AWS Threat Detection
24/7 Threat Detection That Auditors Accept.
What this hub covers
AWS-native threat detection is enough for most workloads — once it is configured correctly. These guides cover GuardDuty across CloudTrail, VPC, EKS, S3, RDS, Lambda, and EC2 Runtime; Security Hub Essentials on resource-based pricing — including the Jul 2026 AI inventory that catalogs managed Bedrock/AgentCore/SageMaker assets, self-hosted stacks via Inspector SBOM, and external model APIs via GuardDuty DNS; Amazon Inspector with agentless EC2, Lambda code scanning, and CI/CD repo scanning; Amazon Detective for graph-based forensics; and Security Lake with OCSF 1.1. Plus the automation that turns findings into remediation runbooks instead of dashboard noise.
10 guides in this hub
Each one is written for a production AWS estate: the configuration, the trade-offs and what the auditor asks for. Part of the AWS Security & Compliance hub.
AWS CSPM: Native Security Hub Stack vs Third-Party (Wiz, Orca) — 2026 Decision Guide
After Security Hub Essentials consolidated Inspector and CSPM into per-resource pricing (example: 500 units ≈ $1,875/mo), most AWS-only estates should run native first. This guide scores when Wiz/Orca-class tools earn a line item, and where paying twice for the same CVE becomes the failure mode.
Read the guideAWS GuardDuty Threat Detection: A Production Setup Guide
How to deploy, tune, and operationalize Amazon GuardDuty for production threat detection, covering finding types, multi-account setup, automated response, and reducing false positives.
Read the guideAmazon Inspector v2: Agentless Container and Lambda Vulnerability Scanning in Production
Inspector v2 continuously scans EC2, ECR container images, and Lambda functions without agents. Production guide to CI/CD integration, finding management, risk scoring, and multi-account deployment.
Read the guideAmazon Security Lake: Centralized OCSF Security Data Lake for Enterprise Threat Intelligence
Security Lake: OCSF Parquet in your S3. July 2026: ingestion+conversion pricing, Hub vs Lake vs SIEM, rollout checklist.
Read the guideHow to Set Up AWS Security Hub for Compliance Monitoring
AWS Security Hub aggregates security findings from 200+ sources and, as of Jul 14 2026, includes AI inventory for org-wide AI assets. This guide covers setup, compliance standards, AI inventory, automated remediation, and a compliance dashboard without hiring a SOC team.
Read the guideFrom Reactive to Proactive: Automating AWS Security Remediation with AI-Driven Threat Detection
Manual security triage cannot keep up with cloud-scale threats. This post wires GuardDuty Extended Threat Detection, Security Hub, EventBridge, and Lambda into a self-healing AWS security architecture.
Read the guideAWS Incident Response Runbooks (2026): What Changes Now That Security Incident Response Is Metered and GuardDuty Correlates Attack Sequences
Two 2025 shifts rewrite the IR playbook: GuardDuty Extended Threat Detection now emits a single critical attack-sequence finding instead of a pile of high findings, and AWS Security Incident Response moved to metered pricing (free first 10,000 findings/month, then $0.000676 each) on November 21, 2025. The lesson is to page humans on the top 1% of correlated criticals, isolate instead of terminate, and let auto-triage absorb the rest.
Read the guideAWS Security Agent Full Repository Code Review: Trust Boundaries Beyond Pattern-Only SAST
July 2026 placement guide for AWS Security Agent full-repository code review (announced May 12, 2026): trust-boundary and data-flow analysis beside Inspector, CI SAST, and a reproducible pilot checklist. Preview terms still apply, so confirm console pricing.
Read the guideBuilding a Vulnerability Management Program on AWS: CVSS, KEV, and Reachability
How to build a vulnerability management program that scales beyond CVE-counting. Inspector v2 deployment, CVSS + CISA KEV + reachability for risk-based prioritization, container and IaC scanning in CI/CD, and remediation SLAs that survive audits.
Read the guideAmazon Macie + Detective on AWS: Data Security Posture Management and Forensic Investigation in Production
Macie + Detective: S3 DSPM and forensic graphs. July 2026: scope costs, KMS decrypt, paired Security Hub pipeline.
Read the guideServices and neighbouring hubs
The engagements that apply these guides, in navy, and the hubs buyers usually read alongside this one.
AWS Managed SOC & MDR Services
24/7 managed SOC and MDR for AWS — GuardDuty, Security Hub (AI inventory), Security Lake. Threat hunting, automated containment, incident response from an AWS Select Tier Partner.
Explore the serviceAWS Security Consulting
AWS security consulting from an AWS Select Tier Partner. 2-week assessment, 4–6 week remediation, zero disruption. IAM hardening, public exposure, compliance gaps, and continuous monitoring.
Explore the serviceData Security
Bucket-level controls, secret rotation, KMS post-quantum, Amazon Macie for data classification, and clean-room collaboration without raw-data sharing.
Open the hubGovernance & Multi-Account
Multi-account is where compliance scope is either won or quietly lost. Control Tower, landing-zone topology, automated conformance packs, and drift detection — the patterns that hold scope at 50+ accounts.
Open the hubAI Security
Know every AI asset across accounts, then harden inference: prompt injection, PII leakage, hallucinations, and regulated model deployment.
Open the hubCommon questions
- Do we still need GuardDuty if Security Hub is already on?
- Yes — they are complementary, not redundant. Security Hub Essentials is the aggregator: it ingests findings from AWS services and partner tools, runs continuous standards checks (AWS Foundational Security Best Practices, CIS, PCI DSS, NIST 800-53 r5), and emits a normalized severity score. GuardDuty is one of those finding sources — it produces threat-detection findings (cryptocurrency mining, anomalous CLI activity, credential exfiltration, malware, EKS runtime threats) by analyzing CloudTrail, VPC Flow Logs, DNS logs, S3 data events, EKS audit logs, RDS login events, and Lambda invocations. Without GuardDuty, Security Hub still runs the standards checks but has no behavioral threat-detection feed — and AI inventory loses the DNS path that surfaces third-party model API calls.
- What is Security Hub AI inventory, and do we need to enable it?
- AI inventory (generally available 14 July 2026) is a continuously updated, organization-wide catalog of AI assets inside Security Hub Essentials — included at no additional cost and with no separate enablement step. It discovers managed AI via AWS Config (Amazon Bedrock, Bedrock AgentCore, Amazon SageMaker), self-hosted AI via Amazon Inspector SBOM analysis on EC2 and ECR (frameworks such as Ollama, vLLM, Hugging Face TGI), and external AI API endpoints via GuardDuty DNS telemetry. Each asset maps to underlying infrastructure and correlates with security findings so you remediate AI under active threat first. Filter and group by account, resource type, discovery method, and model identity.
- When should we add Amazon Detective on top of GuardDuty?
- Add Detective when finding triage takes more than a few minutes per investigation. Detective ingests GuardDuty, VPC Flow Logs, CloudTrail, Route 53, and EKS audit logs and pre-builds the entity graph (IPs, principals, resources, finding chains) so you click into a finding and see the linked behaviour over the prior 30 days without writing CloudWatch Logs Insights queries. Most teams hit the threshold once they cross ~50 GuardDuty findings/week or once a security analyst is dedicated to AWS investigations. Below that, jumping straight to CloudTrail Lake or Athena on Security Lake is acceptable.
- Amazon Inspector vs third-party CSPM tools?
- Amazon Inspector is best-in-class for AWS-native vulnerability and code scanning: agentless EC2 via EBS snapshots, container image scanning in ECR, Lambda function and Lambda code scanning, and (since 2025) CI/CD scanning of supported code repositories. It is the right call for AWS-only estates because findings flow directly to Security Hub with one CVSS + KEV-aware severity — and its SBOM analysis now feeds Security Hub AI inventory for self-hosted inference stacks. A third-party CSPM (Wiz, Lacework, Orca, Rapid7) earns its line item when you span multi-cloud, need posture findings beyond vulnerability (data exposure, attack-path graphs), or have a SOC that already lives in that console. We do not recommend duplicating findings — pick one source of truth per finding type.
Apply this to your environment
Our consulting engagements apply this guidance to your specific environment, regulatory scope and threat model.
Pictures:Lock and Key (public domain (CC0)); Lock and Key (public domain (CC0)); Coffer lock and key (public domain (CC0)); Padlock and key, André Omereler (public domain (CC0)); Padlock, French (?) maker (public domain (CC0)); Chubb lock (public domain); Safe deposit vault 1908, The Cleveland Trust Company (public domain); The Street Locksmith (6899206616), John Thomson (no known copyright restrictions).Via The Metropolitan Museum of Art and Wikimedia Commons.
.jpg){kind=link}