AWS has a lot of security services with similar-sounding names, and the naming changed again in late 2025. If you are an IT manager or CTO trying to work out which ones you actually need, this is the short version: GuardDuty watches for attacks in progress, Inspector finds vulnerable software, Security Hub CSPM checks your configuration against best practice, and the newer Security Hub pulls all of that together and ranks it by risk.
For the CLI commands to check whether each is enabled in your account, see the AWS security baseline checklist.
Amazon GuardDuty: threat detection
GuardDuty is a managed threat detection service. It analyses activity in your account and raises findings when something looks like an attack: an EC2 instance contacting a known command-and-control server, an IAM credential used from an unusual location, API calls that look like reconnaissance, crypto-mining, or S3 data being accessed in an unusual pattern.
Its foundational detection uses CloudTrail management events, VPC flow logs and DNS query logs. You do not need to turn those logs on yourself for GuardDuty to read them. On top of that are optional protection plans for S3 data events, EKS audit logs, runtime monitoring for EC2, ECS and EKS, RDS login activity, Lambda network activity and malware scanning of EBS volumes and S3 objects.
GuardDuty answers the question: is someone doing something bad in my account right now? It does not tell you that your software is out of date or that a bucket is misconfigured, unless that misconfiguration is being actively abused.
Amazon Inspector: vulnerability management
Inspector continuously scans workloads for known software vulnerabilities (CVEs) and unintended network exposure. It covers EC2 instances (with the SSM agent, or agentless via EBS snapshots), container images pushed to Amazon ECR, and Lambda functions, including optional scanning of Lambda code. When a new CVE is published, Inspector re-evaluates what you already have, so you do not need to schedule scans.
Inspector answers the question: what in my environment has a known vulnerability, and how exposed is it? It is most useful in the first hours of an incident like PHP2Shell, when you need a list of affected instances and images. Its limits are worth knowing: it relies on package metadata, so software compiled from source or bundled inside an application may not show up.
Security Hub CSPM: configuration checks
Until late 2025 this was just "Security Hub". AWS renamed it AWS Security Hub CSPM (cloud security posture management). It runs automated checks against security standards you choose, including AWS Foundational Security Best Practices, CIS AWS Foundations Benchmark, PCI DSS and NIST SP 800-53, and reports controls that fail: an S3 bucket without Block Public Access, an RDS instance that is publicly accessible, a security group open to the internet on SSH.
Security Hub CSPM uses AWS Config to evaluate many of its checks, so Config needs to be recording in each Region where you use it. Findings use the AWS Security Finding Format (ASFF). It answers the question: is my account configured the way AWS and common frameworks recommend?
AWS Security Hub: the unified view
The new AWS Security Hub went generally available in December 2025 after a preview at re:Inforce 2025. It sits above the others. It takes posture findings from Security Hub CSPM, vulnerabilities from Inspector, threats from GuardDuty and sensitive-data findings from Macie, and correlates them into exposures: for example, an EC2 instance that is reachable from the internet, has a critical vulnerability, and has an IAM role with broad permissions. Each exposure comes with the contributing factors, a potential attack path, and remediation guidance.
It also adds a summary dashboard with up to a year of trend data, a coverage view showing where security services are not enabled, and integrations with Jira and ServiceNow. Findings use the Open Cybersecurity Schema Framework (OCSF). According to AWS, the exposure and correlation features need Security Hub CSPM and Inspector enabled; enabling Security Hub turns on Security Hub CSPM automatically, while Macie is not enabled automatically.
It answers the question: of everything the other services found, what should I fix first? For a small team with hundreds of findings, that prioritization is the main value.
Where they overlap
| Service | Looks at | Finds | Best for |
|---|---|---|---|
| GuardDuty | CloudTrail, VPC flow, DNS, optional runtime/S3/EKS/RDS data | Active threats and suspicious behaviour | Knowing you are under attack |
| Inspector | EC2 packages, ECR images, Lambda functions | Known CVEs and network reachability | Patch prioritization |
| Security Hub CSPM | Resource configuration via AWS Config | Failed best-practice controls | Hardening and compliance evidence |
| Security Hub | Findings from the above plus Macie | Correlated, risk-ranked exposures | Deciding what to fix first |
There is some overlap. Inspector reports network reachability, and Security Hub CSPM flags open security groups, so you may see related findings from both. GuardDuty and Security Hub CSPM both care about root user activity. That overlap is why the correlation layer exists. Two other services fill gaps none of these cover: IAM Access Analyzer (resources shared outside your account) and CloudTrail itself, which is the audit record everything else depends on.
How the billing works, in words
We are deliberately not quoting prices here: they vary by Region and change. The shape of the billing is what matters for planning.
- GuardDuty bills on volume: how many CloudTrail events, how many gigabytes of flow and DNS logs, and for the optional plans, the volume of S3 or EKS events, vCPUs monitored, or data scanned for malware. A busy account with chatty workloads costs more than a quiet one. New accounts get a 30-day free trial per Region.
- Inspector bills per workload: the average number of EC2 instances scanned per month, container images scanned on push and on rescan, and Lambda functions covered. New accounts get a 15-day free trial.
- Security Hub (new) uses resource-based pricing. An Essentials plan is required and is charged per monitored resource, with EC2 instances counting as a full unit and Lambda functions, container images and IAM users and roles counting as fractions. Under this plan, charges for Inspector and Security Hub CSPM are consolidated into Security Hub. An optional threat analytics add-on is priced on the volume of data analysed. There is a 30-day free trial for the Essentials capabilities.
- AWS Config, which Security Hub CSPM depends on, has its own charges based on configuration items recorded and rule evaluations.
The practical advice: turn services on, watch the first two weeks of usage in Cost Explorer during the free trial, and set a budget alert. AWS publishes a cost estimator in the Security Hub console. Check the current AWS Security Hub pricing page before committing.
Enabling them across an AWS Organization
If you have more than one AWS account, enable these through AWS Organizations rather than account by account. The pattern is the same for each service:
- From the organization management account, designate a delegated administrator account, usually a dedicated security or audit account. AWS recommends using the same delegated administrator for all security services.
- From the delegated administrator, turn on auto-enable so that existing and new member accounts are covered.
- Repeat for every Region you use, because all of these services are Regional. Security Hub lets you pick an aggregation Region to see findings from all Regions in one place.
These are changes, not checks. Review them before running, and run them from the right account:
# CHANGES: run from the organization management account, once per Region
aws guardduty enable-organization-admin-account --admin-account-id 111122223333 --region eu-west-2
aws inspector2 enable-delegated-admin-account --delegated-admin-account-id 111122223333 --region eu-west-2
# --feature SecurityHubV2 designates the admin for the new Security Hub; omit it for Security Hub CSPM
aws securityhub enable-organization-admin-account --admin-account-id 111122223333 --feature SecurityHubV2 --region eu-west-2
# CHANGE: then, from the delegated admin account, auto-enable GuardDuty for all members
aws guardduty update-organization-configuration --region eu-west-2 \
--detector-id <admin-detector-id> --auto-enable-organization-members ALLFor the new Security Hub, AWS manages enablement and configuration through AWS Organizations policies; central configuration in the older style is supported for Security Hub CSPM. If Security Hub CSPM already has a delegated administrator, the new Security Hub uses the same one. The Security Hub FAQ explains the rules if you are migrating an existing setup.
What we recommend for a small or mid-sized business
- Turn on GuardDuty in every enabled Region, even ones you do not use. Unused Regions are cheap to monitor and are where stolen keys often get used.
- Turn on Inspector wherever you run EC2, containers or Lambda.
- Enable Security Hub (which brings Security Hub CSPM) with the AWS Foundational Security Best Practices standard, and route critical findings to a person through EventBridge, email or your ticketing system.
- Make sure CloudTrail and IAM Access Analyzer are on too. They are not optional extras.
- Then budget a few hours a month to actually read and close findings. A dashboard nobody looks at protects nobody.
HashTech Systems enables and reviews these services as part of its AWS Security Health Check, described on our Cybersecurity page.
