SageMaker

Last updated: Nov 4, 2026

Rationale

SageMaker is the platform that Fluid Attacks uses to develop solutions with Machine Learning.

These are the primary reasons why Fluid Attacks selected it and not other alternatives:

It integrates with EC2. Thus, Fluid Attacks can easily provision cloud computing resources. This feature is necessary for horizontal autoscaling.
It complies with many certifications from ISO and CSA. Many of these certifications make sure that the entity uses best practices for secure cloud-based environments and information security.
It integrates with S3. Thus, Fluid Attacks can keep raw data, datasets, and training outputs in its S3 Bucket.
It supports a wide range of EC2 ML-specific machines to train models.
It supports EC2 spot machines, which decrease the machine costs very much.
Because of its horizontal autoscaling capabilities, it is very easy to implement parallelism. Fluid Attacks can run some models or feature combinations on different machines, and this increases training performance very much.
It supports Hyperparameterization. Thus, Fluid Attacks can do the concurrent training of more than one instance of a model with different parameter values. This feature is necessary to optimize the most accurate model of Fluid Attacks.
It integrates with IAM. Thus, Fluid Attacks can keep a least-privilege approach for authentication and authorization.
It supports a wide range of frameworks, for example, scikit-learn, which Sorts uses.
Fluid Attacks can monitor the performance of the EC2 workers with CloudWatch.
Fluid Attacks can monitor the logs of training jobs with CloudWatch.

IBM Watson Studio: It does not integrate with EC2 or S3. Thus, it increases the general complexity (review pending).
GCP Vertex AI: It does not integrate with EC2 or S3. Thus, it increases the general complexity (review pending).
Azure machine learning: It does not integrate with EC2 or S3. Thus, it increases the general complexity (review pending).

Fluid Attacks uses SageMaker as the Machine Learning platform to train Sorts, its ML-based software vulnerability scanner.
Fluid Attacks does not use SageMaker spot instances (implementation pending).