Free AWS Security Whitepaper
    Toc Consulting Logo
    compareguardduty-vs-inspector
    SECURITYPublished 2026-07-26
    Amazon GuardDutyAmazon GuardDuty
    vs
    Amazon InspectorAmazon Inspector

    GuardDuty vs Inspector: Key Differences and When You Need Both

    Threat detection and vulnerability management are two different jobs

    GuardDuty and Inspector get confused constantly because both surface "security findings" in your AWS console. They answer opposite questions. GuardDuty watches your logs and runtime activity to answer "is someone attacking me right now?" Inspector scans your EC2 instances, container images, Lambda functions, and code to answer "what could an attacker exploit?" One is a smoke detector, the other is a building inspector. Neither replaces the other, they bill on completely different dimensions, and in most real AWS accounts you want both running. Here is exactly what each one detects, how each is priced, and the order to enable them. If you also need Macie and Security Hub in the picture, see the full four-way comparison at guardduty-vs-inspector-vs-macie-vs-securityhub.

    Service Overview

    Amazon GuardDuty

    Amazon GuardDuty

    Threat Detection

    Detects active attacks: compromised credentials, crypto mining, C2 traffic, and multi-stage attack sequences correlated into a single Critical finding

    TypeReal-time threat monitoring
    Pricing$4.00/M CloudTrail events, $1.00/GB VPC Flow Logs & DNS (first 500 GB, us-east-1); protection plans priced separately
    Amazon Inspector

    Amazon Inspector

    Vulnerability Management

    Finds CVEs and unintended network exposure across EC2, ECR, and Lambda before attackers do, plus SAST, SCA, and IaC scanning for your code

    TypeContinuous vulnerability scanning
    Pricing$1.258/EC2 instance/month (agent-based, $1.75 agentless), $0.30/Lambda function/month, $0.09/ECR image scan + $0.01/rescan (us-east-1)

    Side-by-Side Comparison

    $ diff --side-by-side
    CriteriaGuardDutyInspector
    Question It AnswersIs someone attacking me right now?What could an attacker exploit?
    What It AnalyzesCloudTrail events, VPC Flow Logs, DNS queries, S3 data events, EKS audit logs, RDS logins, runtime activity on EC2/ECS/EKS, Bedrock and SageMaker invocationsSoftware packages on EC2 instances, ECR container images, Lambda functions and layers, source code repositories, IaC templates
    Detection MethodML, anomaly detection, and threat intelligence feeds; Extended Threat Detection correlates weak signals into attack sequencesMatching installed packages against CVE databases, plus network reachability analysis, SAST, and SCA
    When It FiresIn near real-time as malicious activity happens, correlating events over a 24-hour rolling windowContinuously: on resource discovery, on change (new package, new deploy), and when a new CVE affecting you is published
    Finding TypesThreat findings (severity 1.0-10.0) and attack sequence findings, always Critical, with MITRE ATT&CK mappingsVulnerability and network exposure findings with a contextualized Inspector risk score (CVSS adjusted to your environment)
    Agent RequiredNo agent for log-based detection; GuardDuty agent only for Runtime Monitoring on EC2, ECS, and EKSSSM Agent for agent-based EC2 scanning, or agentless snapshot-based scanning; no agent for ECR and Lambda
    Shift-Left / CI-CDNone, it watches production activity onlySAST, SCA, and IaC scanning for GitHub/GitLab repos, plus on-demand container image scanning in CI/CD at $0.03/image
    Auto-Remediation SignalFindings stay until you resolve and archive themAutomatically detects when you patch and closes the finding for you
    Malware & BenchmarksMalware Protection scans EBS volumes ($0.03/GB), S3 objects ($0.09/GB + $0.215 per 1,000 objects), and AWS Backup data for active malwareCIS Benchmark assessments for OS-level configuration at $0.03 per instance per assessment, plus SBOM export in standard formats
    Pricing DimensionVolume of logs and events analyzed (per million events, per GB, per vCPU for runtime)Number of resources scanned (per instance, per function, per image, per repo scan)
    Free Trial30 days15 days

    When to Use What

    $ cat DECISION_GUIDE.md
    IFIs GuardDuty a vulnerability scanner?
    THENNo, use Inspector for that
    WHYGuardDuty never looks at what software is installed on your instances. It analyzes activity: API calls, network flows, DNS queries, runtime behavior. It will catch an attacker exploiting a vulnerable service, but it will never tell you the CVE was there. Inspector is the AWS-native vulnerability scanner.
    IFDoes Inspector detect active attacks or intrusions?
    THENNo, that is GuardDuty's job
    WHYInspector is a vulnerability management service. It finds software vulnerabilities and unintended network exposure, and stops there. It has no threat intelligence, no anomaly detection, and no visibility into live traffic. An attacker actively exfiltrating data would sail past Inspector unnoticed.
    IFCan I use GuardDuty and Inspector together?
    THENYes, and you should
    WHYThey are complementary by design. Inspector shrinks your attack surface by finding exploitable weaknesses; GuardDuty catches whatever gets through anyway. Both publish findings to Security Hub, which correlates them: a vulnerable instance that is also showing threat activity becomes an exposure finding you triage first.
    IFYou can only enable one service today
    THENGuardDuty
    WHYZero configuration, no agents, and it starts producing threat findings within minutes of enablement. An unpatched CVE is a risk; an active compromise is an incident. Detect the incident first, then build out vulnerability management with Inspector.
    IFYou ship containers through CI/CD and want issues caught before deploy
    THENInspector
    WHYInspector scans ECR images on push ($0.09/image), rescans when new CVEs drop ($0.01), and offers on-demand scanning inside CI/CD pipelines at $0.03/image. GuardDuty only sees a container after it is running in ECS or EKS.
    IFAn EC2 instance has a critical CVE and is making odd outbound connections
    THENBoth, correlated
    WHYThis is the exact scenario where the pairing pays off. Inspector tells you the instance is exploitable, GuardDuty tells you it is likely already exploited. Treat it as an incident: isolate, investigate with the GuardDuty finding's MITRE ATT&CK context, then patch based on the Inspector finding.
    IFYou need malware scanning: which one covers it?
    THENGuardDuty, not Inspector
    WHYCounterintuitive but true. GuardDuty Malware Protection scans EBS volumes, S3 objects, and AWS Backup data for active malware, because malware on disk is evidence of a threat, not a CVE. Inspector looks for vulnerable software versions, not malicious files. Teams often assume the scanner handles malware; it does not.
    IFYou manage dozens of accounts in AWS Organizations
    THENBoth, via delegated administrator
    WHYEach service supports a delegated administrator account that enables coverage across the organization, auto-enrolls new member accounts, and aggregates findings centrally. Enable both org-wide from a dedicated security account rather than account by account, or coverage gaps will accumulate as teams spin up new accounts.

    Security Insights

    A clean Inspector dashboard does not mean you are safe

    Inspector only knows about published CVEs and misconfigurations. Stolen IAM credentials, a leaked access key used from an unusual network, or a phished console session involve zero CVEs and are invisible to Inspector. Only GuardDuty catches credential-based attacks, which is why running Inspector alone leaves your biggest real-world risk uncovered.

    Extended Threat Detection costs nothing extra

    When you enable GuardDuty, Extended Threat Detection is on by default at no additional cost. It correlates weak signals and existing findings across a 24-hour window into attack sequence findings (credential compromise, S3 data compromise, EKS/ECS cluster compromise, EC2 instance group compromise), all rated Critical. Enabling S3 Protection and Runtime Monitoring widens what it can correlate.

    Inspector is no longer just a CVE scanner

    Inspector now covers code security: SAST on your source, SCA on dependencies, and IaC scanning on your infrastructure templates, with GitHub and GitLab repository integration at $0.15/scan. If you were paying a separate tool for dependency scanning, check whether Inspector already covers it.

    The pricing models fail in opposite directions

    GuardDuty costs scale with activity: a noisy account with heavy CloudTrail and VPC Flow Log volume pays more even if tiny. Inspector costs scale with fleet size: 500 instances cost roughly 500 x $1.258/month regardless of how busy they are. Estimate both from your own numbers before enabling org-wide, and use the free trials (30 days GuardDuty, 15 days Inspector) to measure real spend.

    Runtime Monitoring blurs the line but does not erase it

    GuardDuty Runtime Monitoring puts an agent on EC2, ECS, and EKS to watch process behavior, which sounds like host security overlap with Inspector. It is not: the agent detects malicious behavior (crypto miners, reverse shells), it does not inventory packages or find CVEs. You still need Inspector for vulnerabilities even with Runtime Monitoring enabled.

    Key Takeaways

    $ cat SUMMARY.md
    1.GuardDuty detects active threats from logs and runtime activity; Inspector finds exploitable vulnerabilities before attackers do. Different questions, different tools.
    2.They are complements, not alternatives. Mature AWS accounts run both, feeding Security Hub.
    3.Enable GuardDuty first: zero config, findings within minutes, and Extended Threat Detection included free.
    4.Billing dimensions differ completely: GuardDuty bills on log and event volume analyzed, Inspector bills per resource scanned.
    5.Inspector expanded into code security (SAST, SCA, IaC, repo scanning), making it a shift-left tool as well as a production scanner.
    6.Neither one aggregates or scores compliance. For a single pane of glass, add Security Hub (see the guardduty-vs-security-hub comparison), and for the data security angle see the full four-way comparison with Macie.
    7.Use the free trials back to back on a representative account: 30 days of GuardDuty, then 15 days of Inspector, and read the usage pages before rolling either out organization-wide.
    Threat DetectionVulnerabilityCVERuntime Security

    Need Architecture Guidance?

    These comparisons are a starting point. Every architecture is different. Contact us for tailored AWS security assessments and architectural guidance.

    All ComparisonsGet in Touch