AWS CSPM: Native Security Hub Stack vs Third-Party (Wiz, Orca) — 2026 Decision Guide
Quick summary: After Security Hub Essentials consolidated Inspector and CSPM into per-resource pricing (example: 500 units ≈ $1,875/mo), most AWS-only estates should run native first. This guide scores when Wiz/Orca-class tools earn a line item—and when paying twice for the same CVE is the real failure mode.
Key Takeaways
- After Security Hub Essentials consolidated Inspector and CSPM into per-resource pricing (example: 500 units ≈ $1,875/mo), most AWS-only estates should run native first
- May 2026
- 75/unit ≈ $1,875/month)
- That pricing reset is the reason “CSPM on AWS” stopped meaning “buy a third-party console first
- This post is a buyer decision guide for regulated SaaS and mid-market AWS estates—not a setup tutorial
Table of Contents
May 2026. AWS reorganized Security Hub Essentials into a single per-resource-unit price that folds in continuous posture management (CSPM), Amazon Inspector vulnerability scans, and unlimited re-scans—documented on the Security Hub pricing page with example arithmetic (500 resource units × $3.75/unit ≈ $1,875/month). That pricing reset is the reason “CSPM on AWS” stopped meaning “buy a third-party console first.”
This post is a buyer decision guide for regulated SaaS and mid-market AWS estates—not a setup tutorial. For GuardDuty versus Security Hub roles, read the comparison page. For enabling standards, see Security Hub compliance monitoring.
Reference estate (benchmark, not a client) — We scored a 12-account AWS Organization (~180 EC2-equivalent units, ~90 Lambda-heavy workloads rolled into units, ~40 active ECR images) against the published Essentials calculator: landed ~$1,400–$1,900/month for Essentials before Threat Analytics add-on—consistent with AWS’s 500-unit example band. Your unit count is the input; do not copy our dollars into a board slide without exporting your Security Hub usage page.
What CSPM means on AWS (and what it does not)
Cloud security posture management on AWS is not one SKU. It is four overlapping jobs:
| Job | Native primary | Third-party often adds |
|---|---|---|
| Configuration posture | Security Hub standards + AWS Config rules | Cross-cloud policy packs |
| Vulnerability | Inspector v2 (EC2, ECR, Lambda) | Same CVEs + app-layer context |
| Threat detection | GuardDuty (+ optional Threat Analytics add-on) | Correlation across clouds |
| Data exposure (DSPM) | Macie + Detective | SaaS data stores, attack paths |
Opinionated take: For AWS-only production, we recommend native Essentials + delegated admin + org-wide Config before any Wiz/Orca/Lacework procurement. A third-party CSPM earns budget when it changes workflow (multi-cloud graph, DSPM depth), not when it re-lists Inspector findings.
Native stack map (2026)
- Security Hub Essentials — standards (CIS, PCI DSS, NIST 800-53, HIPAA), consolidated findings, risk/exposure analytics.
- AWS Config — resource configuration history; conformance packs (often billed separately—do not forget Config recorder costs).
- Amazon Inspector v2 — included in Essentials pricing for covered resources; feeds Security Hub.
- Amazon GuardDuty — behavioral threats; optional Threat Analytics add-on on top of Essentials.
- Amazon Macie — S3 data classification and sensitive data findings (DSPM slice for object storage).
- Amazon Detective — investigation graph after GuardDuty noise justifies it (~50+ actionable findings/week is a common threshold).
Enable Organizations delegated administrator for security services so member accounts cannot disable the recorder to pass an audit the week before QSA visit.
When third-party CSPM earns its line item
Buy Wiz-, Orca-, or Lacework-class CSPM when any of these are hard requirements:
- Multi-cloud production (Azure/GCP) with one risk backlog.
- Attack-path visualization is how your SOC prioritizes (not severity × asset criticality in Security Hub).
- DSPM must cover data stores Macie does not (SaaS CRM exports, warehouse shares) in the same product.
- Enterprise EDP already funds Security Hub Extended Plan partner modules—you are integrating, not greenfield buying.
When NOT to buy: single-cloud AWS, Security Hub already satisfies audit evidence, <0.5 FTE security engineering, and no integration owner for deduplication.
Cost model: native vs third-party (order-of-magnitude)
| Layer | Native (published / observed) | Third-party (market) |
|---|---|---|
| Essentials | AWS example: $3.75/resource unit/mo; 500 units ≈ $1,875/mo | — |
| Threat Analytics add-on | Usage-based (CloudTrail events + log GB) | — |
| Config conformance packs | Config rules + evaluations (separate) | Often bundled in CSPM quote |
| Third-party CSPM | — | $100k–$400k+ ACV mid-market; higher at enterprise |
A $200k/year CSPM plus $20k/month native Essentials is rational when multi-cloud graph saves analyst hours. It is not rational when both stream Inspector CVEs into Jira.
Duplication trap (what broke)
What broke — A healthtech SaaS (~35 accounts, SOC 2 + HIPAA) ran Security Hub Essentials and a third-party CSPM for 14 months. Inspector findings appeared twice; Jira auto-assigned ~40% duplicate tickets in the first quarter after go-live. Engineers muted Critical in both systems. MTTR on real issues rose from 9 to 21 days (their ServiceNow export—not a FactualMinds claim). Remediation: Security Hub became system of record for AWS posture + vuln; third-party kept GitHub + container registry paths only; EventBridge suppressed duplicate
AwsAccountId+GeneratorIdpairs.
Decision workflow
- Export Security Hub → Usage (resource unit count).
- List contractual frameworks (SOC 2 only vs PCI + HIPAA).
- Score the matrix in
examples/architecture-blog-2026/cspm-native-vs-third-party/decision-matrix.md. - If third-party wins, write deduplication rules before purchase order.
Reproduce this — Copy the scoring matrix from
examples/architecture-blog-2026/cspm-native-vs-third-party/decision-matrix.mdinto your wiki. Pair with AWS’s Security Hub cost estimator and the live pricing page (Essentials unit ratios as of May 2026).Want a second-opinion review before the PO? AWS cloud security consulting and AWS managed SOC / MDR.
What to do this week
- Enable Essentials in the security delegated admin account; export unit count.
- Map one finding type per tool (vuln / posture / threat / data).
- Run a 30-day pilot: native-only triage; measure duplicate rate if you already pay for third-party.
- Only then issue CSPM RFP—or cancel renewal if native cleared the backlog.
What this post does not cover
- Step-by-step Security Hub enablement (see setup guide).
- Macie + Detective pairing (see data security investigation guide).
- SIEM replacement analysis (Splunk/Sentinel feeding Security Lake).
- Vendor contract negotiation.
Related: Security & compliance hub · Continuous compliance pipeline (Config + conformance packs) · Inspector v2 on containers and Lambda · Vulnerability prioritization (CVSS + KEV)
If you only do one thing: Pick one system of record for Inspector CVEs before you renew or buy a third-party CSPM.
Frequently asked questions
Does Security Hub Essentials replace GuardDuty?
No. Essentials bundles posture management, vulnerability management (Inspector), and risk analytics on a per-resource unit model. Threat Analytics is an optional add-on powered by GuardDuty (CloudTrail, VPC, DNS, S3, EKS, Lambda). Turning on Essentials without understanding Threat Analytics leaves behavioral detection under-provisioned if your SOC expects mining and credential-exfiltration findings. See our GuardDuty vs Security Hub comparison for the split.
When should we NOT buy a third-party CSPM?
Skip the purchase when: (1) production is AWS-only with no near-term Azure/GCP, (2) Security Hub standards (CIS, PCI 4.0, NIST 800-53) satisfy contractual audit evidence, (3) your team already triages in Security Hub + EventBridge, and (4) a third-party tool would duplicate Inspector CVE findings without a distinct workflow. Paying $150k+ ACV to re-label Critical findings you already ingest is a common waste pattern.
What goes wrong if we run native and third-party without deduplication?
The same Inspector-sourced CVE appears in Security Hub and in Wiz with different ticket IDs. MTTR looks worse because engineers chase duplicates; SOCs mute both streams. Fix: designate Security Hub (or the third-party tool) as system of record per finding type—vuln vs posture vs DSPM—and suppress the other source in the ticketing integration.
How does 2025 Security Hub pricing change the math?
AWS moved Essentials to consolidated per-resource units with unlimited scans (ratios: 1 EC2 = 1 unit, 12 Lambda = 1 unit, 18 ECR images = 1 unit, 125 IAM principals = 1 unit). AWS published example math: 500 resource units × $3.75/unit ≈ $1,875/month for Essentials before optional Threat Analytics log/event charges. Old per-finding ingestion math no longer applies—re-quote any 2023-era spreadsheet.
When does a third-party CSPM clearly win?
When multi-cloud posture is in scope, when buyers require attack-path graphs as the primary triage UI, when DSPM must catalog data beyond Macie’s S3-centric strengths, or when the SOC already standardized on that vendor’s console and AWS is a feed. Enterprise EDP credits for Extended Plan partners (CrowdStrike, Cyera, etc.) can also tilt the decision—if you are paying anyway, integrate rather than duplicate.
Can we satisfy PCI DSS 4.0 with native tools only?
For AWS-only cardholder environments, Security Hub PCI DSS standard + Config conformance packs + Inspector + GuardDuty + Macie (where PAN-adjacent data lives in S3) is a defensible baseline—auditors still expect your policies, penetration tests, and manual evidence. Third-party CSPM does not remove QSA scope; it centralizes findings. If your QSA already accepts Security Hub control summaries, native is sufficient.
AWS Cloud Architect & AI Expert
AWS-certified cloud architect and AI expert with deep expertise in cloud migrations, cost optimization, and generative AI on AWS.
