AWS›
Cloud Security›
Culture of Security

How AWS sustains a strong culture of security

At AWS, security is our top priority.

Since day one, AWS has deeply invested into our culture of security. Security is prioritized by our leadership and built into our organizational structure. Everyone, regardless of role, views security as a shared responsibility. Security advocates and advisors are embedded in our teams to share their expertise, and innovation empowers our people to move fast while staying secure.

We’ve found that building and maintaining a culture of security requires constant investment and focus on four key principles.

How Do I Build a Culture of Security?

Culture of security principles at work within AWS

Security is a top-down priority

At AWS, security is deeply ingrained into our organizational structure and decision-making. Our security teams report directly to the CEO while also being deeply embedded in our respective business units. Weekly meetings with executive leadership examines security metrics, connect data to business outcomes, and ensure alignment on strategic security issues. This top-down commitment reinforces that security accelerates business objectives and enhances customer experiences.

Security is everyone’s job

AWS operates with a strong ownership model built around our culture of security. Everyone, from executives to engineers, embraces a security-first mindset. Service teams are fully responsible for the security of the service that they deliver. Security is ingrained into every product roadmap, engineering plan, and weekly stand-up, just as much as capabilities, performance, and cost. We encourage teams to raise their hand and ask for help when there’s even a hint of a security issue.

Security expertise is distributed across AWS

AWS Security provides critical capabilities and services that enable our engineering and service teams to fulfill their security responsibilities effectively. This includes training, threat modeling tools, code scanning frameworks, design reviews, penetration testing, and security reviews of new services and features. Security teams are empowered to make a go or no-go decision with respect to each and every release, and always err on the side of maintaining the high security bar our customers expect from AWS.

Security innovation that empowers people

At AWS, people are our biggest asset, driving us to build security innovations that improve their work experience, remove barriers, and enable sound security decisions. We use artificial intelligence (AI) to accelerate secure software development and complement human expertise. We use security automation to reduce mundane tasks, reduce human error, and scale security best practices. And, we use automated reasoning to detect misconfigurations and prove that our security controls are effective.