AWS Security Hub

Prioritizes your critical security issues and helps you respond at scale

Cybersecurity Cloud Infrastructure aws.amazon.com

Visit Website

Founded

2018

Starting Price

About AWS Security Hub

AWS Security Hub is Amazon Web Services' unified cloud security operations service. It combines security posture management (CSPM), vulnerability scanning powered by Amazon Inspector, threat detection powered by Amazon GuardDuty, and risk analytics into one console, correlating findings across AWS and Microsoft Azure to surface exposures and attack paths. Pricing is pay-as-you-go per resource unit, with optional add-ons and an Extended plan for curated partner security products billed through AWS.

Pros & Cons

Pros

Consolidates GuardDuty, Inspector, CSPM checks, and partner findings into one prioritized view instead of separate consoles
Native integration with AWS Organizations, multi-account, and cross-Region aggregation with no agents to deploy
Correlated exposure findings and attack paths help teams focus on genuinely exploitable risks rather than raw alert volume
Usage-based pricing with no upfront commitment, a 30-day free trial, and a cost estimator that analyzes your real resources
Extended plan lets you buy partner tools like CrowdStrike or Okta on the same AWS bill and count it toward EDP commitments

Cons

Setup and tuning across many accounts and standards is complex and can overwhelm teams new to AWS security services
Costs scale with resources and log volume; data processing and threat analytics can grow quickly in large environments
Multicloud support covers AWS and Azure only, with no native Google Cloud coverage
Pricing spans several dimensions (resource units, events, GB, partner rates), which makes budgeting harder than flat per-seat tools
Less intuitive than dedicated CNAPP vendors such as Wiz or Cortex Cloud, according to some reviewers

Key Features

Prioritized risk summary

Correlates and enriches signals from threat detection, vulnerability management, and posture checks to rank the most critical active risks in your environment.

Exposure findings and attack path analysis

Identifies combinations of issues, such as a publicly exposed resource with an exploitable vulnerability that can reach sensitive data, and maps the attack path.

Cloud security posture management (Security Hub CSPM)

Runs automated best-practice and compliance checks against AWS resources using standards such as CIS AWS Foundations and AWS Foundational Security Best Practices.

Vulnerability management

Includes Amazon Inspector scanning for EC2 instances, ECR container images, and Lambda functions, plus CIS Benchmark assessments, in the Essentials plan.

Multicloud coverage

Monitors Microsoft Azure virtual machines, functions, container images, and identities alongside AWS resources once you connect an Azure integration.

Security-focused resource inventory and AI inventory

Builds a security resource graph of your assets, including an inventory of AI resources, with network scanning and unused access findings.

Automation rules and automated response

Lets you suppress, update, or route findings automatically and trigger remediation workflows at scale across accounts.

Multi-account and cross-Region aggregation

Aggregates findings across AWS Organizations accounts and Regions into a single administrator view.

OCSF-based findings format

Normalizes findings into the Open Cybersecurity Schema Framework so you can analyze them and send them to SIEM and ticketing tools.

Extended plan partner marketplace

Lets you buy curated partner security products (for example CrowdStrike, SentinelOne, Okta, Zscaler, Proofpoint) from the console with pay-as-you-go pricing on one AWS bill.

Pricing

Free Trial

$0/30 days

Essentials plan capabilities for 30 days
Free trial per AWS account in each Region
Available even if you used Security Hub CSPM or Inspector trials before
Separate 30-day trial for Azure monitoring
Add-ons and Extended plan not included

Essentials

$3.75/resource unit/month

Risk analytics, finding prioritization, and security resource graph
Exposure findings, AI inventory, network scanning, unused access findings
Security Hub CSPM posture checks and automation rules
Inspector EC2, ECR, and Lambda standard scanning plus CIS Benchmark assessments
1 EC2 instance or Azure VM = 1 unit; 12 Lambda functions, 18 container images, or 125 IAM users/roles = 1 unit
Multicloud (Azure) coverage; pro-rated by time monitored

Threat Analytics Add-on

$4/million events

GuardDuty-powered ML threat detection on CloudTrail management events
Data events, VPC Flow Logs, DNS logs, and EKS audit logs billed per GB (from $0.55/GB for the first 1,000 GB)
Runtime activity monitoring for EKS, ECS, and EC2
Requires the Essentials plan

Extended Plan

Custom

23 curated partner solutions across 10 security categories
Pay-as-you-go per partner, no upfront cost
Single consolidated AWS bill
Eligible toward AWS PPA / EDP commitments
Charged in addition to Essentials

Best For

Centralized cloud security operations

Security teams running many AWS accounts aggregate posture, vulnerability, and threat findings into one administrator account to triage from a single queue.

Compliance posture monitoring

Organizations track CIS, PCI DSS, NIST, and AWS best-practice controls continuously and report on drift across accounts and Regions.

Exposure and attack path prioritization

Cloud security engineers find resources that combine public exposure, exploitable vulnerabilities, and access to sensitive data, then fix those first.

Automated remediation at scale

Teams use automation rules and EventBridge-driven workflows to suppress noise, route findings to ticketing, and auto-remediate common misconfigurations.

Consolidating security vendor procurement

AWS-centric enterprises buy endpoint, identity, email, and SIEM partner products through the Extended plan to simplify billing and use existing AWS commitments.

Tags:cloud security cspm aws vulnerability management threat detection compliance security operations multicloud