider architectures carry higher switching costs as the model landscape evolves. A migration assessment is a practical first step to understanding your potential savings and risk profile.

To learn more about Emumba, refer to Emumba in AWS Partner Network. To contact Emumba, visit the Emumba AWS Partner contact page.

Emumba – AWS Partner spotlight

When you work with Emumba, you gain access to production-grade generative AI implementations, cloud migration and modernization expertise, and data strategy capabilities, backed by more than 300 certified engineers across the Bay Area, Islamabad, and Dubai. Emumba is an AWS Advanced Tier Services Partner with the AWS Generative AI Services Competency, helping companies in healthcare, travel, and software industries build AI infrastructure that scales profitably.

Contact Emumba | Partner Overview | AWS Marketplace

Reimagining legacy applications with Pega and AWS through AI-driven approach

Ujwal Bukka — Thu, 02 Jul 2026 22:20:47 +0000

By: Andre Boaventura, Principal AI Solutions Consultant, Applied AI – Pegasystems Inc.
By: Surender Kumar, Mainframe Modernization Architect – Pegasystems Inc.
By: Sourav Sarkar, Senior Worldwide Specialist Solutions Architect – AWS
By: Ujwal Bukka, Senior Partner Solutions Architect – AWS

For most large enterprises, AI-driven legacy application modernization presents a clear imperative, but acting on it without disrupting the critical business processes that depend on those systems every day remains the core challenge. For decades, legacy applications have served as the operational bedrock of global enterprises. Yet these very systems, often built on tightly coupled, monolithic architectures, can make it difficult for organizations to move with the speed and agility that today’s business demands. Organizations face mounting pressures: high maintenance costs consuming IT budgets, immense technical debt accumulated over decades, scarcity of skilled talent familiar with legacy languages such as COBOL, and the inherent risk of big bang migration projects that frequently overrun budget and timeline.

These challenges drive many organizations to seek a structured approach that delivers business value incrementally. This post shows you how the AI-Driven App Modernization Platform from Pega and Amazon Web Services (AWS) provides a structured, low-risk methodology to transform legacy systems into intelligent, automated workflows.

The AI-Driven App Modernization Platform with Pega and AWS

The AI-Driven App Modernization Platform from Pega and AWS represents a fundamentally different approach. Instead of replatforming or refactoring legacy applications to like-for-like replacements, this solution fundamentally reimagines the business processes they support.

This solution combines the AWS Global Infrastructure and artificial intelligence and machine learning (AI/ML) services with Pega’s low-code platform for AI-powered decisioning and workflow automation. Together, they transform complex legacy architectures into a portfolio of intelligent, agentic workflows that are built for the cloud, automated, and designed around the customer experience and optimized for business agility.

This is not a like-for-like replacement. It’s an opportunity to reimagine existing processes onto an agentic platform, transforming core operations into intelligent, automated workflows.

Target use cases

The platform provides tailored, AI-accelerated paths for multiple complex legacy application estates. Each path addresses a specific modernization challenge:

Mainframe systems – The platform provides a low-risk, phased approach to deterministically extract business rules, requirements, and process flows from mainframe applications with full traceability from every extracted artifact back to the original source code, transforming monolithic COBOL or PL/I systems into agile, Pega workflows built for the cloud. Common industry use cases include insurance claims processing, banking loan origination, customer onboarding, and supply chain orchestration.
Legacy BPM platforms – Organizations running legacy business process management (BPM) suites can use a direct-to-Blueprint import of Business Process Model and Notation (BPMN) diagrams, allowing rapid reimagining of existing processes into intelligent, automated Pega workflows.
Legacy Java and .NET applications – Custom-built applications on established frameworks are analyzed to identify and untangle business logic, allowing strategic migration to a modern, microservices-based architecture on the Pega platform.
Legacy document-centric workflow applications – A specialized import path (to Blueprint) enables rapid analysis and transformation of form-based applications and embedded business logic directly into the Pega platform.
Legacy ERP transformation – The platform acts as the workflow orchestration layer, building new workflows on Pega while ringfencing the legacy enterprise resource planning (ERP) tool, reducing expensive customizations without disrupting the core system of record.
Application consolidation – A common use case is consolidation. Rather than treating each legacy application as a separate one-to-one modernization project, the platform provides a unified foundation to converge functionality across multiple legacy estates. As organizations modernize from mainframe, Notes, and legacy Java, they identify and remove redundant processes, creating a single, cohesive set of agentic workflows. The result is a simplified architecture and a significantly lower total cost of ownership (TCO).

Applications with embedded business rules and process flow can be Pega candidates. The following guidelines offer a starting point.

Banking and financial services:

Loan origination, credit assessment, and fulfillment
Loan servicing and product lifecycle management
Account management, such as onboarding, changes, and offboarding

Insurance:

Policy changes, endorsements, and renewal management
Claims first notice of loss (FNOL), adjudication, and settlement orchestration
Underwriting, such as submission intake, appetite, and risk decisioning

Communications and telecom:

Order management, including validation, decomposition, and orchestration
Enterprise trouble-to-resolve and fault management
Billing dispute management and adjustments

Healthcare and health plans:

Prior authorization, including intake, clinical review, and determination
Member grievances, clinical appeals, and independent dispute resolution (IDR) management
Provider credentialing, contracting, and network management

Government:

Citizen service delivery, including case intake, tracking, and resolution
Benefits eligibility determination and administration
Grant management, including application, review, approval, and monitoring

Manufacturing:

Engineering change orchestration and approval workflows
Warranty claims processing and recovery and recall management
Supplier onboarding, performance management, and risk assessment

Composable platform architecture

The platform is built on a composable architecture combining two vertical pillars with a central engine of four horizontal processing layers. The anatomy of the core modernization engine is as follows:

Discovery, analysis and preprocessing – Uses specialized AWS services and tools such as AWS Transform and Kiro to perform deep analysis of legacy source code. A specialized Pega Blueprint Agent processes these insights through Amazon Bedrock AgentCore using agent-to-agent (A2A) and Model Context Protocol (MCP) integration capabilities to create enriched artifacts for the design layer.
AI-powered application design and generation – This layer functions as the architect. It ingests the enriched artifacts from discovery and uses generative AI to create a comprehensive application design, including case type hierarchies, workflow models, data objects, and persona-based UI layouts. The output is a high-fidelity Blueprint: a validated, editable design document that defines what the modernized application should look like and how it should behave.
Pega Platform – This layer acts as the builder. It takes the validated Blueprint design and automatically generates a functional, running application on the Pega Platform. Developers can then refine and extend the generated application using the low-code App Studio, with the full power of Pega’s decisioning and workflow automation engine underneath.
Data and integration services – Provides broad connectivity, including microservices integration built for the cloud, legacy application connectivity, data modernization paths, and unified identity and security.

The foundation of the platform relies on AWS Cloud and AI infrastructure and the Pega Cloud Platform. AWS Cloud and AI infrastructure provides global scale, scalable compute, and a rich AI/ML portfolio that includes Amazon Bedrock and Amazon SageMaker AI.

Pega Cloud Platform delivers a fully managed platform as a service (PaaS) with always-on architecture, security with SOC 2 and ISO 27001 compliance with around-the-clock SOC monitoring, integrated DevOps through Pega Deployment Manager, and proactive global support.

The following diagram illustrates the platform anatomy.

Figure 1: Anatomy of the AI-Driven App Modernization Platform

The three-phase modernization methodology: Anything to Blueprint to cloud

The platform follows an anything-to-Blueprint-to-cloud (ABC) methodology that guides organizations from legacy complexity to a modernized future on Pega Cloud. The methodology follows three phases:

Reverse engineering and discovery
AI-powered forward engineering
Deployable architecture on Pega Cloud

The next sections explain these phases.

Phase 1: Reverse engineering and discovery

Goal: Transform the mystery of undocumented legacy functionality into a structured, queryable knowledge base.

The platform ingests legacy technologies including COBOL, Programming Language One (PL/I), Java, .NET, legacy ERPs, and legacy forms and workflows. These assets are processed using the powerful analysis engines of AWS Transform, Kiro, and other specialized partner tools. For example, for legacy mainframe COBOL code, AWS Transform deterministically discovers business functions and generates verified, implementation-ready requirements. The output delivers following key capabilities:

Discovery Business Functions – Discovers business functions from the codebase to produce a catalog of logical modernization boundaries. This gives both business and technical stakeholders a shared language for scoping transformation with evidence from the code itself.

1. Code Analysis – Ingests source code, classifies artifacts, builds dependency graphs across programs, entry points, and data stores, and measures code complexity.
2. Data Analysis – Maps Db2 tables and VSAM files, traces data lineage across programs and JCL jobs, and catalogs field-level metadata in a generated data dictionary.
3. Discover Data Paths – Identifies distinct execution paths from entry point triggers through to specific outputs, traced deterministically across the codebase.
4. Discover Business Functions – Groups data paths into business functions (online, batch, or mixed), producing a catalog organized by business process and mapping dependencies to inform wave planning.

Reimagine – Produces formal functional requirements that are technology-agnostic and include testable acceptance criteria, replacing undocumented business logic in applications with a verified, traceable starting point for forward engineering with Pega Blueprint.

1. Extract Business Logic – Performs deterministic static analysis to extract business rules from actual execution logic, with each rule carrying a natural language description, acceptance criteria, and exact source line traceability.
2. Generate Requirements – Produces user stories with structured business rules in EARS (Easy Approach to Requirements Syntax) format, with full traceability from requirements to rules to source code

Phase 2: AI-powered forward engineering

Goal: Use agentic AI to accelerate application design and reimagine legacy processes.

The Pega Blueprint Agent ingests phase 1 artifacts and generates a comprehensive starter application design enriched with Pega’s industry best practices. This facilitates a collaborative AI-assisted design cycle where stakeholders can rearchitect customer journeys, introduce intelligent automation and AI decisioning, simplify data structures, and design modern user interfaces.

The modernized application automatically inherits Pega Platform capabilities including case management, predictive AI and decisioning agents, Center-out architecture, and built-in reporting and process optimization.

Phase 3: Deployable architecture on Pega Cloud

Goal: Transform the blueprint into a deployable application using an incremental deployment strategy.

The core deployment strategy is the strangler fig pattern, an incremental approach that gradually replaces legacy functionality without disrupting the business. Think of the legacy application as the host tree and the new Pega application as the vine that grows around it until the old system can be safely decommissioned. This pattern relies on two critical components:

The strangler façade – This layer acts as the single, intelligent entry point for all application traffic, dynamically routing requests between legacy and modern endpoints based on configurable policies. As each business domain is modernized, the façade is reconfigured to direct traffic to the new Pega application, with zero changes required on the client side.
The anti-corruption layer (ACL) – This layer is a sophisticated translator that protects the new Pega application from legacy complexity, allowing it to communicate with legacy applications using modern REST APIs across supported legacy technologies, including COBOL, PL/I, Java, and .NET. In a mainframe modernization scenario, for example, OpenLegacy(a 3rd party Legacy-to-API integration platform) serves as the ACL, allowing Pega to interact with COBOL systems without needing to understand COBOL data structures, Extended Binary Coded Decimal Interchange Code (EBCDIC) character sets, or mainframe protocols.

Applications are modernized in logical phases called “migration waves.” Each delivers a complete business domain and its associated data. The façade begins by routing traffic to the legacy application and is progressively reconfigured with each wave, until the legacy system is fully replaced and can be safely decommissioned. This incremental modernization is illustrated in the following graphic.

Figure 2: The strangler fig pattern – Mainframe modernization scenario

This strategy is underpinned by a powerful, automated toolchain. Validated case types, data objects, and UI designs from the Blueprint are used as direct inputs to automatically generate the core Pega application structure, minimizing manual effort. Pre-built infrastructure as code (IaC) templates deploy the entire supporting AWS architecture, including networking, security, and data services needed to connect Pega Cloud to the legacy environment. A holistic, layered security model protects the solution at every level: infrastructure-level security enforces least-privilege access through AWS Identity and Access Management (IAM) roles and policies, and application-level security is managed within Pega using role-based access control (RBAC) and single sign-on integration.

The following graphic illustrates this three-phase modernization methodology.

Figure 3: The three-phase modernization methodology

Key benefits

The three-phase modernization methodology offers several benefits:

Accelerated time to value – AI-driven discovery and design can reduce modernization timelines, cutting projects from years to months.
Reduced risk – Automated logic extraction prevents loss of critical functionality; iterative validation removes costly rework.
Lower TCO – This methodology removes expensive licensing and million instructions per second (MIPS) costs, technical debt, and frees IT resources.
Business agility – Low-code platform empowers rapid adaptation without long IT cycles.
Enhanced experience – Modern, intelligent applications drive higher satisfaction and productivity.

Getting started

To begin your modernization journey, follow these steps:

Schedule a personalized demo – Contact Pega to see the platform in action, tailored to your specific systems and business goals.
Book a discovery workshop – Engage with the Pega and AWS team for a guided assessment of your legacy application estate and a preliminary modernization roadmap.
Learn more online – For a deeper technical dive into this joint solution including architecture deep-dives and use-case guidance, refer to our joint technical whitepaper, The AI-Driven App Modernization Platform.
Engage with a certified delivery partner – The ecosystem of certified global system integrators including TCS, Infosys, and Accenture brings deep industry expertise and proven delivery capacity to accelerate your transformation.

Conclusion

The AI-Driven App Modernization Platform from Pega and AWS offers you a fundamentally new approach to legacy application transformation. By combining the AWS Cloud infrastructure and AI-powered analysis tools with Pega’s generative AI design capabilities and workflow automation, you can modernize targeted workloads incrementally, safely, and with confidence. Beyond modernization, this platform helps you reimagine your business processes on an agentic platform designed for the AI era.

Pega – AWS Partner spotlight

Pega is an AWS ISV Partner that delivers AI-powered decisioning and workflow automation to major global enterprises. With solutions spanning customer engagement, intelligent automation, and AI-driven application modernization, Pega helps organizations accelerate their digital transformation on AWS. Learn more at pega.com

Contact Pega | Partner Overview | AWS Marketplace

Designing enterprise AI agents with DevRev guardrails powered by Amazon Nova

Len Gomes — Thu, 02 Jul 2026 17:53:02 +0000

By: Len Gomes, Partner Solutions Architect – AWS
By: Ruhisar Tikoo, Technical Account Manager – AWS
By: Writom Guha Roy, Sr. Startup SA – AWS
By: Prateek Chaudhury, AI Engineer – DevRev

DevRev

Enterprises are embedding AI agents across workflows from customer support to IT service management but face the critical challenge of facilitating responsible behavior at scale. As enterprise AI agents gain autonomy and access to sensitive customer and product data, the demand for robust AI guardrails has increased significantly. With robust AI guardrails in place, organizations gain the confidence to scale AI agents across sensitive workflows knowing that personally identifiable information (PII) is filtered before it surfaces in responses, content stays on policy, business insights remain grounded in verified data, and safety controls hold firm against adversarial inputs. Responsible AI is an operational requirement for enterprises deploying AI agents powered by Amazon Nova or other foundation models (FMs) in production.

The business value is clear. Effective guardrails strengthen regulatory posture, reinforce customer trust, and reduce remediation overhead. For enterprises in regulated industries like financial services, healthcare, or telecommunications, these advantages compound quickly. Organizations that implement custom, domain-specific policies reflecting internal compliance rules gain a measurable operational edge: consistent enforcement around roadmap details, confidential integrations, and regulated industry language. Modern enterprise AI systems that enforce AI safety at the infrastructure level unlock greater agent autonomy with confidence.

DevRev guardrails: Built-in AI safety for every agent

DevRev has addressed this challenge directly by building real-time AI guardrails into its enterprise agent system, powered by Amazon Nova 2 Lite through Amazon Bedrock, a fully managed service from Amazon Web Services (AWS) for building and scaling generative AI applications with foundation models. Agents deployed on DevRev’s system come with a unified guardrail layer that evaluates user inputs before a response is generated, supporting reliable, adherent behavior across enterprise workflows right from the start. Teams can also author custom policies in natural language, making policy enforcement accessible without requiring code.

Amazon Nova is the AWS portfolio of AI offerings delivering frontier intelligence with competitive price performance. Nova is built on AI technologies originally developed for internal Amazon applications, including Alexa+, Amazon Ads, and Amazon Stores. Amazon Nova 2 Lite is a fast, cost-effective reasoning model featuring extended thinking with step-by-step reasoning (at three configurable levels: low, medium, or high), multimodal support (text, image, video, and documents as input), a one million-token context window for expanded reasoning, and built-in tools including web grounding with citations and code interpreter.

Early adopters report significant results: Siemens achieved a 300% improvement in search speed, Trellix saw a 39% accuracy boost in threat classification, and AWS Transform improved tool-calling efficiency by 60%.

Measured impact in production deployments

Production deployments of DevRev’s AI agent system demonstrate measurable impact across enterprise deployments where Computer agents handle support, operations, and knowledge management at scale, as shown in the following table.

Operational metric	Production result
Support ticket automation	85% (compared to 40% industry average)
Support cost reduction	50% (compared to 20% industry average)
Employee time saved per week	10-plus hours per employee
Guardrail evaluation latency	247 ms average (<300ms threshold)

The DevRev guardrails solution

DevRev built AI guardrails as a built-in layer within its agent system not as a bolted-on filter, but as an integral component of the execution pipeline that evaluates every user message before a response reaches the end user. This built-in protection covers the most critical enterprise AI issues:

Prompt injection is designed to alter agent behavior through crafted inputs.
Sensitive content is evaluated, filtering PII before it surfaces in agent responses.
Toxic and off-policy responses are blocked, filtering harmful or nonadherent content before delivery.
Custom domain policies restrict topics such as internal roadmaps, confidential integrations, or regulated terminology.

Administrators configure custom policies using plain natural language rules like “Avoid discussing internal roadmap details” or “Do not reference competitor products” without writing code. After these policies are attached to an agent, they enforce consistent, auditable boundaries regardless of where the agent is accessed across the organization.

How it works: The parallel evaluation architecture

The key design principle behind DevRev’s guardrail system is concurrency. Rather than inserting a sequential safety check that adds latency to every interaction, DevRev runs guardrail evaluation in parallel with the primary agent reasoning loop, achieving near real-time responses while maintaining strict policy enforcement.

Each interaction flows through the system in five steps:

Input received – Each user message simultaneously triggers the guardrail model and the primary agent large language model (LLM).
Parallel evaluation – The lightweight guardrail model classifies the input against the active policy set default and custom while the primary model begins generating a response.
Gated output – The response stream is held until the guardrail model returns its decision.
Approved path – If the input passes evaluation, precomputed portions of the response release instantly to the user, and the remainder streams subsequently.
Violation detected – If a violation is flagged, the system aborts the pending response and streams a safe, policy-defined fallback instead. The violation is passed back to the agent reasoning loop for handling.

This concurrent evaluation architecture is what enables sub-300 ms guardrail performance without degrading the conversational experience. The flow is shown in the following graphic.

Figure 1: Parallel evaluation flow for real-time guardrails

Why Amazon Nova 2 Lite?

DevRev’s guardrail model runs on every single user message, in parallel with the primary agent LLM. This means the model must be fast, accurate, and cost-efficient at scale simultaneously. After evaluating multiple models available through Amazon Bedrock, DevRev selected Amazon Nova 2 Lite as the best fit for production-grade enterprise safety enforcement based on three deciding criteria:

Speed – Amazon Nova 2 Lite achieves a 247 ms average evaluation time, which is fast enough for real-time guardrails without disrupting user experience. This meets the critical threshold for maintaining conversational fluidity at enterprise scale.
Classification performance – Amazon Nova 2 Lite delivers strong accuracy in detecting prompt injection, flagging sensitive content, and enforcing custom natural-language policies, the exact workload DevRev’s guardrail layer requires.
Cost efficiency – Per-interaction costs remain low across thousands of concurrent agent sessions. Built-in availability on Amazon Bedrock also simplifies scaling and monitoring within DevRev’s AWS based infrastructure.

System context: Computer by DevRev

DevRev is a modern enterprise AI system that unifies fragmented enterprise data through Computer, an AI assistant designed to go beyond chatbots that merely read and summarize. Computer can create, update, and delete records across systems such as Salesforce, Jira, and Zendesk. Understanding the architecture explains why guardrails are not optional: they’re essential infrastructure for agents operating at this level of autonomy.

Computer is powered by two core technologies:

Computer Memory – DevRev’s permission-aware knowledge graph transforms structured and unstructured data from across the enterprise into a dynamic network of interconnected information, maintaining data permissions, context, and compliance requirements throughout.
Computer AirSync – A real-time synchronization engine that continuously synchronizes data bidirectionally across systems, alleviating silos and keeping connected systems aligned.

The following graphic shows DevRev at the center of an interconnected architecture that unifies enterprise data across multiple systems such as Jira and Teams.

Figure 2: Computer by DevRev unifies enterprise data across multiple systems

Computer operates as a true AI teammate across the enterprise, finding answers and reasoning across business context. It acts through AI agents that create tickets, update records, route work, and automate tasks using Computer Agent Studio, delivering enterprise-grade governance through built-in security, permission awareness, and compliance controls. DevRev’s Computer Agent Studio provides an intuitive, low-code environment for teams to design, test, and deploy AI agents. Each agent moves through a defined lifecycle (from design to simulation, validation, and finally publishing) and inherits identity and permissions like a human user, limiting access to only authorized data and operations. This is the execution environment in which guardrails operate: a deterministic, observable, permission-bounded runtime where safety enforcement is built in at the system level.

The following graphic shows Computer executing a multistep ticket reassignment in which it updates eight records, applies escalation tags, and logs changes across multiple systems, including Salesforce and Slack.

Figure 3: Computer executing a multistep ticket reassignment

The following screenshot of the Build dashboard shows the agent configuration interface for a Developer Evangelist agent, including modular sections for knowledge sources, skills, and guardrails alongside a live chat preview panel.

Figure 4: The Build dashboard showing the interface for a Developer Evangelist agent

Enabling safe agent autonomy at enterprise scale

When enterprises can trust that every interaction is evaluated against policy before reaching the user, they can confidently expand the scope of what agents are allowed to do, taking on more complex workflows, accessing more sensitive data, and operating with less human oversight. AI safety, properly implemented, makes greater autonomy possible rather than constraining it.

The production results reinforce this value. When agents resolve 85% of support tickets automatically and save employees more than 10 hours per week, efficiency gains only hold if the underlying AI operates within defined boundaries. By building real-time evaluation directly into the agent execution pipeline powered by the 247 ms average evaluation time of Amazon Nova 2 Lite, DevRev demonstrates that speed and safety can coexist without sacrificing either. For organizations exploring enterprise AI adoption, deploying AI agents is a must, and their challenge is to choose a system that can best enforce the policies, permissions, and AI safety boundaries required by production deployments.

Conclusion

DevRev’s guardrails capability powered by Amazon Nova 2 Lite through Amazon Bedrock demonstrates that enterprise AI safety and operational performance coexist comfortably. With real-time policy evaluation running at 247 ms average latency, natural-language policy authoring, and parallel execution that preserves conversational fluidity, DevRev gives enterprises the foundation to deploy AI agents confidently and at scale. The combination of Computer’s permission-aware architecture with the classification performance of Nova 2 Lite demonstrates how responsible AI and operational efficiency can scale together.

To get started, request a demo and see DevRev’s agent system and built-in guardrails in action. Visit DevRev’s homepage to learn about Computer by DevRev and check out the DevRev blogs for technical articles and updates. Watch Building safer agents at DevRev, a live session with DevRev CTO Ahmed Bashir, for a comprehensive walkthrough of guardrail implementation and real-world use cases.

DevRev – AWS Partner Spotlight

DevRev is an AWS Partner that provides an enterprise AI system unifying customer support, product development, and business operations through Computer, an AI agent system that executes work across enterprise systems while enforcing safety policies with built-in guardrails powered by Amazon Nova 2 Lite on Amazon Bedrock.

Contact DevRev | Partner Overview | AWS Marketplace

AWS and Elastio deliver comprehensive ransomware resilience

Stuart Lupton — Wed, 01 Jul 2026 15:17:54 +0000

By: Cecily Polonsky, Chief of Staff, GTM Strategy – Elastio
by: Stuart Lupton, Senior Specialist SA, Storage – AWS
by: Danny Johnston, Principal Storage Specialist – AWS

Elastio

As ransomware threats grow more advanced, organizations across industries are strengthening their recovery readiness alongside prevention. Forward-thinking teams recognize that a robust recovery capability is a strategic advantage, one that enables confident operations even in the most challenging cyber scenarios. By designing recovery strategies purpose-built for modern threats, organizations gain the ability to restore critical systems quickly and reliably, even when attacks move laterally across production, standby, and backup environments. The result is a resilient posture where recovery points remain trustworthy and teams stay in control.

That’s why leading organizations are building ransomware-aware recovery strategies and, crucially, maintaining continuous visibility into the integrity of their recovery points. Amazon Web Services (AWS) services, including AWS Backup and AWS Elastic Disaster Recovery, provide the foundation for scalable, resilient recovery architectures that address these modern threat scenarios. Alongside partner solutions such as the Elastio Ransomware Recovery Assurance Platform, these services bring ransomware intelligence and recovery validation into a unified approach to resilience.

In this post, we examine how to develop ransomware-aware recovery strategies that are tested, trusted, and ready for the current threat landscape. You’ll see how to use AWS services and Elastio’s ransomware intelligence to gain continuous visibility into what is protected, what is vulnerable, and what can be safely restored, giving your organization the ability to recover when it matters most.

Why ransomware demands a new approach to recovery

For over 70 years, data protection as a strategy has mainly consisted of a combination of:

High availability – In case of a local hardware failure
Business continuity or disaster recovery plan – For recovery in case of a threat event
Backup – An independent copy of the data for restoration

These data protection mechanisms remain valid and critical but haven’t kept pace with ransomware evolution. Traditional strategies assume failures are contained within data centers and won’t travel across networks. Ransomware deliberately exploits lateral connectivity between production, standby, and protection systems to eliminate all recovery avenues post-attack. This evolving risk requires a recovery strategy purpose-built to disrupt ransomware’s lateral movement, one that adds a layer of protection designed to isolate, validate, and preserve clean recovery data when it matters most.

The following graphic illustrates these three operational data protection layers with a cloud-hosted vault as the fourth layer to prevent ransomware lateral movement.

Figure 1: Traditional data protection layers plus a cloud-hosted data vault

A fourth line of data protection – Cloud-hosted data vault

A solution that resilient organizations are adopting is a cloud-hosted data vault (CHDV). A CHDV is an environment that secures mission-critical data assets in an immutable, air-gapped vault so that if ransomware attacks occur, businesses have good copies for recovery. The financial services industry (FSI) has learned how critical its interconnected systems are, and what global consequences could result if those systems fail. In response, financial services have taken a leading role in advancing data vaulting and ransomware recovery strategies.

Regulatory bodies are also driving data vault adoption in financial services. The Hong Kong Monetary Authority (HKMA) released regulatory requirements for Secure Tertiary Data Backups, and New York Department for Financial Services (NYDFS) released requirements for backups that are protected from unauthorized alterations or destruction. In the UK, the Cross Market Operational Resilience Group (CMORG) developed a reference architecture for CHDVs.

AWS and its partners have met this regulatory shift to deliver solutions that build on existing data protection to enable data vault strategies anchored on three essential pillars: immutability, air-gapping, and integrity validation.

How to get started with data vaulting on AWS

AWS has data protection mechanisms within its AWS services portfolio that can be used independently to construct resilient data platforms as needed. AWS Backup centralizes these data protection services and features into one place, using backup policies and job reporting to automate and monitor an organization’s data protection strategy.

A feature of AWS Backup is the logically air-gapped vault. A logically air-gapped vault offers additional security features compared to a standard vault that are automatically applied at creation:

Logically air-gapped vaults are automatically created with compliance mode enabled. Data stored in these vaults is immutable.
An AWS owned key manages encryption of the data. AWS Key Management Service (AWS KMS) managed keys and customer managed keys are also supported.
Restore-only copies of the backups can be shared using AWS Resource Access Manager (AWS RAM) for quick restores and testing.

For on-premises infrastructure and Amazon Elastic Compute Cloud (Amazon EC2) workloads that require near-zero Recovery Point Objectives (RPOs), Elastic Disaster Recovery provides a fast and reliable solution for ransomware recovery. It enables rapid failover by creating a cost-optimized staging area in AWS, allowing servers and applications to be restored within minutes from a designated recovery point.

AWS Backup and Elastic Disaster Recovery both provide robust tools to protect mission-critical data and applications in the event of a ransomware attack. But protection only works if the correct data and systems are included and, just as importantly, if the data that is stored is trustworthy. That’s why visibility into data integrity, actionable insights, and continuous validation are essential components of an effective ransomware resilience strategy.

Elastio Platform 360 Ransomware Resilience – Critical visibility into recovery integrity

For critical insights and visibility into recovery data, organizations are turning to the Elastio Ransomware Recovery Assurance Platform. Elastio is an AWS Partner that brings ransomware-specific intelligence into the recovery process. Elastio integrates directly with AWS Backup logically air-gapped vaults through restore testing and Elastic Disaster Recovery to deliver continuous data integrity validation and visibility into an organization’s recovery posture. In this way, the Elastio Platform addresses the integrity pillar of ransomware recovery.

With ransomware threats growing more evasive, attackers often move slowly and stealthily, encrypting data over time or staging attacks in dormant states. This type of behavior can quietly compromise recovery points, even if they are made immutable or air gapped. Elastio helps customers stay ahead of this risk by continuously validating backup and recovery data against hidden ransomware indicators, insider threats, and silent corruption. The result is a real-time understanding of the recoverability of mission-critical data—a key factor when recovery speed, regulatory compliance, and business continuity are at stake. These insights are delivered through Elastio Platform 360 Ransomware Resilience User Interface (UI), which gives AWS customers a centralized view of recovery health across five core areas:

Recovery Assurance – Confirms the presence of clean, usable recovery points across all protected assets.
Ransomware Safety – Detects ransomware behavior, before or after detonation.
Encryption Safety – Flags unauthorized encryption activity, including slow, stealthy changes indicative of insider threats.
Asset Coverage – Highlights unprotected systems or gaps in the current recovery plan.
Storage Health – Evaluates backup configurations for alignment with best practices for resilience.

The following screenshot shows the Elastio Platform 360 Ransomware Resilience UI dashboard with recovery health metrics across these five core dimensions.

Figure 2: Elastio 360 Ransomware Resilience UI dashboard

Each dimension is scored and monitored over time, offering a quantifiable view of ransomware recovery health. This level of operational visibility is especially important as organizations look for provable recovery readiness. Elastio helps meet those expectations by making recovery posture measurable and continuously verifiable. Critically, Elastio’s insights do more than live inside a dashboard. They drive real, high-impact decisions. Infrastructure teams rely on Recovery Assurance data to flag backups that fall outside the defined RPO windows. Security teams act on Ransomware Safety alerts to detect early-stage threats, pinpoint the last known clean version of compromised assets, and accelerate incident response, ensuring recovery to a verified, uncompromised state. Meanwhile, compliance teams use Asset Coverage intelligence to identify gaps in protection, such as unvalidated workloads, and proactively adjust policies to close those risks.

Elastio also provides a Model Context Protocol (MCP) server, the Elastio MCP Server, giving teams the ability to connect large language models (LLMs) such as Anthropic’s Claude directly to Elastio and use plain English prompts to ask questions, summarize findings, and identify compliance and recovery gaps in real time.

This level of visibility transforms recovery from a reactive process into a proactive discipline. In high-stakes environments like financial services, where cyber insurers, regulators, and boards demand proof of resilience, Elastio helps enterprises answer the question: Can you recover safely?

Conclusion

The data protection landscape has evolved. Where recovery strategies once focused primarily on accidental loss or localized incidents, today’s organizations are building defenses that account for deliberate, targeted attacks. As the barrier to entry for threat actors continues to lower, the most resilient organizations are staying ahead by adopting recovery architectures that assume compromise and ensure rapid, validated restoration regardless of the attack vector. In this environment, visibility, insights, and actionable data are key to understanding what good looks like, and, more importantly, what bad looks like, so it can be corrected. Combining these insights with a validated, clean copy of the data not only gives organizations the ability to recover but also limits the impact on customers and third parties. Together, AWS and Elastio offer a modern, integrated approach to ransomware-aware recovery. From immutability and air-gapping to continuous integrity validation and recovery assurance, their combined capabilities form the foundation of a resilient recovery posture—one designed to restore data as well as trust, operations, and business continuity in the event of a cyberattack.

Elastio – AWS Partner Spotlight

Elastio is the control point for cyber resiliency—because survival depends on clean recoveries. The Elastio Platform continuously validates storage and backups, detects ransomware encryption, and ensures uncompromised recovery, even from zero-days. By bridging the gap between security tools and immutable storage, Elastio removes the risk of unrecoverable data.

Contact Elastio | Partner Overview | AWS Marketplace

Introducing Forward Deployed Engineering for Partners: Winning the Future of Enterprise AI

Chandra Pinapala — Tue, 30 Jun 2026 15:06:19 +0000

By: Karthik Sonti. Head of Agentic AI, Consulting Partners – AWS
By: Erik Farr, Director, Solution Architecture, Consulting Partners – AWS
By: Chandra Pinapala, WW Director, Global Strategic Partners – AWS

Enterprise AI has outgrown the advisory model. Customers are not asking for roadmaps. They are asking who can put production agentic systems into their environment — running under real governance, on real data, in weeks. The shift is from counsel to outcomes. And the partner who delivers outcomes first wins the architecture relationship for the future.

Today, AWS announced Forward Deployed Engineering, a dedicated organization backed by a $1 billion investment to embed thousands of engineers directly with customers to co-develop and deploy agentic AI solutions at speed. FDE teams operate under actual customer constraints from day one and deliver systems structured for self-sufficiency, not ongoing dependency.

Our commitment does not stop with AWS engineers. The new Partner-Led Forward Deployed Engineering Motion extends that investment to our most strategic partners. Not as a certification. Not as a training program. As a durable, embedded delivery capability inside the consulting firms our customers already rely on — the same methodology, the same production bar, operating at the same velocity.

Why Partners, Why Now

Agentic AI has moved past strategy and proof-of-concept into execution. Demand for production-grade agentic systems has outpaced the delivery capacity of any single organization. Customers are no longer asking whether to deploy — they are asking who will build it fast enough to matter. They need to agentify IT operations, engineering workflows, supply chain decisions, and compliance monitoring across every business unit simultaneously.

Partners already hold the customer relationships, the industry context, and the delivery footprint to operate at that scale. What they have not had is a production-grade delivery methodology that compounds with every engagement.

The Agentic Process Transformation initiative gives customers and partners the right mental model for agentification: start with a business process, reimagine it for the agentic world, deploy it into production, and demonstrate measurable results. With APT, we validated both the demand signal and the delivery pattern. It also revealed that partners with deep domain expertise accelerate time-to-production when they operate under the same engineering bar.

The Partner-Led FDE motion takes that insight and makes it durable: a permanent delivery capability embedded inside our partners that holds the same production bar across all agentic work, compounds institutional knowledge with every engagement, and scales independently over time.

A Continuum of Customer Choice

The Partner-Led FDE motion is one part of the broader AWS Forward Deployed Engineering continuum. Customers choose how AWS and Partners show up: The production bar does not change regardless of the mode.

What Makes This Different: The Delivery Harness

Every Partner-Led FDE engagement builds a reusable harness the partner owns permanently: domain ontologies, evaluation frameworks, MCP servers, agent operations tooling, and a context graph that records the architecture choices, evaluation criteria, and domain patterns applied during each build.

The harness captures the knowledge that AWS and partner engineers apply together during a build, so the partner FDE team can apply it independently on subsequent engagements.

Partners also build the agents that amplify their own delivery: an architecture agent that proposes design decisions in real time, an agent-operations layer that bakes governance into everything it ships, and a reusable registry of capabilities that grows with each engagement. The delivery IP stays with the partner. The compounding advantage stays with the partner. The business outcome belongs to the customer.

How it Works

Partners will build ring-fenced, AWS-credentialed engineering teams with AWS support to deliver production agentic systems with AWS services. In early customer engagements, AWS engineers are deeply embedded with the partner to support the build journey. As more of the work moves into reusable patterns, AWS support will shift to helping the partner scale their FDE practice.

Partner AWS-credentialed engineers pass an AWS-defined technical bar before engaging with any customer. This is not a certification checkbox. It is a production-engineering standard, validated against the same methodology that AWS FDE teams use.

Getting Started

We are launching the Partner-Led FDE Motion with a limited set of partners. As we validate the delivery model, sharpen the harness, and scale it, we will extend it to the broader partner network. To get started, connect with your AWS Partner Development Manager.

Learn more about the AWS Forward Deployed Engineering announcement.

How DXC Technology upgraded Angular and .NET applications with Amazon Q Developer

Dhiraj Thakur — Mon, 29 Jun 2026 21:02:07 +0000

By: Charles Christopher, Principal Solutions Architect – DXC Technology
By: Dhiraj Thakur, Senior Solutions Architect – AWS

DXC Technology

Many enterprises adopt microservices and micro-frontend architectures to build scalable, cloud-based platforms. A customer of DXC Technology operated a large-scale, distributed enterprise platform supporting multiple business domains with high availability and continuous delivery.

The platform consisted of more than 80 independently deployed backend microservices; multiple Angular-based micro-frontend applications; separate continuous integration and continuous delivery (CI/CD) pipelines per service; integrations with authentication systems, APIs, and third-party services; and mandatory static application security testing (SAST) and dynamic application security testing (DAST) security validation before production deployment.

Although the architecture was modern, the underlying technology stack had aged. Backend services ran on older .NET versions, and frontend applications used earlier Angular releases—both approaching or past end-of-support. As the platform grew, maintaining outdated frameworks introduced operational risk. Each microservice carried its own dependencies, configurations, and version constraints. Upgrading required careful coordination to avoid breaking API contracts, authentication flows, routing, shared components, and integrations.

With multiple teams owning different services, standardized upgrade patterns, synchronized release planning, and rigorous regression validation were essential. Modernization demanded structured execution across architecture, security, testing, and DevOps. However, modernizing such a large distributed system required a well-planned, automated, low-risk approach to maintain business continuity while accelerating transformation. In this post, we explore how DXC used Amazon Q Developer to successfully upgrade to a newer framework.

Business challenges

DXC’s customer faced mounting operational and security risks from their aging stack:

End-of-life risk – Several Angular and .NET versions were nearing end-of-support, limiting access to security patches and vendor support.
Security exposure – Regular SAST and DAST scans surfaced vulnerabilities from deprecated libraries and unsupported components.
Large-scale complexity – Upgrading more than 80 microservices and multiple micro-frontends required coordinated changes across distributed repositories.
Regression and integration risk – Framework changes could impact API contracts, authentication flows, and service communication, requiring extensive validation.
Cross-team coordination overhead – Multiple teams with inconsistent upgrade approaches led to extended timelines.

A traditional manual upgrade strategy was unsustainable. The customer needed a standardized, automated approach to accelerate upgrades while preserving stability and business continuity.

Proof of concept and prompt engineering approach

Before initiating the full-scale upgrade across so many microservices, DXC conducted a structured proof of concept (POC) to validate the modernization approach using Amazon Q Developer. The objective of the POC was to:

Evaluate migration accuracy to the latest supported framework versions
Identify breaking changes and dependency conflicts
Measure effort savings compared to manual upgrades
Assess security improvements
Validate build and testing stability after migration

During the POC, the team carefully selected a representative set of microservices and one Angular application. Instead of performing direct manual upgrades, developers used Amazon Q Developer with structured prompt engineering techniques.

How prompt engineering was used

The team provided clear and contextual prompts to guide the migration process, such as:

Specifying the source and target framework versions
Asking for deprecated API replacements aligned with best practices
Requesting dependency compatibility checks
Providing build errors and stack traces for troubleshooting
Asking for secure coding improvements

When migration-related build failures occurred, developers supplied configuration files and error logs to Amazon Q Developer. The tool analyzed the context and suggested corrected package versions, configuration updates, and refactored code snippets.This iterative interaction significantly reduced troubleshooting time compared to traditional debugging. The POC demonstrated that Amazon Q Developer could standardize the upgrade process, reduce manual effort, and improve consistency across services. Based on measurable time savings and successful validation, the team proceeded with full-scale modernization across the platform.

Solution design

The customer operated many backend microservices and multiple micro-frontend applications built on older framework versions. The goal was to upgrade the entire platform quickly, securely, and with minimal risk. The process followed four steps:

Developer workstation – Developers worked in Visual Studio and VS Code, connecting legacy applications (Angular 9 or 15, .NET 6 or 7) to Amazon Q Developer directly from their integrated development environments (IDEs).
AI-driven modernization – Amazon Q Developer automatically upgraded Angular 9 or 15 to Angular 20 and .NET 6 or 7 to .NET 8. It fixed deprecated APIs and resolved broken dependencies and security vulnerabilities.
CI/CD and security pipeline – After the applications are modernized, they flow through a fully automated CI/CD and security pipeline. The pipeline has the following components:
1. AWS CodeCommit – Source code repository
2. AWS CodeBuild – Build and unit testing
3. AWS CodePipeline – End-to-end pipeline orchestration
4. Code assessment – Code quality checks
5. SAST tool – Static security scanning
6. Amazon Elastic Container Registry (Amazon ECR) – Container image repository

The pipeline has the following components:

Automated build and test
Code quality validation
Security vulnerability scanning
Container image creation
Secure artifact storage

By using this design, every change is validated, secure, and production ready.

Secure cloud deployment – After successful validation, the applications are deployed to AWS. The frontend deployment consists of:
1. Uses Amazon Simple Storage Service (Amazon S3) for static web hosting
2. Hosts Angular 20 web applications
3. Can be integrated with Amazon CloudFront for global content delivery network (CDN)

The backend deployment consists of:

Amazon Elastic Kubernetes Service (Amazon EKS) for containerized microservices
Runs .NET 8 microservices
Supports auto scaling and high availability

The following high-level architecture diagram illustrates the solution design.

Figure 1: Solution design

Security validation

Before production promotion, DXC implemented multiple security validation layers. Beyond traditional SAST and DAST scans, Amazon Q Developer proactively identified security concerns during development—flagging insecure patterns, deprecated libraries, and recommending secure alternatives for authentication and configuration handling.This early AI-assisted review reduced vulnerabilities before code entered the CI/CD pipeline. Formal SAST and DAST scans then maintained compliance with enterprise security policies. Combining AI-driven review with automated scanning strengthened the platform’s security posture and production readiness.

Testing and validation

After the upgrade, DXC ran automated unit tests within the CI/CD pipeline to validate framework compatibility and functional correctness. Integration testing verified service communication, authentication flows, and API contracts, and regression testing confirmed that existing workflows remained unaffected. Amazon Q Developer helped developers quickly resolve issues from deprecated APIs or configuration changes, reducing stabilization time before deployment.

Customer benefits

By using Amazon Q Developer for application upgrades, the customer was able to modernize both frontend and backend applications faster and with much lower risk. They enjoyed several benefits:

Faster upgrades across a large platform – The customer was able to upgrade more than 80 microservices and several micro-frontend applications in a structured and consistent way. Tasks that would normally take several months using manual effort were completed much faster in few weeks, helping the team meet security and compliance timelines.
Less manual work and fewer errors – Upgrading frameworks usually involves a lot of manual changes, such as fixing deprecated APIs, updating dependencies, and resolving build issues. Amazon Q Developer handled most of this work automatically, reducing manual effort and lowering the chance of mistakes across multiple codebases.
Stronger security and compliance – Moving to supported framework versions helped resolve issues found during SAST and DAST scans. By replacing outdated and vulnerable libraries, the platform became more secure and aligned with security and compliance requirements.
Lower risk during testing and rollout – The upgrades were applied in a consistent way across services, which reduced unexpected behavior and integration issues. This helped minimize regression risks and reduced the time needed for testing and stabilization.
Cleaner and easier-to-maintain code – After the upgrades, the applications followed modern framework standards and best practices. This made the code easier to understand, maintain, and extend, simplifying future enhancements and upgrades.
Better long-term stability – By upgrading to long-term support (LTS) versions, the customer received continued access to security patches, bug fixes, and vendor support. This reduced operational risk and improved platform stability.
Higher developer productivity – With much of the upgrade work automated, developers were able to focus more on delivering business features instead of spending time on repetitive technical tasks. This improved overall team productivity.
Cross-team consistency – Amazon Q Developer enforced a common upgrade approach, reducing dependency conflicts during integration.

Productivity metrics

By using Amazon Q Developer for framework modernization, DXC significantly reduced the total upgrade effort compared to a manual approach. On average, manually upgrading a single microservice required approximately 16–24 developer hours, including dependency updates, deprecated API fixes, build issue resolution, security remediation, and testing. For more than 80 microservices, this would have required an estimated 1,600–2,000 total developer hours. With Amazon Q Developer, the average upgrade time per service was reduced to approximately 4–6 hours, bringing the total effort down to roughly 400–600 hours. This resulted in an estimated savings of 1,200–1,400 developer hours, representing a 60–75% reduction in overall upgrade effort while maintaining security and quality standards.

Key learnings

Structured POC validation reduces large-scale upgrade risk.
Prompt engineering significantly improves AI modernization accuracy.
Standardizing upgrade patterns across teams minimizes integration failures.
AI-assisted troubleshooting reduces debugging time but still requires engineering validation.
Combining AI modernization with SAST or DAST strengthens production readiness.
Upgrading to LTS versions provides long-term operational stability.

Conclusion

By combining AWS AI tooling with deep engineering expertise, DXC helped its customer transform a high-risk, long-duration modernization effort into a fast, secure, and scalable success.

DXC – AWS Partner Spotlight

DXC is an enterprise technology and innovation partner that helps global enterprises and public sector organizations run efficiently and modernize their systems. We provide end-to-end solutions across every technology domain, keeping critical systems resilient, compliant, scalable, streamlined and protected with our Business Process Services, Cloud & Infrastructure, Cybersecurity, Enterprise Applications, Infrastructure Protection, Managed Applications, Modernization as a Service and Modern Workplace solutions.

Contact DXC Technology | Partner Overview | AWS Marketplace

Securing AI-driven APIs on AWS with Wallarm

Aliaksei Ivanou — Tue, 23 Jun 2026 21:50:15 +0000

By: Craig Riddell, Global Field Chief Information Security Officer (CISO) – Wallarm
By: Aliaksei Ivanou, Worldwide Security & Identity Senior Partner Solutions Architect (PSA) – AWS

Wallarm

As organizations deploy AI-driven APIs on Amazon Web Services (AWS), security teams have an opportunity to enable rapid AI adoption while maintaining full visibility into how these workloads operate. AWS is architected to be the most secure global cloud infrastructure on which to build, migrate, and manage applications and workloads. Together, AWS and Wallarm deliver a comprehensive security architecture that combines foundational cloud controls with specialized runtime visibility for AI-driven APIs. In this post, you’ll learn why runtime visibility is essential for AI-driven APIs and what capabilities address this need.

The visibility gap in AI security

As AI applications scale in production, the API layer becomes the primary interface for AI interactions. Traditional security controls weren’t designed to provide visibility into what happens at runtime within these dynamic, stateful conversations.Every prompt, every model response, every tool invocation, and every automated decision flows through APIs. This creates a fundamentally different security surface than traditional applications. Existing controls weren’t designed to answer the following questions AI workloads raise:

What is this agent doing with the permissions it was granted?
Is this model response revealing sensitive or confidential information?
Which APIs are being called by autonomous agents and are they authorized?
How do you validate outcomes, not just inputs?

This is not about generative AI alone. As organizations move toward agentic systems, multi-service orchestration, and automated decision-making, APIs become the control plane for how everything operates. The difference between what security teams can observe and what is actually happening continues to grow.

The benefits of extending visibility to AI workloads

AWS is architected to be the most secure global cloud infrastructure on which to build, migrate, and manage applications and workloads. AI workloads introduce behaviors that require continuous visibility, and you should work to ensure that your tools and controls provide that visibility.Issues appear as normal-looking traffic. AI-related security issues often don’t trigger traditional signatures or rules. A prompt injection looks like a valid user request. An over-permissioned agent making unintended API calls appears as authorized traffic. The structure is correct; the intent is not.Continuous discovery keeps pace with deployment velocity. With runtime visibility, security teams maintain a current inventory of AI services, models, and APIs as they appear in production, confidently answering the question, “What is actually running in production?”Outcomes are not validated. Security controls have focused on inspecting inputs, validating requests, checking permissions, and filtering malicious content. But with AI, the output matters as much. Model responses can inadvertently disclose sensitive data, reveal internal logic, or provide incorrect information that drives business decisions.None of this suggests existing controls are insufficient. It means AI workloads require an additional layer of visibility that complements perimeter security with runtime awareness.

Extending AWS security with runtime visibility

The solution is extending your security architecture with capabilities designed specifically for AI workloads. AWS provides strong foundational controls, and Wallarm adds specialized runtime visibility that helps customers observe and respond to AI-specific behavior.Organizations that successfully secure AI at scale focus on three complementary capabilities:

Continuous API and AI service discovery – Maintain an accurate, real-time inventory of APIs and AI services in production, including those deployed outside formal processes. This provides the foundation for understanding your actual attack surface.
Behavioral detection beyond signatures – Identify unintended behavior even when requests appear valid. This includes detecting prompt injection attempts, identifying anomalous agent behavior, and flagging unexpected data access patterns.
Runtime output validation – Inspect model responses and API outputs before they reach users or downstream systems. This prevents data disclosure, validates response appropriateness, and verifies AI systems operate within defined boundaries.

These capabilities layer into existing AWS architectures without requiring re-architecture. They complement AWS controls by extending visibility into runtime behavior across APIs and AI workloads.

Financial services AI deployment

The following scenario is drawn from common patterns observed across multiple controlled security assessments in the financial services sector and doesn’t represent any specific customer deployment.

A regional financial institution deployed an AI-powered customer service assistant using Amazon Bedrock. The architecture followed AWS best practices, including using Amazon API Gateway for access control, AWS WAF for threat filtering, Amazon CloudFront for content delivery, and Amazon Virtual Private Cloud (Amazon VPC) isolation for network security. The team at the financial institution reviewed and approved the deployment, which met all internal security requirements.

During a proactive security assessment, the team introduced runtime visibility capabilities to evaluate the full AI ecosystem, not only the primary application but all supporting APIs, integrations, and services.The assessment identified three areas of runtime behavior that existing perimeter controls weren’t designed to surface:

Prompt injection disclosing internal logic – Carefully crafted prompts can cause the model to reveal information about internal system architecture and business rules.
Unintended API exposure – A development endpoint remained accessible from the production environment, creating an unmonitored access path.
Sensitive data in model responses – Under specific conditions, the model included customer financial information in responses that should have been redacted.

When the team implemented runtime visibility, they gained:

Complete API inventory – Identification of services that hadn’t been formally documented, including shadow APIs deployed by development teams
Real-time behavioral detection – Ability to identify and block prompt injection attempts and anomalous agent behavior as they occurred
Output validation – Inspection of model responses before delivery, preventing data disclosure and supporting compliance with data handling policies

The outcome was enhanced security posture without re-architecting the AWS environment.

Measuring success from architecture to outcomes

Security leaders increasingly measure success by what they can observe and prevent in production. Deploying controls is necessary but insufficient—the real indicator is whether those controls reduce the time between a threat appearing and being stopped.Organizations that add runtime visibility to their AWS security architecture report improvements across three dimensions:

Coverage – Moving from partial visibility to comprehensive awareness of APIs and AI services in production, including those deployed outside formal processes
Risk reduction – Decreasing the time between deployment and security validation, reducing the window of exposure for new AI services
Mitigation effectiveness – Improving the ratio of threats detected to threats prevented, moving from logging and alerting to active prevention

These outcomes translate directly to business value: faster AI deployment with maintained security posture, reduced compliance risk, and increased confidence in AI-driven decision-making.

Moving forward

AI is accelerating how organizations build applications, how systems interact, and how quickly new risks emerge. AWS provides the strong foundation required to build secure, scalable AI workloads. The AWS Partner Network (APN) extends that foundation with specialized capabilities that help customers maintain visibility and governance as AI adoption scales.

The next step is supporting visibility into what is happening at runtime, understanding your APIs, your AI services, and how they interact in production.Consider these questions as you evaluate your AI security posture:

Inventory – Do you have complete visibility into APIs and AI services running in production, including those deployed outside formal processes?
Behavioral risk – Can you detect risky behavior, such as prompt injection, anomalous agent activity, or unexpected data access patterns?
Output validation – Are you validating AI outputs as well as inputs to prevent data disclosure and verify response appropriateness?
Outcome measurement – How do you measure whether your security controls are effective, not merely deployed, in preventing threats specific to AI workloads?

Runtime visibility helps organizations extend visibility and governance across AI workloads as they operate in production. To explore how runtime visibility can strengthen your AI security posture, visit Wallarm in AWS Marketplace.

Wallarm – AWS Partner spotlight

Wallarm is an AWS Advanced Technology Partner and independent software vendor (ISV) specializing in API security and AI runtime protection. Wallarm integrates natively with AWS services including Amazon API Gateway, Amazon CloudFront, Elastic Load Balancing (Application Load Balancer), and Amazon EKS to provide continuous API discovery, behavioral threat detection, and runtime output validation for AI workloads. Through the APN, Wallarm helps AWS customers deploy AI with confidence by extending native controls with the runtime visibility layer that modern AI applications require. Wallarm is available in AWS Marketplace, where customers can deploy using existing AWS commitments and streamline procurement.

Contact Wallarm | Partner Overview | AWS Marketplace

Automate security and observability with Elastic and Amazon Bedrock

Ganesh Ramesh Shenoy — Thu, 18 Jun 2026 17:03:22 +0000

By: Udayasimha Theepireddy, Senior Principal Solutions Architect – Elastic
By: Ganesh Ramesh Shenoy, Solutions Architect – AWS
By: Srinivas Pendyala, Senior Partner Solutions Architect – AWS

elastic

As cloud-native architectures grow in complexity, your security analysts and site reliability engineers (SREs) need faster ways to correlate events, investigate incidents, and resolve issues. The manual hand-offs between tools pivoting across consoles, copying data, deciding next steps are where response time goes. That gap widens the moment an attacker or incident moves faster than the analyst watching the screen.

Elastic’s AI-powered features, powered by Amazon Bedrock, close that gap. Instead of stopping at detection, the platform investigates and acts, so your team moves from alert to resolution faster. Analysts reclaim the hours they spent on correlation and triage and redirect them to strategic threat hunting and operational improvements that require human judgment.

In this post, you learn how these capabilities accelerate security and observability workflows through conversational agents, automated workflows, and custom AI agents and how to get started on AWS.

Elastic’s AI-powered features on Amazon Bedrock

Elastic has evolved its AI-powered capabilities from conversational assistance to full workflow automation. What started as Elastic AI Assistant, a conversational interface for querying threat intelligence and analyzing logs, has grown into a comprehensive platform that combines intelligent agents with automated workflows.Today, Elastic’s AI-powered features include three core capabilities:

Elastic AI Assistant – The conversational AI foundation that helps you query data in natural language, summarize alerts, and receive investigation guidance
Elastic Workflows – A declarative automation engine that orchestrates multi-step processes across Elasticsearch, Kibana, and external systems like Slack, Jira, and PagerDuty. You define workflows in YAML with triggers, conditional logic, and AI steps that run automatically
Elastic Agent Builder – A framework for building custom, context-driven AI agents grounded in your data. You define agent instructions, assign tools, and deploy agents that reason across your indices to provide accurate, actionable answers via chat, API, MCP, or A2A

These capabilities work together. Agents can invoke workflows when action is required. Workflows can invoke agents when investigation or reasoning is needed. Amazon Bedrock provides the scalable foundation model layer, delivering managed access to foundation models with security and compliance built in. The default chat experience in Elastic is now powered by Agent Builder, providing an agentic interface for interactive investigation and automation. AI Assistant remains available for features such as knowledge base integration, data anonymization, and chat sharing.

You can choose the foundation model that best fits your needs. Elastic handles authentication, routing, and optimization through the Elastic-managed LLM connector, which by default uses Amazon Bedrock with Claude models. As new models become available on Amazon Bedrock, you can adopt them without disrupting your existing workflows.

Accelerating security operations

With these capabilities, you automate the full lifecycle of security investigation and response. Here is how the capabilities work together in a typical security workflow. When a security alert fires, Elastic Workflows can automatically trigger an investigation. The workflow invokes an AI agent built with Agent Builder that is grounded in your security playbooks and threat intelligence. The agent analyzes the alert context, correlates signals across indices, and surfaces findings. Based on those findings, the workflow continues with structured response actions: creating a case, notifying your team through Slack, enriching the alert with context, or triggering remediation. For interactive investigation, you use Elastic AI Assistant to ask questions in natural language. For example, you can ask: “Show me all failed login attempts from unusual geographic locations in the last 48 hours that correlate with data exfiltration patterns.” The assistant analyzes event patterns and provides recommended next steps.

Key capabilities across security operations:

Attack discovery – Automatically identifies and prioritizes coordinated threats across your environment, reducing alert noise and surfacing the incidents that matter most
Automated investigation – Workflows trigger AI agents on alert, enabling immediate triage without waiting for an analyst
Alert summarization and triage – Generates natural language summaries so you can quickly understand severity and prioritize your response
Incident response automation – Workflows orchestrate response actions across Jira, Slack, PagerDuty, and internal systems based on AI findings
Custom security agents – Build agents tailored to your SOC with specific instructions, tools, and security profiles using Agent Builder

This approach shifts your SOC from reactive, manual investigation to automated, AI-driven response. Analysts focus on decisions that require human judgment while automation handles the repetitive correlation and triage work.

Optimizing application performance and observability

As a site reliability engineer, use Elastic’s AI capabilities to diagnose and respond to performance issues across complex microservices architectures. The same agent and workflow patterns apply to observability use cases. When an observability alert fires, a workflow can invoke an AI agent to correlate signals from logs, metrics, and traces. The agent identifies the likely root cause, and the workflow orchestrates next steps: notifying the on-call engineer, creating an incident ticket, or triggering a remediation runbook. For interactive troubleshooting, you ask questions in plain language. For example: “What’s causing the latency spike in our payment service over the last hour?” Elastic AI Assistant pinpoints the root cause and recommends next steps.

Key capabilities across observability:

Root cause analysis – AI agents correlate application traces, logs, and metrics to identify performance bottlenecks across distributed services
Automated remediation – Workflows run predefined response actions when specific conditions are met, closing the loop between detection and resolution
Log analysis and interpretation – Explains error messages and log patterns in natural language, reducing time spent on manual analysis
Query assistance – Helps you write ES|QL queries for specific observability use cases, accelerating data exploration

The platform analyzes logs, metrics, and traces simultaneously, providing insights that are difficult and time consuming to gather manually. With workflows automating the response path, you can resolve issues before they affect end users.

Solution architecture

The architecture on AWS combines multiple services to deliver a scalable, secure, and high-performing solution. The following diagram shows an end-to-end AI-powered threat detection and automated remediation architecture.

A compromised IAM credential triggers unusual API activity. AWS CloudTrail, VPC Flow Logs, and AWS Security Hub stream these security events into Elastic Cloud on AWS, where they are enriched with threat intelligence and correlated by Attack Discovery – powered by Amazon Bedrock through AWS PrivateLink – to surface a high-confidence threat alert. Elastic AI Assistant helps the security analyst investigate in natural language, while Agent Builder runs deeper automated analysis. Based on the findings, Elastic Workflows automatically revoke credentials, isolate affected resources, and notify the team through Slack, PagerDuty, and Jira – reducing mean time to detect and respond from hours to minutes.

Figure 1 – End-to-end AI-powered threat detection and automated remediation architecture

Core components:

Elastic Cloud on AWS – Provides the search and analytics foundation with automatic scaling
Elastic-managed LLM – Connector that by default uses Amazon Bedrock with Claude models, handling authentication and model management automatically
Amazon Bedrock – Delivers managed access to foundation models with security and compliance
Elastic Workflows – Automation engine that orchestrates actions across Elastic and external systems
Elastic Agent Builder – Framework for deploying custom AI agents grounded in your Elasticsearch data

This architecture supports data privacy and security while delivering sub-second response times. You benefit from continuous model improvements and optimizations without manual intervention, reducing time to value.

Organizations using this approach have reduced mean time to respond by up to 99% and cut critical incidents by 95%.

Conclusion

Elastic combines its search expertise with Amazon Bedrock’s foundation models to automate security and observability workflows. With AI Assistant for conversational investigation, Workflows for automated response, and Agent Builder for custom AI agents, you get a complete platform for moving from detection to resolution faster. You can get started today and grow into these capabilities as your needs evolve.

Getting started

Elastic Cloud on AWS is available through AWS Marketplace, offering a path to deployment with integrated billing. With Elastic Cloud on AWS, focus on analyzing data instead of managing infrastructure.

After deployment, enable AI Assistant for conversational investigation, create workflows for automated response, and build custom agents with Agent Builder. The Elastic-managed LLM connector comes pre-configured to use Amazon Bedrock by default, requiring minimal setup.

To learn more, explore Elastic Security and Elastic Observability. To discuss how this solution fits your environment, contact an AWS representative.

Elastic – AWS Partner Spotlight

Elastic is an AWS Advanced Technology Partner with AWS Competencies in Security, Data & Analytics, Financial Services, Government, AI Software, and Education. Elastic participates in the AWS ISV Accelerate Program and the AWS ISV Workload Migration Program. The Elastic Search AI Platform helps everyone find the answers they need in real time, using all their data, at scale. Solutions for search, observability, security, and generative AI are used by thousands of companies, including more than 50% of the Fortune 500.

Contact Elastic | Partner Overview | AWS Marketplace

Securing enterprise ready AI agents with Auth0 for AI Agents and Amazon Bedrock AgentCore

Jose Alvarez — Thu, 18 Jun 2026 16:27:52 +0000

by: Jose Alvarez, Partner Solutions Architect – AWS
by: John Walsh, Partner Solutions Architect – AWS
by: Anthony Smith, Sr. Partner Solutions Architect – AWS
by: Wayne Smiley, Principal Solutions Engineer – Auth0
by: Kapil Patil, Sr. Partner Solutions Architect – Auth0

Auth0

AI agents do more than answer questions. They read emails, book meetings, pull customer records, and take actions across systems on behalf of your users. By extending identity controls to these agents, you give each one a proper identity, scope its permissions to exactly what it needs, and gain a clear audit trail behind every action.

Auth0 for AI Agents provides the complete identity lifecycle for agents built on Amazon Bedrock AgentCore. Together, they let the agents you build, deploy, and operate share the same identity foundation as your workforce and customer applications.

In this post, we walk through how Auth0 and AgentCore come together across the areas that matter most: authenticating users to agents, securing agent-to-agent communication, governing tool access, enforcing fine-grained authorization, and preserving human-in-the-loop approvals.

Securing AI in a world without a blueprint

AI agents are a new category of software. Unlike traditional applications that follow predefined workflows, AI agents can reason about a problem, decide which tools to use, and take actions across multiple systems on their own. Consider an agent handling an IT support request. It might look up a user’s account information in one system, reset a password in another, and search internal documentation in a third. Each step involves different data, different permissions, and different levels of risk.

Gartner predicts that 40% of enterprise applications will integrate task-specific AI agents by the end of 2026, up from less than 5% in 2025. The AWS Security Reference Architecture provides prescriptive guidance on securing agentic workloads, but when teams move fast, common shortcuts create real exposure:

Shared API keys give agents broad access without awareness of which user they’re acting for.
Hard-coded credentials sit in configuration files, where they’re difficult to rotate and hard to scope to a specific user or action.
Passing tokens through a large language model (LLM) and its reasoning layer can disclose credentials in ways that are difficult to monitor with traditional application security tooling.

These shortcuts compound when the access control model itself wasn’t built for agentic workloads. Role-based access control (RBAC), for example, assigns permissions based on a user’s role at login time. AI agents discover information dynamically during a conversation and might need different permissions for each action they take. In this case, you need authorization that evaluates permissions on an ongoing basis, at the level of individual actions, and adapts in real time as roles and relationships change.

For sensitive operations, there is also the question of when a human should still make the final call. Compliance requirements in regulated industries such as healthcare, finance, and government increasingly require that high-risk actions, like resetting a password or modifying financial records, receive explicit human approval before an agent can proceed.

These challenges point to a common need: identity and access management must sit at the center of your AI agent security strategy.

How Auth0 and Amazon Bedrock AgentCore work together

Auth0 for AI Agents and Amazon Bedrock AgentCore address different but complementary parts of this challenge. Understanding what each service is responsible for is key to seeing how they work together.

Auth0 for AI Agents gives you the enforcing function for user identity in agent workflows. It uses upstream identity providers, such as Okta or social connections, to create and maintain the user’s identity so agents operate on behalf of the authenticated and authorized user. Auth0 provides the identity context and fine-grained access control based on the user’s profile and permissions.

Amazon Bedrock AgentCore provides the runtime infrastructure for building, deploying, and operating AI agents at scale. It validates inbound requests to agents and routes outbound tool invocations through Amazon Bedrock AgentCore Gateway, acting as the execution boundary for agent interactions and applying access control across services from Amazon Web Services (AWS) and external systems.

Consistent with the AWS Shared Responsibility Model, AWS and Auth0 provide the services and controls; you’re responsible for configuring identity policies, authorization rules, and approval workflows appropriate for your workloads.

The next sections describe how Auth0 and AgentCore come together across the key areas of agent security.

Restricting access to authenticated users

Before an AI agent can respond to a request, it needs to verify who’s asking. AgentCore uses Auth0 as the identity provider through standard OpenID Connect (OIDC) discovery, so only users with the appropriate credentials and access rights can invoke an agent. Your users authenticate through the same Auth0 login experience they use across your other applications, including enterprise connections to identity providers such as Okta. That means your AI-powered workflows inherit the same multi-factor authentication (MFA) policies and session management as your traditional applications. The following screenshot shows the Auth0 dashboard with the available enterprise identity provider connections.

Figure 1: Auth0 dashboard

Delegating user identity for API calls

When an agent needs to call an external API on behalf of a user, for example to retrieve calendar events from Google or look up account information in a customer relationship management (CRM) system, it needs to act with that user’s permissions without exposing their credentials. Auth0 delegates user identity to the agent, and Auth0 Token Vault stores the access tokens from upstream identity provider connections. Agents retrieve these tokens just in time through a token exchange mechanism, scoped to the specific agent and user combination. The tokens don’t pass through the agent’s reasoning layer. This workflow is shown in the following diagram.

Figure 2: Auth0 Token Vault delegating user identity so the password reset agent can call an external API with a just-in-time federated token

Securing agent-to-agent communication

In multi-agent architectures, a supervisor agent delegates tasks to specialized subagents, and each interaction between agents needs to be authenticated. Auth0 machine-to-machine (M2M) tokens authenticate these interactions following the agent-to-agent (A2A) protocol, an open specification for how autonomous agents authenticate and exchange requests. With A2A in place, agents don’t operate on implicit trust.

Figure 3: A2A authentication flow showing how Auth0 M2M JWT tokens authenticate agent-to-agent communication between the supervisor agent and subagents.

Governing tool access through the gateway

When an AgentCore Runtime agent needs to reach external APIs or Model Context Protocol (MCP) servers, AgentCore Gateway manages and controls those outbound connections. The user’s Auth0-issued access token is included in requests to the gateway, which validates the token’s signature, expiration, audience, and custom claims before routing the invocation to downstream tools. Only requests backed by a valid, Auth0-issued identity reach downstream resources. For direct MCP integrations that bypass the gateway, authentication is handled by the MCP server’s own configuration and credential management

Figure 4: AgentCore Gateway governing tool access, with Auth0 M2M JWT validation before invoking the Lambda documentation search tool

Enforcing fine-grained authorization

Auth0 Fine-Grained Authorization (FGA) provides a framework for defining and enforcing granular permissions based on user attributes and relationships. FGA evaluates permissions at the time of each agent action and can adapt in real time as roles and relationships change, giving organizations ongoing control over what each agent can do on behalf of a given user.

Keeping humans in the loop for sensitive operations

For high-risk actions, Auth0 Client Initiated Backchannel Authentication (CIBA) lets the agent pause its workflow and send a push notification to the user’s device requesting explicit approval. AgentCore can use Auth0 CIBA actions to establish this out-of-band approval channel. The agent only proceeds after the user confirms, preserving human judgment for these operations.

Managing credentials

Both Auth0 and Amazon Bedrock AgentCore provide token vault capabilities with distinct, complementary responsibilities, and in most production deployments, you’ll use both:

Auth0 Token Vault stores tokens for upstream identity provider connections. Use it when your agent needs to act on behalf of a user against third-party APIs (such as Google, Salesforce, or Microsoft 365) without requiring repeated OAuth flows.
Amazon Bedrock AgentCore Identity token vault can initiate and run the full OAuth 2.0 approval flow needed to reach downstream resources, and it stores the resulting tokens for later noninteractive use by agents. Use it when AgentCore itself is brokering access to resources the agent depends on at runtime.

In both cases, credentials are scoped, short-lived, and aren’t exposed to the agent’s reasoning layer.

The following diagram shows the solution architecture.

Figure 5: Reference architecture showing how Auth0 for AI Agents provides OIDC login, fine-grained permissions, and async authorization for agents running on Amazon Bedrock AgentCore Runtime

Why it matters for AWS customers

If you’re already using Auth0, Amazon Bedrock AgentCore support for external identity providers gives you a straightforward path to securing AI agents with the same identity service you use to protect your existing applications. Instead of building separate identity infrastructure for AI agents, you can connect your Auth0 tenant to AgentCore and apply familiar authentication flows, user directories, and security policies to your AI-powered workflows.

This collaboration between AWS and Auth0 is designed to reduce identity overhead for your agent developers and replace fragmented security with a consistent, maintainable model. Your product teams can focus on building agent capabilities, while identity and access management is handled by services purpose-built for it.

Auth0 is offered through AWS Marketplace, making it straightforward for customers to procure and deploy on AWS.

Getting started

You can start bringing Auth0 for AI Agents and Amazon Bedrock AgentCore together in your AWS account today. Wherever you are in your agent journey, there’s a path forward.

To talk through an implementation for your workloads, contact your AWS account team or reach out through the AWS partner contact form.

Auth0 – AWS Partner Spotlight

Auth0 is an AWS Security Competency Partner that takes a modern approach to customer identity and enables organizations to provide secure access to any application, for any user. Auth0 is a highly customizable platform that is as simple as development teams want, and as flexible as they need.

Contact Auth0 | Partner Overview | AWS Marketplace

Transform enterprise visual content with Amazon Nova and Bria Fibo

William Quigley — Wed, 17 Jun 2026 16:48:11 +0000

By: William Quigley, Partner Solutions Architect – AWS
By: Gil Shefler, Partnerships – Bria

Bria

If you’ve tried using existing image models for marketing campaigns, product shots, or branding, you know the frustrations. Outputs are unpredictable. Brand representation drifts. Results can’t be reproduced. And the legality of the training data is an open question. The root problem is fundamental: traditional text-to-image models treat generation as a creative process rather than an engineering task. Ambiguous text prompts produce inconsistent results, making it nearly impossible to maintain brand consistency or achieve reproducible outcomes. For enterprises requiring precise control, auditability, and legal compliance, this unpredictability makes existing tools difficult to use effectively.

In this post, you’ll learn how the integration of Amazon Nova and Bria Fibo solves these enterprise challenges through a deterministic, legally compliant approach to visual content generation. You’ll learn about the architecture that enables precise control, the legal safety that protects your organization, real-world use cases, and how to get started.

A deterministic approach to visual generation

Bria Fibo is a deterministic visual foundation model (FM) that transforms unpredictable text-to-image generation into a precise, reproducible system. Rather than relying on ambiguous prompts, Fibo uses Visual Generation Language (VGL)—a structured JSON-based format that provides fine-grained control over more than 100 image attributes including lighting, composition, color, and camera settings.

Built on an 8-billion-parameter architecture, Fibo interprets structured JSON instructions to generate images with the precision enterprises need for marketing campaigns, ecommerce catalogs, and digital content that demands brand consistency and reproducibility.VGL provides machine-readable specifications for every visual parameter. This approach shifts image generation from a probabilistic guessing game into a deterministic engineering task. The model is trained on structured JSON captions of over 1,000 words, designed to understand and control different visual parameters with precision.

Legal safety through licensed data

Bria trains its models exclusively on licensed data through partnerships with Getty Images, Depositphotos, Envato, Freepik, and other accredited partners. This approach provides full copyright and privacy indemnity (subject to Bria’s terms), reducing the liability risks that affect many generative AI solutions.

Typical text-to-image FMs maximize creativity across entire images, but Bria focuses on predictable outputs with respect to brand data. Most multimodal models struggle to maintain brand integrity without costly fine-tuning. Bria also uses patented attribution technology that provides logs of source images used in generation, supporting proper compensation for content creators.

Bria’s solution is available in AWS Marketplace, with deployments on Amazon SageMaker AI, so your intellectual property is protected by containing image generation in Amazon Virtual Private Cloud (Amazon VPC).

Amazon Nova foundation models

Amazon Nova provides frontier intelligence and industry leading price performance for understanding and generating content. These state-of-the-art FMs excel at text generation and vision-language tasks at a fraction of the cost of comparable solutions—at least 75% less expensive than comparable models in their respective intelligence classes.

The vision-language capabilities of Amazon Nova enable it to understand and describe images with high accuracy, and its text generation capabilities produce structured, high-quality outputs including JSON formatting. The Nova family includes understanding models, Nova Lite and Nova Pro, that process text, image, and video inputs to generate text output. Nova models support over 200 languages.The multimodal capabilities of Amazon Nova encompass visual understanding (image and video), document visual understanding including handwriting and annotations, multimodal document processing and analysis, chart comprehension, and agentic interaction. The affordability and capability of Nova make it well-suited as an orchestration layer for complex AI workflows.

The Amazon Nova to Fibo integration architecture

The integration of Amazon Nova and Bria Fibo creates a precise, cost-effective pipeline for enterprise image generation and editing. The following workflow diagram illustrates how these systems work together to transform natural language into precise visual outputs.The workflow demonstrates how Amazon Nova translates creative prompts such as “two models in business attire walking on a city sidewalk in summer” into structured VGL specifications, which Fibo then uses for deterministic image generation. Note the bidirectional flow—this closed-loop system enables both initial generation and iterative refinement. The following figure shows the Amazon Nova and Bria architecture.

Figure 1: Amazon Nova and Bria architecture

The following code block is the VGL generated by Amazon Nova as input to the Bria Fibo model:

{
	"short_description": "Two models dressed in professional business attire are walking on a bustling city sidewalk during a warm summer day. The scene captures the vibrant energy of urban life with clear blue skies and a backdrop of modern buildings.",
	"objects": [
		{
			"description": "A model dressed in a tailored business suit, wearing a crisp white shirt, a dark blue blazer, and black leather dress shoes. The model has short, neatly styled hair and is carrying a sleek black leather briefcase.",
			"location": "center-left",
			"relationship": "walking alongside the other model",
			"relative_size": "medium-to-large within frame",
			"shape_and_color": "humanoid, light and dark shades of blue and black",
			"texture": "smooth",
			"appearance_details": "The model's attire is polished and professional, reflecting the summer heat with a light, breathable fabric.",
			"pose": "walking confidently",
			"expression": "calm and focused",
			"clothing": "crisp white shirt, dark blue blazer, black dress shoes",
			"action": "walking",
			"gender": "male",
			"skin_tone_and_texture": "light skin, smooth",
			"orientation": "facing forward"
		},
		{
			"description": "A model dressed in a business suit, wearing a light pink blouse, a light grey blazer, and black leather dress shoes. The model has long, straight hair tied back in a low ponytail and is carrying a small black leather handbag.",
			"location": "center-right",
			"relationship": "walking alongside the other model",
			"relative_size": "medium-to-large within frame",
			"shape_and_color": "humanoid, light shades of pink, grey, and black",
			"texture": "smooth",
			"appearance_details": "The model's attire is stylish and professional, with a light, breathable fabric suitable for the summer heat.",
			"pose": "walking confidently",
			"expression": "calm and focused",
			"clothing": "light pink blouse, light grey blazer, black dress shoes",
			"action": "walking",
			"gender": "female",
			"skin_tone_and_texture": "light skin, smooth",
			"orientation": "facing forward"
		}
	],
	"background_setting": "The background features a modern cityscape with tall glass and steel buildings, lush green trees lining the sidewalk, and a clear blue sky. The sidewalk is bustling with people, and there are street vendors and cafes adding to the lively atmosphere.",
	"lighting": {
		"conditions": "bright daylight",
		"direction": "front-lit",
		"shadows": "long, soft shadows"
	},
	"aesthetics": {
		"composition": "rule of thirds",
		"color_scheme": "cool complementary colors",
		"mood_atmosphere": "energetic and professional",
		"preference_score": "very high",
		"aesthetic_score": "very high"
	},
	"photographic_characteristics": {
		"depth_of_field": "shallow",
		"focus": "sharp focus on subjects",
		"camera_angle": "eye-level",
		"lens_focal_length": "standard lens (e.g., 35mm-50mm)"
	},
	"style_medium": "photograph",
	"context": "This is a concept for a high-fashion editorial photograph intended for a business magazine spread.",
	"artistic_style": "realistic, vibrant, detailed"
}

Amazon Nova to Fibo generation

Amazon Nova acts as the intelligent interface, translating your creative natural-language prompts into VGL—the precise JSON structure that Fibo requires. The text generation capabilities of Nova verify that lighting specifications, composition rules, color palettes, and camera parameters are formatted correctly and comprehensively. Fibo then interprets these structured JSON instructions to generate exactly the images you need, reproducibly and at large production workload scale.You can now avoid the unpredictability that affects traditional generative AI systems. Instead of ambiguous text prompts that produce inconsistent results, the Amazon Nova to Fibo integration provides complete control over every visual parameter through structured, machine-readable specifications.

Image refinement loop

The ability to produce specific results extends beyond initial generation. When your existing images need refinement or editing, the vision-language models used by Amazon Nova analyze the current image, generating detailed text descriptions and captions that capture every visual element. Nova then converts these descriptions into VGL, which Fibo uses to make precise modifications while maintaining consistency with your original vision.This bidirectional workflow creates a closed-loop system for iterative creative development. You can start with a concept, generate initial visuals, analyze results, and refine outputs with precision that was previously unavailable in generative AI workflows. The following figure shows the result of Fibo’s “refine” function with the prompt “Same models in fall attire; change city scene to autumn.”

Figure 2: Fibo refine function

Cost and control

This workflow combines the price performance for orchestration and analysis of Amazon Nova with Fibo’s deterministic generation capabilities. You gain both economic efficiency and creative control. The cost savings are substantial: Nova models are at least 75% less expensive than comparable alternatives, and Fibo’s deterministic approach eliminates the waste associated with unpredictable generation requiring multiple attempts.

Enterprise benefits

The Amazon Nova and Bria Fibo integration addresses the fundamental challenges that have prevented widespread enterprise adoption of generative AI for visual content:

Predictability – Fibo’s deterministic architecture eliminates the randomness that makes traditional generative AI unsuitable for production workflows. Every parameter is explicit, disentangled, and reproducible.
Legal compliance – Bria’s 100% licensed training data and full indemnity coverage protect your organization from copyright and privacy infringement risks.
Brand consistency – Because the integration uses structured JSON, you can codify brand guidelines as machine-readable specifications, supporting on-brand outputs at high volume without manual review.
Cost efficiency – The industry-leading price performance of Amazon Nova combined with Fibo’s elimination of wasted generation attempts delivers return on investment (ROI) that makes enterprise deployment economically viable.
Workflow integration – Available in AWS Marketplace and SageMaker AI, the Amazon Nova to Fibo integration fits seamlessly into your existing enterprise infrastructure.

Real-world applications

The Amazon Nova to Fibo integration enables use cases across industries. You can automate campaign generation to produce brand-consistent visuals at high volume. Create product visualization for ecommerce with consistent catalog images across thousands of SKUs or deliver personalized ecommerce experiences with customized product imagery that maintains brand standards. And you can generate real-time sports broadcasting graphics with precise team colors and branding.These applications share common requirements: reproducibility, brand consistency, legal compliance, and cost efficiency. The Amazon Nova to Fibo integration delivers on all four dimensions.

Conclusion

The integration of Amazon Nova multimodal intelligence and cost efficiency with Fibo’s deterministic control and legal safety transforms generative AI from an experimental technology into a production-ready business tool. As you face mounting pressure to produce more content faster while maintaining brand consistency and legal compliance, this integration provides the technological foundation for scalable, responsible visual AI deployment.To get started:

Developers and architects – Try Bria Fibo using Bria API building blocks or deploy the Fibo Hugging Face model in your Amazon VPC or SageMaker AI environment. You can also explore Fibo’s Kiro integration for streamlined development workflows.
Business decision-makers – Explore Bria’s solutions in AWS Marketplace to understand deployment options and pricing models that fit your organization’s needs.

Bria – AWS Partner Spotlight

Bria is an AWS Advanced Partner and AWS AI Partner that offers an enterprise-grade visual generative AI platform available for deployment with source code or as APIs, SDKs, and iFrame. Bria AI’s platform is provided with full copyright and privacy indemnity.

Contact Bria | Partner Overview | AWS Marketplace

Build a complete SOC solution with Amazon Security Lake, Splunk, and Recorded Future Autonomous Threat Operations

Kunal Sharma — Wed, 17 Jun 2026 16:02:16 +0000

By: Kunal Sharma – Sr. Solutions Architect – AWS
By: Anthony Henry – Sr. Account Manager – AWS
By: Jon Hall – Principal Architect – Recorded Future
By: Robert Rossetti – Partner Engineer – Splunk

It’s 2:00 AM and you’re a SOC analyst triaging a suspicious sign-in alert, manually searching across five consoles to determine whether the activity is a real threat or a false positive. By the time the picture becomes clear, the threat actor has already moved laterally.
This detection-to-response gap is where Amazon Security Lake, Splunk Enterprise Security, and Recorded Future Autonomous Threat Operations provide a unified architecture that centralizes your security data, automates analysis, and accelerates response.

Traditional approaches use separate point solutions: a SIEM for log aggregation, threat intelligence feeds for context, and manual playbooks for response. This fragmented approach leaves gaps and creates operational inefficiencies.In this post, you learn how to solve the detection-to-response gap that leaves organizations vulnerable using Amazon Security Lake, Splunk Enterprise Security, and Recorded Future Autonomous Threat Operations. They work as a comprehensive SOC and SIEM solution that addresses the security lifecycle from detection to analysis to mitigation. Recorded Future is an AWS Partner that delivers real-time threat intelligence to help organizations defend against threat actors. Splunk is an AWS Partner that helps organizations build resilience through holistic security and observability. Specifically, you will learn:

How Amazon Security Lake centralizes and normalizes security data for consistent analysis
How Splunk Enterprise Security correlates events in real time and automates response workflows
How Recorded Future Autonomous Threat Operations enriches alerts with intelligence and standardizes threat hunting
How to implement this architecture in phases across your environment

The challenge: From detection to mitigation

Security operations teams struggle with three interconnected problems:

Disparate data resulting in incomplete visibility: Security data exists in silos across AWS services, software as a service (SaaS) applications, and on-premises systems, making comprehensive threat detection difficult.
Alert fatigue and manual inefficiency: Even when threats are detected, analysts face alert fatigue and spend hours manually correlating events and researching threat intelligence.
Response time challenges: The time between detection and response represents an operational gap that requires automation and integration to close effectively.

The solution: Unified detection, analysis, and mitigation

The integration of Amazon Security Lake, Splunk Enterprise Security, and Recorded Future Autonomous Threat Operations provides an architecture where each component directly targets one of the preceding challenges: centralizing data, automating analysis, and accelerating response. The following sections detail how each component works.

Detection: Amazon Security Lake

Amazon Security Lake automatically centralizes security data from AWS environments, SaaS providers, on-premises sources, and cloud platforms into a purpose-built data lake. The service uses the Open Cybersecurity Schema Framework (OCSF) to normalize security data from diverse sources into a consistent format.

Security Lake ingests data from AWS services such as AWS CloudTrail, Amazon GuardDuty, Amazon Inspector, VPC Flow Logs, and AWS Security Hub, along with third-party security tools. This centralized approach supports visibility across multi-account and multi-region AWS environments, reducing the gaps that threat actors target.

Analysis: Splunk Enterprise Security

Splunk Enterprise Security provides real-time analytics and AI-driven anomaly detection, and Risk-Based Alerting (RBA) on the security data flowing from Security Lake. Splunk Enterprise Security performs correlation across multiple data sources, applies User and Entity Behavior Analytics (UEBA) to detect anomalous activity, and provides interactive dashboards and advanced search capabilities for investigating events.

Splunk Enterprise Security uses RBA to accelerate the process of detecting risk in your environment. The risk analysis framework applies insights from cybersecurity frameworks such as MITRE ATT&CK, CIS 20, and NIST controls to identify the tactics and techniques observed in risky events. Doing so reduces alert volume, resulting in higher fidelity alerts.

Splunk Enterprise Security integrates with Splunk Security Orchestration, Automation, and Response (SOAR) for automated response workflows. With this integration, your security teams can define playbooks that run automatically when specific threat patterns are detected, reducing the time between detection and response.

Mitigation: Recorded Future Autonomous Threat Operations

Recorded Future Autonomous Threat Operations extends the architecture with AI-powered capabilities that autonomously hunt, detect, and prevent threats. Powered by real-time threat intelligence from 1+ million sources, the solution proactively tracks and enriches IoCs, malware, and threat actors across your environment.Autonomous Threat Operations standardizes threat hunting processes that previously required days or weeks of manual research. The solution integrates directly with Splunk, so autonomous agents operate within your existing security workflow without requiring analysts to switch between tools.

Architecture: How the components work together

The integrated architecture operates as an integrated pipeline where security data flows from detection through analysis to mitigation.

Data collection and normalization: Security Lake ingests security events from AWS services and third-party sources, normalizing them to OCSF format. With this data standardization, Splunk can analyze data consistently across supported data sources.
Real-time analysis: Splunk Enterprise Security receives normalized security data from Security Lake and performs real-time correlation, behavioral analysis, and threat detection. Splunk Enterprise Security applies machine learning models to identify anomalous patterns and generates alerts for security analysts.
Intelligence enrichment: Recorded Future automatically enriches security events with threat intelligence, providing context about indicators of compromise (IOCs), threat actor tactics, and patterns of unauthorized activity. This enrichment happens continuously without manual analyst intervention.
Automated response: When Splunk detects threats, Splunk SOAR runs automated playbooks that can isolate compromised resources, revoke credentials, block unexpected IP addresses, and initiate incident response workflows. Recorded Future Autonomous Threat Operations provides the intelligence that informs these automated decisions.

Integration benefits

This integrated solution delivers measurable improvements across your security operations.

Centralized visibility: Security Lake provides visibility across your cloud and on-premises environments, helping verify detection of security events across your configured data sources. You gain a single, normalized view of activity rather than switching between siloed tools.

Reduced analysis time: Automated threat intelligence enrichment and correlation reduce the time your analysts spend researching alerts and investigating events. If your security teams currently spend hours per alert on manual research, this integration can compress that timeline.

Faster response: Integration between Splunk SOAR and Recorded Future supports automated response to threats in seconds rather than hours. Your security teams can define playbooks that act on enriched intelligence without waiting for manual triage.

Standardized operations: Autonomous threat hunting creates consistent, repeatable processes that deliver reliable results with standard rigor and coverage every time.

Implementation approach

Organizations can implement this architecture in phases. This sequence builds each layer on the previous one, so that your team validates data flow and detection capabilities before adding automation.

Deploy Security Lake to centralize security data from AWS services and third-party sources using OCSF format.
Integrate Splunk Enterprise Security to analyze security data with real-time correlation and behavioral analytics.
Connect Recorded Future to enrich security events with threat intelligence from global sources.
Configure SOAR playbooks in Splunk to automate response actions based on threat intelligence.
Activate Autonomous Threat Operations to standardize threat hunting and proactively detect threats.

The workflow and components are shown in the following figure. You install the Recorded Future App for Splunk directly from Splunk’s app marketplace, Splunkbase. Security Lake subscribers can configure Splunk as a data consumer for real-time data flow from the centralized data lake, or search remotely with federated search. For configuration details, see the Splunk and Security Lake integration guide or Splunk Federated Search for ASL.

Figure 1: Unified SOC Solution: Detect, Analyze, Mitigate – An integrated framework for security operations powered by AWS CloudTrail, Amazon GuardDuty, Amazon Inspector, Splunk SOAR, and Recorded Future Autonomous Threat Operations

Use case: Detecting and mitigating credential misuse

A practical example demonstrates how the integrated architecture operates:

When a threat actor uses stolen credentials to access an AWS account, AWS CloudTrail logs the authentication event and Amazon GuardDuty detects the suspicious sign-in pattern. Security Lake ingests these events in OCSF format and delivers them to Splunk Enterprise Security.

Splunk Enterprise Security correlates the suspicious login with other security events, including unusual API calls and network traffic patterns. Recorded Future automatically enriches the alert with threat intelligence, identifying that the source IP address is associated with known threat actors.Based on this enriched intelligence, Splunk SOAR runs an automated playbook that suspends the affected account, revokes active sessions, isolates affected resources, and creates forensic snapshots for investigation.Following containment, an analyst can then use Autonomous Threat Operations to extend this initial investigation and run an automated threat hunt for similar activity across the analyst’s environment, surfacing additionally impacted users, assets, or persistence mechanisms that may have otherwise evaded the initial point-in-time investigation.

Transforming security from reactive to preemptive

By combining Amazon Security Lake, Splunk Enterprise Security, and Recorded Future Autonomous Threat Operations, your organization can build a complete SOC and SIEM solution that addresses the security lifecycle from detection to analysis to mitigation. Security Lake centralizes detection across your configured security data sources, Splunk Enterprise Security delivers real-time analysis with automated response capabilities, and Recorded Future provides intelligence-driven mitigation through Autonomous Threat Operations. This integrated architecture helps transform your security operations from reactive alert triage to proactive threat mitigation. By detecting threats across your environment, analyzing them with intelligence-driven context, and automating security actions, you can reduce your risk and strengthen your security posture.

Take the next step

To see this architecture in action, schedule a demo of Recorded Future Autonomous Threat Operations.

AWS Partner Spotlight

Recorded Future is an AWS Advanced Technology partner that provides real-time threat intelligence to help organizations defend against threat actors. With capabilities spanning the open web, deep web, and dark web, Recorded Future delivers actionable intelligence that security teams can use to anticipate and respond to threats.

Contact Recorded Future | Partner Overview | AWS Marketplace

Splunk is an AWS Advanced Technology Partner that helps organizations build resilience through holistic security and observability. Used by enterprises and government agencies worldwide, Splunk Enterprise Security and Splunk SOAR give security teams real-time analytics, automated response workflows, and the operational consistency needed to keep pace with evolving threats.

Contact Splunk | Partner Overview | AWS Marketplace

Agentic SaaS: Your next growth market is already here

Matt Yanchyshyn — Tue, 16 Jun 2026 15:58:05 +0000

By: Matt Yanchyshyn, VP, AWS Marketplace & Partner Services – AWS

Agentic AI represents the third major shift of enterprise software and how it creates value. The first brought applications from desktop to web and mobile, and the second moved software from on premises to cloud, creating a software as a service (SaaS) market worth $300 billion today and projected to reach $576 billion by 2029 that created enormous value for the software providers that moved early. Amazon Web Services (AWS) has been at the center of both, and this post explains how we can again support software providers on capturing the agentic opportunity through capabilities, distribution, and commercial models.

Users are increasingly interacting with software through AI assistants and agentic platforms that invoke capabilities on their behalf instead of the product’s own UI. Your product is still doing the work, but the user might never see it. The buying journey has changed too because the decision-making for technology is no longer owned solely by IT or engineering. Business users from human resources (HR), legal, finance, and other functions know what they need, and they’re buying it themselves. This era also brings an entirely new class of users: autonomous agents that reason, plan, and execute multistep tasks with minimal human intervention. All of this makes agentic AI an expansion of the addressable market, with new distribution channels that operate at machine speed at any hour, not a threat to existing revenue.

Agentic AI represents an evolution from software that users operate to capabilities that agentic systems execute, changing how software is built, priced, distributed, and consumed. Agents and humans alike are already choosing preferred providers based on discoverability and reliability. Your customers are building agentic systems today, and those systems will use your capabilities if they can find them, understand them, and trust them . . . or they’ll route around you.

What “Agentic SaaS” actually means

Agentic AI isn’t killing SaaS, it’s transforming it following similar patterns we’ve seen and pioneered before. Your product capabilities, your domain expertise, your customer relationships, your data moats, and decades of accumulated domain expertise don’t become less valuable in an agentic world. They provide the trusted, reliable, and well-described capabilities agents need to solve industry challenges. Agentic SaaS is the next evolution of software that’s now consumed by a hybrid workforce of both humans and agents and a growth opportunity for software providers that act today. The window for independent software vendors (ISVs) to act is measured in months, not years.

Build for agentic systems: Make current SaaS capabilities consumable by agentic systems and build your own agents for high-value workflows

This evolution doesn’t require a radical departure from SaaS engineering fundamentals. Multi-tenancy, tenant isolation, scale, security, observability, and governance remain the table stakes that enterprise buyers evaluate before any production deployment. What changes is the execution model. Agents operate autonomously, maintain complex state across sessions that can span hours, coordinate across tool chains and subagents. And they must enforce the compliance and authorization boundaries that you establish without getting you in the loop again. Most organizations build and rebuild these primitives for every framework, model, and use case change. That’s months of infrastructure work before a single agent reaches a real user.

AWS solved this at scale so you don’t have to solve it every time, and we did it based on lessons learned from implementing AI at scale for our own products. Amazon Bedrock AgentCore is our hero platform for taking agents from prototype to production. It brings runtime isolation, memory, identity, gateway, policy, and observability together and fully integrated with the rest of the AWS stack. Agent capability without accuracy is a liability, and this integration between infrastructure, model, platform, and data foundation layers enables your agents to be grounded in your proprietary data. Automated reasoning is the safety layer for the agentic era, proving mathematically that agents stay within defined boundaries, and our platform uses it to block unauthorized actions that violate policies and to enforce tool access. Security is built in by design, with network isolation and fine-grained authorization, and AWS industry certifications providing the foundation to reduce the compliance burden for your agentic deployments.

Customer adoption of agentic AI tools and features is accelerating, and we’re seeing this in the growth of AI agents and tools in AWS Marketplace. This fast-growing category went from 900 solutions at launch to over 3,300 in less than a year. Most are not standalone agents, they’re existing SaaS products that have been agentified, extending proven software to work inside agentic workflows.

The results speak for themselves:

Agentforce, Salesforce’s enterprise agentic AI solution available in AWS Marketplace, uses foundation models (FMs) through Amazon Bedrock, implemented natively on AWS Global Infrastructure, to deliver faster, smarter resolutions for customers.
CrowdStrike is deploying autonomous security agents that detect and remediate threats without human intervention.
Workday built a sales companion on AWS, an AI-powered solution that condenses structured and unstructured data to surface product intelligence for sales teams in real time, delivering a 75% reduction in sales prospecting cycle time and saving 5 hours per sales rep per week.
Zendesk customers use Amazon Bedrock and Amazon Connect to automate 80% of customer service interactions.
Druva built DruAI with Amazon Bedrock and AgentCore, transforming cyber investigations that previously took 30–60 days into minutes-long conversational workflows, with the multi-agent system now resolving 68% of customer issues without manual intervention.

These aren’t incremental features. These are companies rethinking what their software does and who uses it.

Design for agentic discoverability: Position your solutions to be found and chosen when agents select tools

Agents interact with software through APIs and structured interfaces in a similar way developers do. But although humans navigate UIs and evaluate feature lists, agents select tools based on structured metadata and natural language descriptions. Agentic discoverability is the new distribution, defined by the degree to which AI agents can find, understand, and choose to invoke your capabilities. Whereas human distribution channels reward brand familiarity and sales reach, agent selection rewards technical precision, which makes the architecture and descriptions of your product the most powerful go-to-market asset.Investing in agentic discoverability isn’t solving a one-time technical configuration. It’s building the equivalent of early domain authority, an agent selection advantage that compounds over time. While building a shopping assistant that selects from hundreds to thousands of internal tools per session, engineering teams at Amazon found that defining structured schemas and precise semantic descriptions for each tool was the central engineering challenge. The agent’s ability to identify and invoke the right tool depends directly on the quality of those descriptions.

The Model Context Protocol (MCP) has emerged as the industry standard for making capabilities discoverable to agents, doing for agentic capabilities what REST APIs did for web applications: make them discoverable, composable, and invokable across any agent runtime. The Agent2Agent (A2A) protocol complements MCP for cross-agent discovery: where MCP handles agent-to-tool invocation, A2A handles agent-to-agent delegation, with structured metadata describing the agent’s capabilities and interface. Supporting both protocols in your solutions maximizes the probability that agents in your domain will find and use your solution rather than a competitor’s.

Salesforce continues to lead the charge with the recent introduction of Headless 360, which makes all its capabilities accessible to agents and humans alike using APIs, MCP tools, or command line interface (CLI) commands. The surface changes, but the platform and its capabilities don’t.

AWS provides MCP and A2A support across the full stack. On the backend, you can provide an immediate agentic surface for your current capabilities without requiring rewrites converting REST APIs and serverless functions into MCP tools with Amazon Bedrock AgentCore Gateway. On the distribution front, AWS Marketplace supports listing both MCP and A2A servers, making your tools and entire agents discoverable within agentic workflows.

For customers already transacting through AWS, this removes the friction of a new vendor relationship and accelerates procurement. Agents can also interface with AWS Marketplace using agent mode through our own MCP server and a native connector available in Anthropic’s Claude, querying AWS Marketplace directly or interfacing to find solutions based on needs and problem descriptions, not keyword searches. And we’re not only building this for partners. We built the AWS Partner Central agent experience using Amazon Bedrock and AgentCore, complementing the AWS Partner Central application used by thousands of partners every day. The platform we’re providing for you to build on is the same one AWS uses to build with.

Align pricing to value: Capture the measurable outcomes that agentic usage creates

Agents create measurable, attributable business value in units that per-seat pricing was never designed to capture: a customer support agent resolving 10,000 tickets overnight, an invoice processing agent handling 50,000 lines without human review, a network monitoring agent running around the clock. Leading SaaS vendors have already begun building commercial models that capture this value, and the consistent pattern is a hybrid model: predictable base revenue from humans combined with consumption-based upside from agent usage, not a replacement of one model for the other.

The practical prerequisite is instrumentation because it provides you with powerful data to understand and show your customers precisely what their agents consumed, what outcomes they produced, and what the unit economics look like. Having the most granular outcome data will help you define pricing metrics for your category instead of matching what your competitors are pushing. This is where observability becomes a commercial capability, not merely an operational one. The ability to trace agent sessions, tool invocation, and resolution events and then map those traces to billable units is the foundation for consumption pricing.

AgentCore provides this instrumentation inherently, with built-in observability that tracks agent execution. AWS Marketplace then closes the commercial loop with support for pay-per-outcome pricing structures and private offer negotiation, so you can establish hybrid pricing models through the same channel that already distributes your existing software, without a new billing platform or a new sales motion.

Zendesk, a leader in AI-powered customer service, used AWS Marketplace to shift from per-seat licensing to outcome-based pricing where customers pay for results, such as tickets resolved. The flexible pricing infrastructure of AWS Marketplace made the transition possible without rebuilding their commercialization stack.

Build the agentic era on AWS

AWS has helped software providers navigate every major platform shift and succeed for the past two decades, and this one is no different. We provide both the platform and expertise to architect for this next generation of software solutions, supporting you to evolve from SaaS products to Agentic SaaS solutions and start winning your category today.

AWS is investing in every layer of the AI stack so you don’t have to, from custom silicon and foundation models to agentic platforms and solutions. We also launched several new programs and initiatives this year to help you make this transition, including expanding the AWS Migration Acceleration Program to cover AI-based new builds, growing AWS ISV Accelerate to support partners engaged in co-sell activities, and investing an additional $100 million in the Generative AI Innovation Center for hands-on support building and deploying agentic AI applications.

Your next growth market is already here, and it won’t wait too long. Get started today with our learning series for building agentic systems on AWS.

Sell smarter with AWS: New agentic capabilities accelerate time to revenue

Tom Thayer — Tue, 16 Jun 2026 14:16:55 +0000

By Tom Thayer, Global Leader, ACE Program – AWS
By Raj Kandaswamy, Principal PMT – AWS

AI is fundamentally changing how sales teams operate, reducing time spent on operational tasks and freeing them to focus on what matters most: building relationships and delivering customer outcomes.

Building on the AWS Partner Central agentic experience launched in March, we’re introducing new capabilities that support you at every stage of selling—from identifying the right leads and creating stronger opportunities to getting real-time insights and selling support on every deal you share with Amazon Web Services (AWS).

In this post, we’ll walk you through how these new capabilities help you build a stronger pipeline, accelerate deal progression, and get real-time qualification and guidance on every opportunity.

Drive stronger pipeline with propensity insights

A healthy pipeline is the foundation of sales success, but not all leads are created equal. When you know which prospects have the highest propensity to buy, you can focus your time on the right opportunities and move faster from outreach to close.

Partners can now submit marketing and sales leads in AWS Partner Central to receive propensity insights that increase lead conversion. This new feature helps you build a stronger pipeline by focusing on the leads most likely to convert. Submit your own leads and receive:

Propensity insights to prioritize outreach on leads with the highest likelihood of conversion.
Recommendations on which leads are eligible for programs, funding benefits, and sales motions.

These insights are only the beginning. Upcoming enhancements will include tailored sales messaging, like sales plays, call scripts, and email templates to support your outreach.

Figure 1 – View propensity insights, program eligibility, and recommended next steps for each lead you submit.

Once you’ve nurtured your strongest leads, you’re ready to create opportunities in ACE (APN Customer Engagements) with real-time selling support to help you close deals faster.

Accelerate deal progression with meaningful engagement on every opportunity

Partners told us they need faster, higher-quality engagement on co-sell submissions to increase deal velocity and reclaim time for strategic customer conversations. With 65% of Partners reporting higher close rates and 54% seeing larger deals as a result of co-sell motions (Canalys, 2024), we’re making selling with AWS faster, smarter, and more actionable on every opportunity.

To help you reduce sales cycles and accelerate time to revenue, every opportunity you submit through ACE now gets data-driven insights and real-time support. With these enhancements, you can:

Get selling support on every opportunity: Data-driven insights and tailored recommendations from the agent to keep your deals progressing.
Accelerate deal progression: Whether co-selling with AWS or progressing with agent support, you keep deals moving with sales plays, customer insights, funding eligibility, and resources to help you close.

Getting started is simple. To create an opportunity, describe a deal in plain language, upload meeting notes or a proposal, or clone an existing opportunity. Coordination happens automatically: the agent initiates workflows on your behalf, pre-populating available data, validating details, and populating customer information, so your team spends time on decisions, not data entry.

Get real-time qualification and opportunity insights

When you submit an opportunity in ACE, the agent qualifies it in real-time and delivers tailored guidance on where the opportunity stands, what actions to take, and recommendations to progress the deal.

Every opportunity receives 24/7 agent support and is matched to a co-sell motion based on the data in your submission:

AWS Field-engaged: Your opportunity is ready and matched with an AWS sales team for direct collaboration.
Agent-engaged: Your opportunity is qualified by the agent, with actionable insights to strengthen your submission and increase the likelihood of AWS sales team engagement.
Partner-led: You have 24/7 agent support, including sales plays, customer insights, and resources, to help you close faster, while you own and drive the opportunity.

Each opportunity also receives an Opportunity Quality Score, a data-driven indicator of how well your submission aligns with what drives successful co-selling. This score is a key input into which co-sell motion your opportunity receives. The agent provides recommendations to improve your score on every opportunity, giving you a clear path to strengthen your submission and increase engagement from AWS.

AWS sellers see this score as well. As your Opportunity Quality Score increases, so does the likelihood of direct engagement with AWS sales team.

Opportunities are continuously rescored as you improve your submission data. As you add detail, refine your business case, or update deal context, the score recalculates in real time. For Agent-engaged opportunities, this can move you closer to AWS Field-engaged as your score strengthens.

Figure 2 – Get data-driven insights on where your deal stands and specific recommendations to strengthen your submission.

We’re also extending Express Private Offers to accelerate co-sell deals by automating custom pricing deals directly to AWS Marketplace customers. When you enable Express Private Offers on your product, an AWS sales representative can identify your solution as the right fit for a customer and invite the customer to receive personalized pricing. You gain direct engagement with high-purchase intent customers, and deals close faster because the friction is eliminated.

Maximize your Opportunity Quality Score

To strengthen your score, focus on these actions:

Be specific in your opportunity description: Include the customer use case, desired business outcome, and relevant AWS services.
Keep your data current: Regularly update the opportunity stage, next steps, estimated revenue, and ensure correct industry and use-case tagging.
Tag your solutions and AWS products: Attach your AWS Partner Solutions and list the AWS services involved in delivery. This helps the agent match your opportunity to the right engagement motion.
Assign the correct sales team member: Insights and recommendations are delivered directly to the seller on the opportunity. Make sure the right person is listed so they can act immediately.

Figure 3 – Chat with the agent to get recommendations on strengthening your score.

Connect agents to your existing tools

Engage directly with agents in AWS Partner Central for real-time guidance and next-step recommendations. You can also connect your existing tools and systems directly to agents with the MCP Server—bringing AWS intelligence into the workflows your teams already use.

Explore automation and integration options >>

Partner testimonial

“The agentic co-sell experience provides the right level of AWS engagement without taking over account management from our reseller network,” said Danny Banks, Technical Director, Business Development at WatchGuard. “The agent enables us to advance opportunities more efficiently while continuing to refine qualification processes, which will ultimately result in better-aligned, higher-quality engagements. Strengthening co-sell engagement with AWS sellers remains our ultimate objective, and these agentic capabilities guide us on that path to ensure the highest level of service and value for our shared customers.”

Get started

Submit your leads and receive propensity insights to build your pipeline, create and manage opportunities with agent support, and get real-time recommendations to strengthen and progress every deal.

Agents are available today for Partners who have migrated to AWS Partner Central in the AWS Console.

Here’s how to get started:

Migrate to the AWS Partner Central experience in the AWS Console if you haven’t already. For step-by-step guidance, review the Migration Guide.
New Partners: Register as an AWS Partner in the AWS Console. Agentic capabilities can help you go from registration to ready-to-sell in days. Learn more >>

More agentic capabilities are coming to support Partners at every stage of their journey, from pipeline to close.

New agentic capabilities to take you from registered to ready-to-sell in days

Jen Letourneau — Tue, 16 Jun 2026 14:16:28 +0000

By Jen Letourneau, Global Leader, Partner Journey – AWS
By Payal Patel, Specialization Program Onboarding Manager – AWS
By Keren Bar Lev, AWS Marketplace Seller Innovation Manager – AWS

Whether you’ve just registered as an AWS Partner or you’re ready to list your first solution in AWS Marketplace, the goal is the same: get to market fast. Partners shared that they want to spend less time on operational steps and more time on what matters most—reaching customers and growing their business.

A Forrester Consulting report found that channel Partners who build and scale an AWS Marketplace practice can realize 234% ROI, 50% faster deal closure, and 4–5× richer deal sizes compared to traditional channels.

To accelerate time-to-revenue through AWS Marketplace, we’re expanding agentic capabilities in AWS Partner Central that take Partners from registration to ready-to-sell in days. From automated profile creation and personalized guidance for seller account setup to AWS Marketplace listing optimization, PRM readiness, and streamlined FTR validation, Partners can now unlock badging, benefits, and funding faster.

Create your profile and set up your seller account in minutes

Getting started as a Partner used to mean manually entering company details and configuring account settings. Now, your profile is pre-filled from your company website—including description, logo, locations, and industry focus—and shared with you for review.

The agent also recommends your account structure based on where you sell and guides you through tax, compliance, and payment setup—so you’re ready to transact and start reaching customers sooner.

Figure 1 – Select from the prompts to engage the agent.

Explore the demo.

Generate your AWS Marketplace listing content from your website

Publishing an AWS Marketplace listing is a key milestone for Partners looking to reach AWS customers at scale. Your website content is transformed into a complete, publish-ready listing—with product descriptions, features, use cases, and proper categorization—in minutes. Already have an AWS Marketplace listing? Get recommendations to refresh and optimize it for better discoverability.

Listings are structured with relevant keywords and categories that help customers find your solution faster.

Figure 2 – Chat with the agent to create or optimize your AWS Marketplace listing in minutes.

Once your listing is published, get guidance on setting up Partner Revenue Measurement so you can unlock revenue insights that inform your growth strategy.

Ready to list? The AWS Marketplace List & Sell Incentive offsets the cost—whether it’s your first listing, expanding to a new country, or adding self-service buying features.

You can also bring the buying experience directly to your customers from your website. AWS Marketplace Storefront lets you create a curated, branded catalog that showcases your complete solution portfolio. Transaction flows through AWS Marketplace and appears automatically on customers’ AWS invoices, giving buyers the consolidated billing and procurement simplicity they expect—while you maintain full brand ownership of the experience.

Set up and launch your storefront quickly, connect it to your CRM and IT systems through pre-built connectors or the AWS Partner Central API, and begin capturing inbound leads that flow directly into your co-sell pipeline with AWS.

Explore the demo: Create a new listing | Optimize an existing listing

Streamline your Foundational Technical Review

Validating your software solutions unlocks badging, program eligibility, and funding benefits. Now there’s a faster path to get there.

Submit existing SOC2 audit reports or completed AWS Well-Architected Framework reviews to complete the Foundational Technical Review. You’ll receive approval or actionable feedback in minutes, so you can iterate quickly and unlock benefits sooner.

Explore the de mo.

Connect agents to your existing tools

Access agents directly through the AWS Partner Central homepage. If you don’t complete all steps in one session, you’ll see exactly what remains so you can pick up where you left off.

You can also bring these capabilities into your CRM via the AWS Partner Central MCP server, directly or through Partner integrators. Your teams get AWS insights in the tools your teams already use every day—eliminating context-switching and keeping sellers focused on deals.

To help offset the cost of integrating these workflows, the Automation Incentive supports system integration and agentic workflows, unlocking real-time pipeline insights and saving hours of manual work.

What Partners are saying

Partners are seeing the timeline from registered to actively selling collapse from weeks to days.

“Partner Central agents accelerated our onboarding and co-sell motion by at least 10x,” shared Sujaiy Shiv, Founder & President at inferdat.ai. “It has completely removed the ambiguity and manual overhead that used to slow us down. The time we’re not spending navigating Partner Central is time we’re spending helping customers get gen AI into production.”

That speed extends to listing quality at scale: “The AWS Marketplace listing feature will be a real gamechanger as we roll out centralized listing-quality guidance across all of our many AWS Marketplace product listings,” said Sarah Dunworth, Program Director of SaaS Operations at IBM.“We’ll be able to easily identify quality issues and provide guidance and recommendations to the product teams, which will save them a lot of time and effort.”

For some Partners, the impact was immediate. “We were able to review our profile, ensure we were set up correctly, ask the agent follow up questions as we progressed and effectively launched four separate AWS Marketplace listings within 1 hour,” shared Mike Salazar, Co-founder & CEO of Nimbus Value. “This was critical for our company launch the next day and we leveraged it for a customer conversion three days later.”

“The AWS Marketplace listing feature transforms AWS Marketplace listing creation from a time-intensive process into a streamlined experience completed in minutes”, shared Drew Jenkins, VP of Strategic Alliances at Opti9.

And Partners are already extending these capabilities into their own workflows.

“We’re excited to integrate this agent directly into Slack and Teams so teams can get clear, contextual next steps and recommendations that help improve their AWS presence faster,” said TJ Laher, CEO of PartnerPlex AI.

Eric Gourmelen, VP, CTO Cloud & AI at Arrow ECS, said “By integrating AWS Partner Central Agents with ArrowSphere Assistant, we’re making the journey faster, simpler, and more actionable.”

Get started

The path from registered to revenue-ready now takes days. These capabilities are available in the new AWS Partner Central experience.

Here’s how to get started:

Migrate to the AWS Partner Central experience in the AWS Console if you haven’t already. Review the Migration Guide for step-by-step guidance.
Create or optimize your AWS Marketplace listing and implement PRM to unlock revenue insights.
Connect your CRM through the AWS Partner Central MCP server to bring automation into the tools your team already uses. Explore automation and integration options >>

We’re continuing to expand agentic capabilities that help Partners move faster at every stage. Learn how we’re making selling with AWS smarter.

From legacy to AI-powered: Transform your customer experience with Amazon Connect Customer Competency Partners

Lawrence Tse — Tue, 16 Jun 2026 14:06:31 +0000

By Lawrence Tse, Amazon Connect Customer Designation Owner – AWS
By Yoona Lee, Applied AI Solutions GTM Acceleration Lead – AWS
By Kelly Costlow, AWS Specializations Partner Program Lead – AWS

Today’s customers expect seamless, personalized brand experiences at every touchpoint—but legacy contact centers fall short. They rely on queues, manual routing, and handle-time metrics as control mechanisms, with AI added as a separate layer rather than built in from the start.

The data confirms the business impact. According to PwC’s 2025 Customer Experience Survey, 29% of consumers say they stopped using or buying from a brand due to poor customer experience, either online or in-person.

That’s why we’re excited to announce the Amazon Connect Customer Competency, which helps customers identify Partner solutions to transform their enterprise-wide customer experience on Amazon Web Services (AWS).

This new AWS Specialization recognizes Services Partners with technical depth and proven success on Amazon Connect Customer—from migrating legacy contact centers to operationalizing AI at scale.

Amazon Connect Customer provides a unified, AI-native solution spanning voice, chat, email, SMS, and social. Teams shift from managing queues to building loyalty, with enterprise-grade observability to move AI from pilot to production with confidence.

This is the first AWS Competency directly aligned to an AWS service, launching with two categories that reflect the accelerating shift toward AI-native customer experiences: Contact Center Transformation and AI-Powered Customer Experience.

“Customer experience is shifting from reactive to predictive, and organizations need Partners who can move at that pace,” said Sara Caleffi, Director, Applied AI Solutions GTM at AWS. “The Competency gives customers the confidence they’re working with Partners who have the expertise to deliver that transformation at scale.”

In this blog, we’ll cover the two categories, new benefits for Partners, and how to get started.

Competency categories

Amazon Connect Customer Competency Partner solutions are validated by AWS experts across two categories:

Contact Center Transformation: Transform legacy contact center environments by migrating organizations from on-premises or cloud-based systems to a modern, AI-powered customer experience on Amazon Connect Customer. Deliver end-to-end transformation using structured methodologies from discovery through post-migration optimization, enabling AI features as part of the migration to drive measurable improvement over the legacy environment.
AI-Powered Customer Experience: Design, build, and operate intelligent customer experiences using Amazon Connect Customer’s AI capabilities, including autonomous AI agents, conversational AI, agent and manager assist, and multi-channel self-service. Resolve customer issues at scale, augment human agents, and continuously improve outcomes through AI-driven insights while maintaining rigorous governance, observability, and testing practices.

New benefits for Amazon Connect Customer Competency Partners

We’re increasing our investment in Partners’ success through the following key initiatives:

Additional Marketing Development Funds – Receive $50K in Marketing Development Funds (MDF) in 2026 and 2027 for achieving the Amazon Connect Customer Competency.
AWS Migration Acceleration Program funding – Unlock funding to offset customer migration costs.
AWS PartnerEquip: Live Amazon Connect Track – Access strategic and confidential content, including product roadmaps, feature release previews, and demos, as part of the AWS PartnerEquip event series. To attend live events in your region or tune in virtually, register for an upcoming session.
Signature benefits – Receive dedicated co-selling support, private strategy sessions, and AWS guest speaker support at Partner-led customer events.

To learn more, review the AWS Specialization Program Benefits Guide in AWS Partner Central (login required).

Launch Partners

The AWS Competency Program is designed to highlight AWS Partners who have demonstrated technical proficiency and proven customer success in specialized solution areas.

We invite you to explore the following Amazon Connect Customer Competency launch Partner solutions recommended by AWS:

Contact Center Transformation

Accenture
Caylent
Deloitte
Genpact
Infosys Ltd
NeuraFlash
NTT DATA Inc.
PricewaterhouseCoopers
Pronetx, Inc.
Salesforce
TTEC Digital
USAN
Zendesk

Success story

Partners are already helping customers close the gap between AI investment and measurable business outcomes on Amazon Connect Customer.

Pronetx helped New York Cancer & Blood Specialists replace 30,000+ manual calls monthly with an AI-powered contact center on Amazon Connect Customer—increasing patient enrollments by 54% in 8 weeks.

Read the full case study

Customers: Work with an Amazon Connect Customer Competency Partner

Amazon Connect Customer Competency Partners offer purpose-built contact center transformation and AI-powered customer experience services to help you modernize your customer experience operations—ensuring seamless, personalized interactions at every touchpoint.

Discover solutions and connect with validated Amazon Connect Customer Competency Partners or explore solutions listed in AWS Marketplace.

Partners: Become an Amazon Connect Customer Competency

AWS Partners looking to get their solutions validated through the AWS Specialization Program must be validated or differentiated members of the Services Path prior to applying. This AWS Competency replaces the Amazon Connect Service Delivery designation, which will be deprecated on June 1, 2027.

Ready to apply? Review the Specialization Partner Program Guide for instructions on how to apply in AWS Partner Central (login required).

Accelerate customer outcomes with the AWS Business Value Realization motion

Bhargs Srivathsan — Tue, 16 Jun 2026 14:06:03 +0000

By Bhargs Srivathsan, Director Customer Success Center of Excellence – AWS
By Cynthia Starr, Sr. Manager, Partner Led Customer Success – AWS
By Zehra Ladiwala, Partner CS Development Manager – AWS

AI is reshaping the technology landscape at a pace we’ve never seen before, and with it, the bar for what customers expect from their Partners has shifted. It’s no longer enough to deploy the right technology, customers want Partners who understand their business, align to their goals, and can demonstrate real, measurable impact from their Amazon Web Services (AWS) investments.

The data reinforces this. According to a 2026 AWS Market Study, 80% of customers interviewed are moving toward outcome-based commercial models. To help Services Partners meet this shift, we’re introducing the Business Value Realization (BVR) motion, which provides funding, enablement resources, and specialized support to lead post-sales customer success.

Partners who demonstrate excellence in driving customer outcomes can earn the AWS BVR Competency, a new AWS Specialization that unlocks the full suite of BVR motion benefits and serves as a powerful differentiator in the market.

“Customers are investing significantly in technology, but many aren’t yet seeing the full return,” said Bhargs Srivathsan, Director, Customer Success Center of Excellence at AWS. “That gap is exactly what the Business Value Realization motion is designed to close from defining what success looks like in business terms to proving it with the AWS BVR Competency, which recognizes Partners with the demonstrated success and deep expertise to deliver real outcomes.”

In this blog, we’ll share the market data behind the BVR motion, the benefits available to Partners who achieve the BVR Competency, and early results from Partners already putting it into practice.

Market study: How Customer Success and a Focus on Value Realization Set Winning Consulting Partners Apart

A 2026 AWS Market Study examined how Services Partners are investing in customer success capabilities and what it means for their bottom line. Across Partner segments, the data shows a clear correlation between customer success maturity and financial performance:

$3.50 in gross profit for every dollar invested in customer success over five years, with 79% breaking even within two years.
Four Partner archetypes emerged based on customer success maturity—from Implementation Boutiques to End-to-End Transformation Leaders—with most Partners falling somewhere in the middle.
Returns rise sharply with maturity – from $2.70 to $3.90 across the spectrum, with the most advanced Partners seeing 10-11% revenue growth and 6-7 percentage point margin expansion over three years.
Customers pay up to a 20% premium for proven customer success capabilities, specifically value mapping, change management, and outcome tracking.

Benchmark your customer success maturity and see where you stand. Read the full study >>

Benefits

The AWS BVR Competency is the key that unlocks the full BVR motion—giving you access to funding, enablement, and specialized support designed to help you build and scale customer success practices.

Business Value Realization Toolkit: Execute customer success engagements at scale with domain and industry-specific market intelligence, benchmarks, value drivers, and business case models, plus ready-to-use templates for value realization planning and business value calculations across today’s most relevant enterprise AI transformation use cases.
Funding: Unlock funding tied to customer outcomes, not just delivery milestones, with automated requests through AWS Partner Central so you can focus on execution.
Enablement: Accelerate team readiness through domain-specific adoption playbooks, immersive BVR-focused hands-on workshops, and self-service learning on AWS Skill Builder, covering the BVR approach, Business Value Realization Plans, post-sales engagement, and change management.
Partner Success Specialists support: Access specialized post-sales support to build and scale customer success capabilities, from operationalizing success frameworks to establishing repeatable practices and applying AWS best practices for post-launch adoption.

In addition to these benefits, the new agentic capabilities in AWS Partner Central support you through the post-sales journey, including automated milestone tracking and intelligent notifications as engagements progress through each phase.

AWS Business Value Realization Competency

The AWS BVR Competency recognizes Partners who excel at helping customers define, measure, and achieve business outcomes from their cloud investments. It signals to customers that you have the leadership commitment, enabled teams, and proven track record to deliver measurable outcomes beyond technical implementations.

In addition to the AWS Specialization Program and BVR motion benefits, BVR Competency Partners receive $50K in Marketing Development Funds (MDF) in 2026 and 2027. They also gain visibility with the AWS Specialization badge, priority placement in Partner Solutions Finder, and enhanced presence in customer-facing channels.

To learn more, review the AWS Specialization Program Benefits Guide in AWS Partner Central (login required).

Launch Partners

We invite you to explore the following AWS BVR Competency launch Partners recommended by AWS:

Success stories

Early results from pilot Partners demonstrate the impact of BVR in action.

Tower Insurance and Deloitte
Deloitte helped Tower Insurance move from pilot to production in 10 weeks—achieving a 26% improvement in call handling time, 18% faster email handling, and 8,200 agent hours freed up.

“In just 10 weeks, Tower demonstrated that AI-driven experiences can be delivered at pace, with stability, strong governance, and real business impact,” said Kylie Bryant, Partner at Deloitte.

Read the story

Promptly and DoiT

DoiT helped Promptly consolidate fragmented data and build AI-powered experiences for patients and staff—with Amazon Q Developer now accounting for 30-40% of code written and a 25% improvement in development speed.

“Anyone from any department can get the information they need quickly, easily, and efficiently using AI agents,” said Dr. Anish Kapur, CEO and Founder at Promptly.

Read the story

United Express and Caylent

Caylent helped United Express build an agentic AI observability solution for its critical weight and balance system—delivering a 90% improvement in mean time to detect and resolve issues and saving 336 hours of manual log analysis monthly.

“The quicker we can identify issues, the quicker we can fix or prevent them to deliver excellent customer service in the moments that matter most,” said Thomas Jacobs, Product Owner at United Express.

Read the story

Get started

Whether you’re formalizing existing customer success capabilities or building them from the ground up, the BVR motion gives you a clear path forward. Here’s how to get started:

Achieve the BVR Competency: Review the Program Guide and BVR learning requirements, and access the application in AWS Partner Central (login required).
Unlock BVR benefits: Once you’ve achieved the Competency, nominate qualifying customer engagements to access funding, dedicated support, and resources.

How Public AI delivers sovereign LLM inference on AWS and Intel

Nicolas Jourdan — Mon, 15 Jun 2026 15:29:38 +0000

by: Nicolas Jourdan, Sr. Specialist Solutions Architect AI/ML – AWS
by: Diego Bailón Humpert, Global AWS Data & AI/ML GTM Lead – Intel
by: Malte Reimann, Solutions Architect – AWS
by: Joshua Tan, Product Lead – Public AI

Intel

When research institutions release open-weight large language models (LLMs), their work is largely done. The weights land on services such as Hugging Face, the paper gets published, and the team moves to the next project. But for the businesses and public institutions that want to actually use these models, the work is only beginning. They need API endpoints, auto scaling infrastructure, and integration paths that no research lab is set up to provide.

This gap is showing up everywhere sovereign AI is being built. National initiatives such as Swiss AI train multilingual models, AI Singapore builds Southeast Asian language models, and the Allen Institute for AI (Ai2) releases models with open weights, training code, and training data. Each publishes weights and research, but none operates production inference services. That isn’t their mission.

The Public AI Inference Utility (IU) has changed that. It deploys sovereign open-weight models on Amazon Elastic Compute Cloud (Amazon EC2) instances powered by Intel processors, exposing public inference endpoints so organizations can test and integrate these models without provisioning their own infrastructure. Amazon Web Services (AWS) provided the managed infrastructure to launch quickly within Swiss jurisdiction; Intel-powered EC2 instances made the architecture cost-effective enough to replicate across other sovereign initiatives.

In this post, we walk through how Public AI built a production inference platform on Amazon Elastic Kubernetes Service (Amazon EKS) and Intel-powered EC2 instances for the Apertus model launch, and why that architecture is replicable for other sovereign LLM initiatives.

“Training the model was our contribution to open AI research. AWS makes our innovation easily accessible to any organization that can now run our model privately on AWS global infrastructure.” — Martin Jaggi, Associate Professor at EPFL and Head of Machine Learning and Optimization Laboratory

What is Public AI?

Public AI is a global initiative to build AI as public infrastructure, open, auditable, and governed in the public interest. It brings together governments, research institutions, and open source communities to deploy sovereign AI systems that are accessible and transparent.

The Public AI Inference Utility is the operational core of this vision: a distributed inference layer that aggregates compute from partners (including national labs, cloud providers, and public institutions) and exposes it through a unified API and chat interface. By pooling infrastructure and demand across jurisdictions, the IU reduces duplication, improves utilization, and provides a viable alternative to closed AI ecosystems. In practice, it allows newly released open-weight models to be served reliably at scale while preserving data privacy and enabling local governance.

Why Public AI chose AWS

Public AI is the international launch partner of the Swiss AI initiative, providing inference access to the Apertus model family, Switzerland’s first large-scale, fully open, multilingual LLM developed by EPFL, ETH Zurich, and the Swiss National Supercomputing Centre (CSCS). A publicly accessible inference endpoint is essential for newly released models: companies, public institutions, and developers want hands-on experience with a model before committing to their own hosting on services such as Amazon SageMaker AI.

As a nonprofit, open-source community with lean engineering resources, Public AI faced a demanding launch. The Apertus release was expected to draw thousands of concurrent users at peak, and popular open source inference stacks such as vLLM didn’t support the Apertus architecture until only weeks before the model release. The goal was clear: deliver a scalable inference interface (both a chat-style UI for broad accessibility and an API for developers) within a narrow timeline.

AWS provided the infrastructure foundation and hands-on expertise to make this possible. Early in the process, AWS solutions architects and specialists worked with the Public AI team on enablement sessions, reference architectures, and guidance on service selection. Together, they built a production stack in the AWS Europe (Zurich) – eu-central-2 Region, which kept inference workloads and user data within Swiss jurisdiction, a key requirement for sovereign AI deployment.

The architecture is a fully containerized stack on Amazon EKS Auto Mode, designed so a single inference request flows cleanly from user to model and back:

Entry – End users reach a hosted Open WebUI chat interface; developers connect through an API gateway. Both paths are protected by AWS WAF, with Amazon CloudFront fronting the chat interface.
Authentication – Amazon Cognito handles user identity and access for both interfaces.
Routing and inference – Requests are routed through a gateway layer to auto scaling vLLM deployments. The Apertus 8B variant runs on Intel-powered Amazon EC2 R8i instances; the larger 70B variant runs on GPU-powered instances. Check the Amazon EKS best practices guide for CPU inference to dive deeper.
Responsible AI – Amazon Bedrock Guardrails enforces safety policies including blocking of prohibited topics across both model variants inline with each request.
State and storage – Amazon Aurora Serverless v2 PostgreSQL-Compatible Edition handles persistent data, Amazon ElastiCache for Valkey provides caching, Amazon Simple Storage Service (Amazon S3) stores objects, and Amazon Elastic File System (Amazon EFS) shares files across pods. Container images are managed in Amazon Elastic Container Registry (Amazon ECR).

This architecture, shown in the following diagram, gives Public AI what a sovereign, nonprofit inference provider needs most: the ability to go from zero to production scale quickly within a specific jurisdiction, scale with demand, and operate reliably, without building or managing physical infrastructure.

Figure 1: Solution Architecture

How Intel provides choice for sovereign inference

With the Apertus deployment running, Public AI turned to the next challenge: how to scale from one model in one country to many sovereign LLMs across many jurisdictions. That requires an inference platform that is cost-effective for budget-conscious research institutes, built on open source software to provide transparency, and available in every region where sovereign models need to run.

Intel-powered EC2 instances meet all three requirements. Intel Xeon processors are available across the full spectrum of AWS deployment options: AWS Regions worldwide, AWS Local Zones for low-latency metropolitan deployments, and AWS Outposts for on-premises workloads that must remain within national boundaries. This broad availability means Public AI can replicate its inference architecture in new jurisdictions without re-engineering the stack. Each European research institute can select the deployment model that fits its sovereignty, latency, and regulatory requirements while running the same Intel Xeon-based infrastructure underneath.

For smaller language models—the 8B-parameter class that many sovereign initiatives produce—Intel-powered EC2 R8i instances offer a cost-effective alternative to specialized AI accelerators. R8i instances deliver up to 40% higher performance on deep learning inference workloads compared to the previous R7i generation, reducing total cost of ownership while providing ample compute for production inference. The open source ecosystem around Intel architecture, including optimized LLM serving with vLLM on Intel, lets research institutes deploy standardized inference frameworks without licensing fees or proprietary dependencies.

Conclusion

Since its launch, the Public AI Inference Utility has served thousands of active users daily and sustained thousands of concurrent users at peak—researchers, developers, public institutions, and enterprises exploring what a sovereign, multilingual LLM can do for their use cases. That sustained demand confirms that the architecture built on Amazon EKS, Intel-powered EC2 instances, and other AWS services can handle real-world production traffic while maintaining performance, security, and data residency.More importantly, the Apertus deployment established a repeatable blueprint. As governments and research institutes continue to train open-weight models—each with their own language coverage, compliance requirements, and sovereignty constraints—the need for a turnkey inference layer grows. Public AI, powered by AWS infrastructure and Intel’s broadly available Xeon-based compute, is positioned to onboard new models quickly, deploy them within the required jurisdictions, and give organizations an immediate path from published weights to usable API endpoints.Organizations evaluating sovereign LLM deployment can get started in three places:

Try the live Apertus endpoint at Public AI to see what the model can do.
Review the Intel Xeon for small language model inference guide and Amazon EC2 R8i instance documentation to evaluate the compute layer for your own model.
Contact your AWS account team to discuss reference architectures for your jurisdiction.

The blueprint Public AI established for Apertus is ready to onboard the next sovereign LLM, whichever country, language, or research institute it comes from.

Intel – AWS Partner Spotlight

Intel and Amazon Web Services (AWS) have collaborated for over 20 years to develop flexible technologies and software optimizations tailored for critical enterprise workloads. This collaboration allows our AWS Partners to help their customers migrate and modernize their applications and infrastructure to manage cost and complexity, accelerate business outcomes, and scale to meet current and future computing requirements.

Contact Intel | Partner Overview | AWS Marketplace

Unified Secrets Security with GitGuardian and AWS Secrets Manager

Nic Gumina — Tue, 09 Jun 2026 21:48:03 +0000

By: Pierre Le Clezio, Lead Product Manager – GitGuardian
By: Nic Gumina, Senior Security Consultant – AWS
By: Manu Chandrasekhar, Senior DevOps Consultant – AWS
By: Dan Parlin, Security Consultant – AWS

The rise of AI coding assistants and Model Context Protocol (MCP) servers, which provide AI tools with access to external data sources, has accelerated the secret management challenge as developers increasingly share configuration files and context with AI tools that inadvertently expose sensitive credentials. API keys, access tokens, and credentials end up in Git repositories and continuous integration and continuous delivery (CI/CD) logs. While organizations invest in secrets management solutions like AWS Secrets Manager—a fully managed service for storing, rotating, and retrieving credentials—security teams still face a fundamental challenge: you can’t secure what you can’t see.

Organizations lack answers to critical questions. They don’t know which vaulted secrets have been exposed in code, whether developers have shared credentials through AI tool configurations, how many duplicate credentials exist across accounts, or how many orphaned secrets remain that no application uses.The visibility gap leads to:

Credential exposure: Hardcoded secrets in version control systems create attack vectors that persist even after rotation
Secret sprawl (the uncontrolled proliferation of credentials across systems): Duplicate credentials across accounts expand your attack surface
Compliance gaps: Inability to track secret lifecycles undermines audit requirements
Remediation delays: Without correlation between secret inventory and code exposure, security teams lack the context to prioritize and act quickly.

With multi-account AWS architectures, the need for unified visibility becomes critical. Without it, duplicate credentials and orphaned secrets across accounts go undetected, leaving attack surfaces unaddressed. Organizations need more than just a vault. They need visibility across the entire secret lifecycle, from developer workstations to production environments.

GitGuardian and AWS Secrets Manager

GitGuardian is an AWS Partner specializing in non-human identity (NHI) security, which focuses on protecting machine credentials such as API keys, service accounts, tokens, and secrets management. GitGuardian can be integrated with code repositories, container registries, package registries, documentation platforms, and messaging channels. GitGuardian’s integration with Secrets Manager addresses the visibility challenge that organizations face by bridging the gap between your secret vault and your code. This post focuses on deriving the usage context by integrating Secrets Manager with GitGuardian’s cross-repository scanning capabilities. The following figure illustrates GitGuardian’s key capabilities across the secrets security lifecycle, from detection and remediation to NHI governance.

Figure 1: GitGuardian key capabilities

The key component that makes these capabilities possible is ggscout, GitGuardian’s external collector that safely catalogs secrets from Secrets Manager and correlates them with exposed credentials detected across your repositories. ggscout uses the Hashed Message Secret Lookup (HMSL) protocol, a cryptographic hashing approach that converts secrets into secure fingerprints locally within your AWS infrastructure. Because only anonymized fingerprints leave your environment, your actual secrets remain within your AWS infrastructure. Only hashed fingerprints and metadata are transmitted to GitGuardian, maintaining your security posture and compliance requirements while enabling secret correlation and exposure analysis. For most environments, ggscout can run on an Amazon Elastic Compute Cloud (Amazon EC2) t3.small instance, keeping operational costs minimal.

Key capabilities

Using GitGuardian and the Secrets Manager integration, enables teams to gain continuous visibility and control over their secret’s lifecycle. Here are the key capabilities you get from this integration:

Detect vaulted secret exposures: This capability identifies when secrets stored in Secrets Manager have been exposed in code. When integrated with your organization’s source control systems, GitGuardian’s platform continuously monitors them across both internal repositories and public-facing code and correlates any detected credentials against your Secrets Manager inventory. When a developer accidentally commits a credential that’s already vaulted, you get an immediate alert with full context: which secret was exposed, where it appeared, and whether it’s visible internally or on the public internet. This transforms a raw “secret detected” alert into actionable intelligence, so you can prioritize your response based on the actual scope of exposure.
Prioritize incident response: Not all secrets pose equal risk. You prioritize remediation based on exposure severity (public compared to internal), sensitivity level, usage context, and rotation status. Knowing which systems depend on the secret, when it was last rotated, and what level of access it grants is crucial for prioritizing remediation. The information about which systems depend on the secret, when the secret was last rotated, and level of access the secret grants you is crucial in making that decision. For instance, a publicly exposed production database credential requires immediate rotation, while a development API key in a private repository might be scheduled for the next sprint.
Identify secret sprawl across AWS accounts: Multi-account AWS architectures are a best practice for security and organizational boundaries, but they hide duplicate secrets across account boundaries. You gain visibility into identical credentials stored across multiple AWS accounts and unused secrets to decommission. By identifying duplicate secrets, you can consolidate credentials, reduce your attack surface, and simplify attack surface.
Track remediation progress: GitGuardian’s remediation tracking gives incident managers real-time visibility into the remediation status from pull requests, making it straightforward to monitor code fixes from initiation through PR merge. Teams can streamline the entire secrets remediation lifecycle: tracking pending fixes, verifying secret removal, and confirming pull request activity, all from a single, collaborative workflow.
Establish continuous governance policies: You can implement rotation policies to identify secrets that haven’t been rotated within your policy time frame, set customizable thresholds to flag long-lived credentials, and automatically surface orphaned secrets for review, turning secrets management from a reactive cleanup into a continuous, policy-driven process.

Prerequisites

Before starting the implementation, ensure you have the following in place:

An AWS account with appropriate AWS Identity and Access Management (IAM) permissions for Secrets Manager access (cross-account read access if using multi-account architecture)
A GitGuardian account and API credentials (sign up at GitGuardian)
Deployment infrastructure: Amazon EC2 (t3.small or larger), Amazon Elastic Kubernetes Service (Amazon EKS) cluster, or Docker environment
IAM permissions for cross-account Secrets Manager read access (if scanning multiple accounts)
Source control systems to connect to GitGuardian for code scanning
AWS Command Line Interface (AWS CLI) installed and configured (required for Amazon EC2 and AWS EKS deployment methods)

Implementation roadmap

When your organization wants to introduce a continuous governance process using GitGuardian, use the following phased approach.

Note: The resources deployed in this implementation (Amazon EC2 instances, Amazon EKS clusters, and AWS Lambda functions) will incur AWS charges. Review the pricing pages for Amazon EC2, Amazon EKS, and AWS Lambda to estimate costs for your environment. Remember to clean up resources when no longer needed to avoid ongoing charges.

Phase 1 – Deployment (1–2 days): Deploy ggscout in your AWS environment using your preferred deployment method: Amazon EC2 instance based, Docker containers for containerized environments, or using Helm charts in an Amazon EKS cluster. Connect ggscout to your GitGuardian account.

Deployment guide: Deploy ggscout to your preferred environment. For detailed deployment steps, see the ggscout documentation. Key configuration parameters include your GitGuardian API token, AWS Region, and Secrets Manager access credentials.

Verification: Verify deployment by checking that ggscout successfully connects to GitGuardian (check logs for connection confirmation) and completes the initial scan (verify that scan completion status in the GitGuardian dashboard shows all configured accounts).

Phase 2 – Assess (2–3 days): Configure read-only access to Secrets Manager across your accounts. Run your initial scan to catalog all secrets and their metadata. Review the baseline report to understand your current secret landscape. The total number of secrets in your AWS environment, their age distribution, rotation status, and any immediate red flags like secrets older than your policy allows become immediately visible, as shown in Figure 2.

Figure 2: NHI governance with criticality

Phase 3 – Analyze (3–5 days): Review detected exposures that match secrets in Secrets Manager. Identify duplicate secrets across AWS accounts. Prioritize remediation based on exposure severity and secret sensitivity. This analysis reveals which of your vaulted secrets have been exposed in code, where duplicates exist, and which secrets pose the highest risk to your organization. Use this baseline to define or revisit your security tolerance. For example, any public exposure of a production secret requires immediate rotation, while internal exposures in archived repositories can be scheduled.

Analysis guide: For guidance on reviewing scan results and configuring exposure policies, see the GitGuardian NHI governance documentation.

Verification: Confirm analysis completion by verifying that all detected exposures have been reviewed and prioritized in the GitGuardian dashboard.

Figure 3: Tracking secret exposure lifecycle

Phase 4 – Automate (1–2 weeks): Schedule ggscout to run daily or weekly to enable teams to track secret exposure continually, as shown in figure 3. Configure alerts for new exposures of vaulted secrets. Set up automated notifications for secrets approaching rotation deadlines and for re-use of existing secrets as shown in figure 4. After Phase 3 remediation is complete, expand scanning to additional AWS Regions and accounts by deploying ggscout instances or configuring cross-account access. Continuous monitoring detects new exposures as they occur, rather than discovering them weeks or months later during security audits.

Automation guide: For configuring scheduled scans and alert integrations, see the GitGuardian integrations documentation.

Verification: Validate automation by confirming scheduled scans run successfully (check scan history in the GitGuardian dashboard) and test that alerts trigger correctly by simulating an exposure.

Figure 4: Breached policies for secret duplication

Phase 5 – Monitor (ongoing): By tracking KPIs such as time-to-remediation and rotation compliance rate, teams can move beyond reactive cleanup and start identifying trends across their secrets posture. These metrics simplify identifying recurring gaps, measure improvement over time, and continuously refine governance policies based on real incident data. You can view this metrics using the GitGaurdian monitoring dashboard, as shown in the following figure.

Figure 5: GitGuardian monitoring dashboard overview

Clean up resources

To avoid incurring ongoing AWS charges, delete or decommission all resources created during implementation when they are no longer needed. Follow these steps:

Stop and terminate Amazon EC2 instances running ggscout: Navigate to the Amazon EC2 console, select the instances, and choose Instance state and then choose Terminate instance.
Remove the Helm release by running helm uninstall ggscout.
Delete the EKS cluster based on your provisioning method (infrastructure as code, eksctl, or manually from the console )
Remove Lambda functions created for automated remediation workflows by navigating to the Lambda console and deleting each function associated with the integration.
Delete any associated IAM roles and policies created for ggscout access, including cross-account roles used for Secrets Manager read access. Review and remove these from the IAM console.

Conclusion

The combination of AWS Secrets Manager and GitGuardian gives you visibility and automation across the secret’s lifecycle, from creation to usage to rotation to decommissioning. By integrating GitGuardian with Secrets Manager, organizations gain continuous visibility into their secrets security posture, detecting exposures as they occur and establishing governance policies that prevent future incidents.You now have the visibility and governance controls to build a unified secrets security strategy. Start by deploying ggscout, running your initial scan, and reviewing the baseline report.After initial deployment, extend the integration with these next steps:

Implement automated remediation workflows: Use GitGuardian webhooks with Lambda to trigger automatic secret rotation when exposures are detected, reducing mean time to remediation.
Integrate with your incident response pipeline: Connect GitGuardian alerts to your existing SIEM, ticketing, or ChatOps tools to embed secrets incidents into your established workflows.

For more information and detailed deployment guides, explore these resources:

GitGuardian – AWS Partner Spotlight

GitGuardian is an AWS Partner specializing in NHI security and secrets management, providing end-to-end solutions from secrets detection in code to remediation, observability, and proactive prevention of leaks.

Contact GitGuardian | Partner Overview | AWS Marketplace

AWS Partner Network (APN) Blog

Announcing 2026 AWS Partner Award Nominations

Nomination-Based Award Categories

Nomination Categories and Forms

Category Descriptions and Judging Criteria

Innovation Partner of the Year

Design Partner of the Year

Social Impact Partner of the Year

Sustainability Partner of the Year

Collaboration Partner of the Year

Don’t Miss Out!

Say Hello to 184 New AWS Competency, Service Delivery, and MSP Partners Added in June

NEW! AWS Competency Partners

Team up with our newest AWS Competency Partners:

NEW! AWS Managed Service Providers (MSPs)

Say hello to our newest AWS MSP Partners:

NEW! AWS Service Delivery Partners

Work with our newest AWS Service Delivery Partners:

More Value, Greater Profitability for AWS Partners

How InterWiz reduced AI costs by 90% with Amazon Bedrock

The InterWiz story: From cost crisis to competitive advantage

Why Emumba

The migration approach

The results

The competitive impact

Three strategic takeaways for AI-powered SaaS leaders

Looking forward

Emumba – AWS Partner spotlight

Reimagining legacy applications with Pega and AWS through AI-driven approach

The AI-Driven App Modernization Platform with Pega and AWS

Target use cases

Composable platform architecture

The three-phase modernization methodology: Anything to Blueprint to cloud

Phase 1: Reverse engineering and discovery

Phase 2: AI-powered forward engineering

Phase 3: Deployable architecture on Pega Cloud

Key benefits

Getting started

Conclusion

Pega – AWS Partner spotlight

Designing enterprise AI agents with DevRev guardrails powered by Amazon Nova

DevRev guardrails: Built-in AI safety for every agent

Measured impact in production deployments

The DevRev guardrails solution

How it works: The parallel evaluation architecture

Why Amazon Nova 2 Lite?

System context: Computer by DevRev

Enabling safe agent autonomy at enterprise scale

Conclusion

DevRev – AWS Partner Spotlight

AWS and Elastio deliver comprehensive ransomware resilience

Why ransomware demands a new approach to recovery

A fourth line of data protection – Cloud-hosted data vault

How to get started with data vaulting on AWS

Elastio Platform 360 Ransomware Resilience – Critical visibility into recovery integrity

Conclusion

Elastio – AWS Partner Spotlight

Introducing Forward Deployed Engineering for Partners: Winning the Future of Enterprise AI

Why Partners, Why Now

A Continuum of Customer Choice

What Makes This Different: The Delivery Harness

How it Works

Getting Started

How DXC Technology upgraded Angular and .NET applications with Amazon Q Developer

Business challenges

Proof of concept and prompt engineering approach

How prompt engineering was used

Solution design

Security validation

Testing and validation

Customer benefits

Productivity metrics

Key learnings

Conclusion

DXC – AWS Partner Spotlight

Securing AI-driven APIs on AWS with Wallarm

The visibility gap in AI security

The benefits of extending visibility to AI workloads

Extending AWS security with runtime visibility

Financial services AI deployment