AWS re:Inforce 2025: The Complete Guide to Cloud Security Innovation
AWS re:Inforce 2025 delivered groundbreaking security innovations, transformative AI security guidance, and practical hands-on learning for over 5,000 security professionals. The event showcased how security at scale becomes a business accelerator, not a barrier to innovation.
From June 16-18, 2025, Philadelphia’s Pennsylvania Convention Centre became the epicentre of cloud security innovation as AWS hosted its third annual re:Inforce conference. Unlike other security conferences, re:Inforce prioritizes experiential learning, bringing together security specialists who build the AWS services organisations rely on daily.
The Vision: Security as a Business Accelerator
AWS Chief Information Security Officer Amy Herzog delivered her first keynote as CISO, demonstrating how AWS is helping customers simplify security at scale. Her central message challenged a fundamental assumption: security doesn’t have to slow down innovation, when done right, it accelerates it.
Drawing on real-world success stories from Comcast, RedShield, and BMW, Herzog showed how proactive, automated AWS security tools help teams identify and remediate issues faster and more efficiently. The keynote emphasised that organizations with mature security foundations across four key pillars, identity and access management, data and network security, monitoring and incident response, and continuous migration/modernisation are actually moving fastest in their cloud journeys.
Major Security Announcements: Simplifying Security at Scale
The conference unveiled significant security innovations focused on reducing complexity while enhancing protection:
Identity and Access Management Advances
AWS IAM now enforces Multi-Factor Authentication (MFA) for root users across all account types, preventing over 99% of password-related attacks. The system supports FIDO-certified security keys and FIDO2 passkeys, allowing up to 8 MFA devices per root and IAM user.
A particularly noteworthy addition was new internal access findings for AWS IAM Access Analyser, which uses automated reasoning technology to analyse complex permission layers across diverse policy types, giving security teams comprehensive visibility into who within their organizations has access to what resources.
Enhanced Threat Detection and Response
Amazon GuardDuty Extended Threat Detection expanded coverage to Amazon EKS clusters, while AWS Security Hub received enhancements to transform security signals into actionable insights, helping security teams prioritize and respond to critical issues at scale.
The introduction of Shield network security posture management automatically discovers and analyses network resources across AWS accounts, prioritizes security risks based on AWS best practices, and provides actionable remediation recommendations.
Simplified User Experiences
AWS WAF’s new console experience reduces security configuration steps by up to 80% through pre-configured protection packs, while Amazon CloudFront simplified web application delivery and security with a new user-friendly interface that automates TLS certificate provisioning, DNS configuration, and security settings.
Advanced Threat Intelligence
AWS Network Firewall introduced a new managed rule group that uses the Amazon threat intelligence system MadPot to continuously track attack infrastructure, including malware hosting URLs, botnet command and control servers, and crypto mining pools.
The AI Security Focus: From Possibility to Production
One of the most compelling aspects of re:Inforce 2025 was its dedicated focus on securing AI workloads. The rapid advancement of generative AI has ushered in unique opportunities for innovation, but it also introduces a new set of security challenges that organizations must address.
Key AI and Security Sessions/Talks
Innovation Talk: From Possibility to Production
Speakers Hart Rossman and Becky Weiss from AWS demonstrated how AWS removes the heavy lifting of AI security, enabling organizations to accelerate from development to production.
Behind the Shields: AWS and Anthropic’s Approach to Secure AI
This session featured Anthropic’s Head of Risk Governance alongside AWS security leaders, revealing how AWS and Anthropic collaborate to deliver enterprise-grade security for large language models and generative AI workloads.
Workshop: Defend Your AI: Mitigate Prompt Injection with Amazon Bedrock
This hands-on workshop allowed participants to master the art of identifying and mitigating prompt injection vulnerabilities in generative AI systems, including completing an interactive ‘capture the flag’ style challenge and learning to implement defensive controls using Amazon Bedrock Guardrails.
Key Takeaways for Security Professionals
- Security Enables Speed
The overarching theme throughout re:Inforce 2025 was that properly implemented cloud security doesn’t slow down innovation, it accelerates it. Organisations with mature security foundations across the four key pillars are moving fastest in their digital transformation journeys.
- AI Security Requires Proactive Planning
As generative AI adoption accelerates, organizations need comprehensive strategies that address everything from prompt injection vulnerabilities to data protection in AI training pipelines. The conference provided practical frameworks for implementing secure AI systems at enterprise scale.
- Automation is Critical for Scale
The announcements around GuardDuty Extended Threat Detection and enhanced Security Hub demonstrate AWS’s focus on using AI and machine learning to detect sophisticated threats and provide actionable insights automatically.
- Identity Foundation Matters Most
Identity and access management underpins every aspect of cloud security, and success requires both rigorous authentication controls and comprehensive visibility into access permissions.
- Experiential Learning Drives Results
The conference’s emphasis on hands-on workshops, builders’ sessions, and direct collaboration with AWS experts highlighted that practical implementation experience is crucial for effective security learning.
Looking Forward: The Future of Cloud Security
re:Inforce 2025 painted a picture of cloud security’s future where security becomes increasingly automated, AI-powered, and seamlessly integrated into development workflows. The event demonstrated that when security scales naturally with business operations, teams can focus on building what’s next instead of managing infrastructure.
For organisations beginning their cloud security journey or looking to enhance existing capabilities, the conference provided clear guidance: start with strong foundations across the four key pillars, embrace automation and AI-powered security tools, and prioritise experiential learning that builds practical implementation skills.
The message from re:Inforce 2025 was clear: the organisations that will thrive are those that view security not as a constraint, but as an enabler of innovation and growth.
AWS re:Inforce 2025 took place June 16-18, 2025, at the Pennsylvania Convention Centre in Philadelphia. The keynote and innovation talks are available on-demand for those who couldn’t attend in person.
