AWS Security Service Comparison
GuardDuty vs Security Hub: When to Use Each AWS Security Service
Most AWS estates need both — they answer different questions. The architectural difference, the 2025 Security Hub pricing reset, and the deployment pattern we run on every regulated workload.
<div class="quick-answer"> **Quick Answer:** Security Hub is the aggregation and standards-evaluation layer. GuardDuty is the behavioral threat-detection feed that flows into it. You need both — Security Hub alone has no anomaly detection; GuardDuty alone has no continuous standards checks or normalized severity. </div> GuardDuty and Security Hub are not competing services — they answer different questions. Confusing them leads to one of two wrong calls: turning on Security Hub and assuming behavioral threats are covered (they are not), or running GuardDuty without Security Hub and ending up with a stream of findings nobody can normalize across CIS, PCI DSS, NIST 800-53, or HIPAA. This comparison is written for security architects deploying AWS-native detection on regulated workloads. ## The Core Distinction **Security Hub** is the aggregation layer. It ingests findings from 30+ AWS services and 50+ partner tools (CrowdStrike, Wiz, Palo Alto Prisma, Lacework, Tenable, Qualys, Rapid7), runs continuous standards checks against the AWS Foundational Security Best Practices, CIS AWS Foundations, PCI DSS 4.0, NIST 800-53 r5, and HIPAA standards, and emits a single normalized severity score per finding. It does not produce its own threat-detection findings. **GuardDuty** is the behavioral threat-detection layer. It analyzes CloudTrail management events, CloudTrail S3 data events, VPC Flow Logs, DNS query logs, EKS audit logs, RDS login events, and Lambda invocations — looking for cryptocurrency mining, credential exfiltration, anomalous API patterns, malware on EBS volumes, and EKS runtime compromises. It feeds findings into Security Hub. The right way to think about it: GuardDuty is a finding **source**; Security Hub is a finding **destination + standards evaluator**. ## What Each Service Detects **GuardDuty Foundation (CloudTrail-based):** - Anomalous IAM API patterns (suddenly listing all S3 buckets at 2 a.m. from a new IP) - Credential compromise (CloudTrail events from regions you do not operate in) - Cryptocurrency mining (Bitcoin protocol DNS queries) - C2 communication (DNS queries to known threat-intel-listed domains) - Recon activity (port scanning, IMDSv1 abuse) **GuardDuty Protection Plans (add-ons):** - **S3 Protection** — anomalous S3 data event patterns (mass GETs, unusual download volumes) - **EKS Protection** — Kubernetes audit log analysis + runtime monitoring (kernel-level threat detection inside containers) - **RDS Protection** — anomalous RDS login patterns (brute force, credential stuffing, unusual user behavior) - **Lambda Protection** — anomalous Lambda invocation patterns - **EC2 Runtime Monitoring** — kernel-level threat detection inside running EC2 instances (file access, process execution) - **Malware Protection** — agentless EBS-snapshot malware scanning on triggered Lambda functions and EC2 instances **Security Hub:** - Finding aggregation across all AWS services + partner integrations - Continuous standards checks (FSBP, CIS 1.4 + 2.0, PCI DSS 4.0, NIST 800-53 r5, HIPAA) - Cross-account and cross-region centralization (delegated administrator pattern) - Automation rules (auto-remediation, finding routing, custom severity overrides) - Insight queries (custom dashboards over normalized findings) ## Cost Comparison (2026) **GuardDuty Foundation** is priced per CloudTrail management event and per GB of VPC Flow Logs / DNS analyzed. For a typical mid-market workload with 50M CloudTrail events/month, expect $200/month base. Protection plans: - S3 Protection: $0.10–$1.00 per million S3 data events (scales with traffic) - EKS Audit Log: $1.00 per million events - EKS Runtime: $4.50 per vCPU per hour for monitored workloads - RDS Protection: $0.20 per RDS login event - Lambda Protection: per invocation, varies - EC2 Runtime: ~$1.50 per vCPU per month (hourly metered) - Malware Protection: $0.05 per GB scanned Mid-market regulated workloads typically land at $300–$2,000/month for GuardDuty. **Security Hub Essentials** (2025 reprice) bills per protected resource per month — $0.0010 per AWS resource per month for security checks, plus per-finding ingestion charges from external sources. Mid-market regulated workloads land at $300–$1,500/month. Unlimited control checks and findings within scope; cross-region aggregation included. **Combined typical mid-market spend:** $600–$3,500/month for the GuardDuty + Security Hub pair on a regulated workload. ## Decision Framework Turn on **Security Hub** if you have any of: - More than two AWS accounts (cross-account aggregation is the headline value) - A compliance framework that asks for continuous controls evaluation (SOC 2 CC7, PCI DSS Req 10–11, HIPAA §164.308, ISO 27001 A.8.16) - Partner security tools (CrowdStrike, Wiz, etc.) you want to centralize - A SIEM or GRC tool that needs a single AWS-side feed Turn on **GuardDuty** if you have any of: - Production workloads (the answer is "always" for production) - Internet-exposed resources (EC2, ALB, API Gateway, S3 with public read) - IAM principals beyond a small core team (insider-threat coverage) - Containers or Lambda in production - RDS or Aurora handling regulated data In practice: **enable both on every regulated production workload from day one**. The combined cost is a fraction of one breach, and the deployment is a single Terraform module. ## Deployment Pattern We Use For multi-account AWS Organizations: 1. **Designate the Security account as Security Hub delegated administrator** — all findings aggregate there 2. **Enable GuardDuty Organization-wide** with auto-enrollment on new accounts 3. **Enable Security Hub Organization-wide** with the AWS Foundational Security Best Practices and any framework-specific standards (PCI DSS, NIST 800-53) 4. **Enable Macie selectively** on accounts that hold sensitive data (full-account is overkill) 5. **Enable Inspector v2** on every account with EC2 / ECR / Lambda 6. **Wire EventBridge rules** in the Security account to fan critical findings to PagerDuty and Slack 7. **Connect Security Hub to your GRC tool** (Vanta, Drata, Secureframe) via the read-only integration The full pattern is documented in our [GuardDuty production guide](/blog/aws-guardduty-threat-detection-production-guide/), [Security Hub setup guide](/blog/how-to-set-up-aws-security-hub-compliance-monitoring/), and [Security & Compliance hub](/security-compliance/). ## When You Outgrow Native AWS Native AWS detection works for AWS-only estates. You start to need a third-party tool when: - You span multi-cloud (AWS + Azure or GCP) and need a single posture view - You need attack-path graphs (Wiz, Orca, Lacework) beyond per-finding severity - Your SOC lives in Splunk, Sumo Logic, Microsoft Sentinel, or Google Chronicle and the integration cost of "Security Hub → SIEM" outweighs the duplication of a CSPM that lives in the SIEM directly For most regulated SaaS, healthtech, and fintech in AWS-only estates, the native pair (GuardDuty + Security Hub + Inspector v2 + Macie) is the right call. We size up to a third-party CSPM only when one of the conditions above triggers it. ## Related Reading - [AWS Cloud Security service](/services/aws-cloud-security/) — assessment, hardening, monitoring - [Managed SOC & MDR](/services/aws-managed-soc-mdr/) — 24/7 detection and response - [Threat Detection subtopic hub](/security-compliance/threat-detection/) — full curated guide set - [Security & Compliance hub](/security-compliance/) — frameworks, services, and tools
Quick Answer: Security Hub is the aggregation and standards-evaluation layer. GuardDuty is the behavioral threat-detection feed that flows into it. You need both — Security Hub alone has no anomaly detection; GuardDuty alone has no continuous standards checks or normalized severity.
GuardDuty and Security Hub are not competing services — they answer different questions. Confusing them leads to one of two wrong calls: turning on Security Hub and assuming behavioral threats are covered (they are not), or running GuardDuty without Security Hub and ending up with a stream of findings nobody can normalize across CIS, PCI DSS, NIST 800-53, or HIPAA.
This comparison is written for security architects deploying AWS-native detection on regulated workloads.
The Core Distinction
Security Hub is the aggregation layer. It ingests findings from 30+ AWS services and 50+ partner tools (CrowdStrike, Wiz, Palo Alto Prisma, Lacework, Tenable, Qualys, Rapid7), runs continuous standards checks against the AWS Foundational Security Best Practices, CIS AWS Foundations, PCI DSS 4.0, NIST 800-53 r5, and HIPAA standards, and emits a single normalized severity score per finding. It does not produce its own threat-detection findings.
GuardDuty is the behavioral threat-detection layer. It analyzes CloudTrail management events, CloudTrail S3 data events, VPC Flow Logs, DNS query logs, EKS audit logs, RDS login events, and Lambda invocations — looking for cryptocurrency mining, credential exfiltration, anomalous API patterns, malware on EBS volumes, and EKS runtime compromises. It feeds findings into Security Hub.
The right way to think about it: GuardDuty is a finding source; Security Hub is a finding destination + standards evaluator.
What Each Service Detects
GuardDuty Foundation (CloudTrail-based):
- Anomalous IAM API patterns (suddenly listing all S3 buckets at 2 a.m. from a new IP)
- Credential compromise (CloudTrail events from regions you do not operate in)
- Cryptocurrency mining (Bitcoin protocol DNS queries)
- C2 communication (DNS queries to known threat-intel-listed domains)
- Recon activity (port scanning, IMDSv1 abuse)
GuardDuty Protection Plans (add-ons):
- S3 Protection — anomalous S3 data event patterns (mass GETs, unusual download volumes)
- EKS Protection — Kubernetes audit log analysis + runtime monitoring (kernel-level threat detection inside containers)
- RDS Protection — anomalous RDS login patterns (brute force, credential stuffing, unusual user behavior)
- Lambda Protection — anomalous Lambda invocation patterns
- EC2 Runtime Monitoring — kernel-level threat detection inside running EC2 instances (file access, process execution)
- Malware Protection — agentless EBS-snapshot malware scanning on triggered Lambda functions and EC2 instances
Security Hub:
- Finding aggregation across all AWS services + partner integrations
- Continuous standards checks (FSBP, CIS 1.4 + 2.0, PCI DSS 4.0, NIST 800-53 r5, HIPAA)
- Cross-account and cross-region centralization (delegated administrator pattern)
- Automation rules (auto-remediation, finding routing, custom severity overrides)
- Insight queries (custom dashboards over normalized findings)
Cost Comparison (2026)
GuardDuty Foundation is priced per CloudTrail management event and per GB of VPC Flow Logs / DNS analyzed. For a typical mid-market workload with 50M CloudTrail events/month, expect $200/month base. Protection plans:
- S3 Protection: $0.10–$1.00 per million S3 data events (scales with traffic)
- EKS Audit Log: $1.00 per million events
- EKS Runtime: $4.50 per vCPU per hour for monitored workloads
- RDS Protection: $0.20 per RDS login event
- Lambda Protection: per invocation, varies
- EC2 Runtime: ~$1.50 per vCPU per month (hourly metered)
- Malware Protection: $0.05 per GB scanned
Mid-market regulated workloads typically land at $300–$2,000/month for GuardDuty.
Security Hub Essentials (2025 reprice) bills per protected resource per month — $0.0010 per AWS resource per month for security checks, plus per-finding ingestion charges from external sources. Mid-market regulated workloads land at $300–$1,500/month. Unlimited control checks and findings within scope; cross-region aggregation included.
Combined typical mid-market spend: $600–$3,500/month for the GuardDuty + Security Hub pair on a regulated workload.
Decision Framework
Turn on Security Hub if you have any of:
- More than two AWS accounts (cross-account aggregation is the headline value)
- A compliance framework that asks for continuous controls evaluation (SOC 2 CC7, PCI DSS Req 10–11, HIPAA §164.308, ISO 27001 A.8.16)
- Partner security tools (CrowdStrike, Wiz, etc.) you want to centralize
- A SIEM or GRC tool that needs a single AWS-side feed
Turn on GuardDuty if you have any of:
- Production workloads (the answer is “always” for production)
- Internet-exposed resources (EC2, ALB, API Gateway, S3 with public read)
- IAM principals beyond a small core team (insider-threat coverage)
- Containers or Lambda in production
- RDS or Aurora handling regulated data
In practice: enable both on every regulated production workload from day one. The combined cost is a fraction of one breach, and the deployment is a single Terraform module.
Deployment Pattern We Use
For multi-account AWS Organizations:
- Designate the Security account as Security Hub delegated administrator — all findings aggregate there
- Enable GuardDuty Organization-wide with auto-enrollment on new accounts
- Enable Security Hub Organization-wide with the AWS Foundational Security Best Practices and any framework-specific standards (PCI DSS, NIST 800-53)
- Enable Macie selectively on accounts that hold sensitive data (full-account is overkill)
- Enable Inspector v2 on every account with EC2 / ECR / Lambda
- Wire EventBridge rules in the Security account to fan critical findings to PagerDuty and Slack
- Connect Security Hub to your GRC tool (Vanta, Drata, Secureframe) via the read-only integration
The full pattern is documented in our GuardDuty production guide, Security Hub setup guide, and Security & Compliance hub.
When You Outgrow Native AWS
Native AWS detection works for AWS-only estates. You start to need a third-party tool when:
- You span multi-cloud (AWS + Azure or GCP) and need a single posture view
- You need attack-path graphs (Wiz, Orca, Lacework) beyond per-finding severity
- Your SOC lives in Splunk, Sumo Logic, Microsoft Sentinel, or Google Chronicle and the integration cost of “Security Hub → SIEM” outweighs the duplication of a CSPM that lives in the SIEM directly
For most regulated SaaS, healthtech, and fintech in AWS-only estates, the native pair (GuardDuty + Security Hub + Inspector v2 + Macie) is the right call. We size up to a third-party CSPM only when one of the conditions above triggers it.
Related Reading
- AWS Cloud Security service — assessment, hardening, monitoring
- Managed SOC & MDR — 24/7 detection and response
- Threat Detection subtopic hub — full curated guide set
- Security & Compliance hub — frameworks, services, and tools
Frequently Asked Questions
Do I need GuardDuty if Security Hub is already on?
Yes — they are complementary, not redundant. Security Hub Essentials is the aggregator: it ingests findings from AWS services and partner tools, runs continuous standards checks (AWS Foundational Security Best Practices, CIS, PCI DSS 4.0, NIST 800-53 r5, HIPAA), and emits a normalized severity score. GuardDuty is one of those finding sources — it produces threat-detection findings (cryptocurrency mining, anomalous CLI activity, credential exfiltration, malware, EKS runtime threats) by analyzing CloudTrail, VPC Flow Logs, DNS logs, S3 data events, EKS audit logs, RDS login events, and Lambda invocations. Without GuardDuty, Security Hub still runs the standards checks but has no behavioral threat-detection feed.
What did Security Hub Essentials change in 2025?
AWS rearchitected Security Hub pricing in 2025. The new "Security Hub Essentials" tier moves from per-finding-ingested billing to per-protected-resource billing — unlimited checks and findings, billed per EC2 instance, container image, Lambda function, IAM principal, S3 bucket, or other protected resource per month. Most mid-market regulated workloads land at $300–$1,500/month. The change was significant for high-volume environments where finding ingestion costs had grown faster than budgets; it slightly increased cost for very small environments. Conformance pack overlap with AWS Config remains separate.
How is GuardDuty priced in 2026?
GuardDuty has a base price plus optional protection plans. Base: $4.00 per million CloudTrail management events plus VPC Flow Log and DNS log analysis at variable rates by region. Protection plans bill separately: GuardDuty S3 Protection ($0.10–$1.00 per million S3 data events), EKS Protection (audit log + runtime), RDS Protection (per RDS login event), Lambda Protection (per invocation), and EC2 Runtime Monitoring (per vCPU per hour). Most production workloads turn on CloudTrail, VPC, S3, and EKS protection — typical mid-market spend $300–$2,000/month.
Can Security Hub replace a SIEM like Splunk or Sumo Logic?
For AWS-only environments with light SOC operations, yes — Security Hub plus CloudTrail Lake or Security Lake on OCSF 1.1 covers the use cases most teams need. For multi-cloud environments, mature SOCs with custom correlation rules, or teams already running Splunk/Sumo for non-AWS log sources, Security Hub serves as a feeder rather than a replacement. The pattern that works: Security Hub aggregates AWS-side findings, Security Lake normalizes events to OCSF, and the SIEM ingests from Security Lake (or Security Hub via EventBridge) for cross-source correlation.
Where does Amazon Detective fit?
Detective is a separate service that pre-builds an entity graph from GuardDuty, VPC Flow Logs, CloudTrail, Route 53, and EKS audit logs. When a Security Hub finding lands and you need to investigate "what else has this IAM principal touched in the last 30 days?", Detective answers that question in clicks instead of CloudWatch Logs Insights queries. Most teams add Detective once GuardDuty findings exceed ~50/week or a security analyst is dedicated to AWS. Below that threshold, jumping to CloudTrail Lake queries is acceptable.
Do GuardDuty and Security Hub satisfy compliance audit evidence?
Yes for most frameworks. SOC 2 CC7.1 (system monitoring) and CC7.2 (anomaly detection) map directly to GuardDuty + Security Hub. PCI DSS 4.0.1 Req 10 (logging and monitoring) and Req 11 (testing) leverage both. HIPAA §164.308(a)(1)(ii)(D) (information system activity review) cites Security Hub findings continuously instead of point-in-time. ISO 27001:2022 A.8.16 (monitoring activities) maps to the combined output. Auditors increasingly accept Security Hub control status as evidence; some QSAs still ask for AWS Config rule evaluations to corroborate.
Not Sure Which AWS Service Is Right?
Our AWS-certified architects help engineering teams choose the right architecture for their workload, scale, and budget — before they build the wrong thing.