Amazon GuardDuty
AWS Security HubGuardDuty vs Security Hub: What Each One Actually Does
One detects threats, the other makes sense of everything
GuardDuty and Security Hub sit next to each other in the AWS console and both fill up with "findings", so teams regularly ask which one to enable. Wrong question. GuardDuty is a detector: it analyzes CloudTrail, VPC Flow Logs, DNS, and runtime activity to generate threat findings when something malicious happens. Security Hub is an aggregator and posture manager: it collects findings from GuardDuty, Inspector, Macie, and dozens of partner tools, runs its own compliance checks against standards like CIS and PCI DSS, and correlates everything into prioritized exposure findings with attack path visualization. Turning on Security Hub without any detectors gives you compliance scores and little else; running GuardDuty without Security Hub works fine but leaves findings siloed. This page breaks down what each actually does, how each is billed, and why the real answer is both. Comparing GuardDuty against Inspector instead? See guardduty-vs-inspector, or the full four-way comparison including Macie.
Service Overview
Amazon GuardDuty
Threat DetectionGenerates original threat detections from raw logs and runtime activity using ML and threat intelligence, no other service required
AWS Security Hub
Security PostureSingle pane of glass: aggregates findings from every detector, scores compliance against CIS/FSBP/PCI/NIST, and correlates signals into exposure findings
Side-by-Side Comparison
| Criteria | GuardDuty | Security Hub |
|---|---|---|
| Primary Role | Detector: generates threat findings from raw telemetry | Aggregator and CSPM: collects, normalizes, correlates, and scores findings from other services |
| Data It Consumes | CloudTrail events, VPC Flow Logs, DNS logs, S3 data events, EKS audit logs, RDS login activity, runtime events, Bedrock/SageMaker activity | Findings from GuardDuty, Inspector, Macie, Security Hub CSPM, IAM Access Analyzer, and third-party tools, in ASFF/OCSF formats |
| Detections It Originates | Threat findings and attack sequence findings from ML, anomaly detection, and threat intelligence | Control findings from compliance checks, plus exposure findings created by correlating other services' signals; it does not detect threats from raw logs itself |
| Compliance Standards | None, findings map to MITRE ATT&CK, not compliance frameworks | AWS Foundational Security Best Practices, CIS, PCI DSS, NIST, with per-standard security scores |
| Exposure & Attack Path Analysis | Attack sequences within GuardDuty's own findings (24-hour window) | Exposure findings correlating vulnerabilities, misconfigurations, threats, and network reachability across services, with attack path and blast radius visualization |
| AI-Related Capability | AI Protection: detects anomalous Bedrock and SageMaker model invocations and prompt injection attempts | AI Inventory: organization-wide view of AI assets (Bedrock, SageMaker, self-hosted) and their security posture |
| Works Standalone? | Yes, fully. Detects threats with zero other services enabled | Partially. Compliance checks run alone (most need AWS Config recording), but without detectors feeding it there is little to aggregate |
| Automation | Findings export to EventBridge and S3 for custom response | Automation rules to enrich or suppress findings at scale, plus EventBridge custom actions for ticketing and remediation |
| Multi-Account | Delegated administrator via Organizations | Delegated administrator plus cross-region aggregation into one home region |
| Pricing Dimension | Volume of logs and events analyzed | CSPM: number of security checks and ingested findings; Essentials plan: monitored resource units ($3.75/unit/month, where 1 EC2 = 1 unit, 12 Lambda functions = 1 unit, 18 ECR images = 1 unit, 125 IAM users/roles = 1 unit) |
| Free Trial | 30 days | 30 days |
When to Use What
Security Insights
Detector vs aggregator is the whole story
Every confusion about these two services dissolves once you place them in the pipeline: GuardDuty (and Inspector, and Macie) produce findings; Security Hub consumes, normalizes, correlates, and prioritizes them. They occupy different layers of the same architecture, which is why "vs" is really "and".
There are now two Security Hub products, priced differently
AWS Security Hub CSPM is the classic product: billed per security check ($0.0010 each for the first 100K, then $0.0008) and per ingested finding ($0.00003/event after the first 10,000 free per month). The newer unified Security Hub Essentials plan is billed per monitored resource unit at $3.75/unit/month with checks and ingestion included, plus a usage-based Threat Analytics add-on. Check which one you are enabling before estimating cost.
Exposure findings are where aggregation becomes analysis
Security Hub generates an exposure finding when signals from Security Hub CSPM, Inspector, GuardDuty, Macie, or other services combine into a real risk: for example a vulnerable, internet-reachable instance whose IAM role carries unused permissions. It includes attack path visualization and blast radius, which no single detector can produce on its own.
Most Security Hub compliance checks depend on AWS Config
Security Hub CSPM uses service-linked AWS Config rules for most controls, so AWS Config must be enabled and recording resources. Teams that enable Security Hub without Config wonder why control findings never appear. Budget for Config recorder costs alongside Security Hub itself.
GuardDuty findings gain context inside Security Hub
A GuardDuty attack sequence finding viewed in Security Hub is enriched with resource configuration details, related findings from other services, and correlation context. Triage in Security Hub, then pivot into GuardDuty for the detection detail and MITRE ATT&CK mapping.
OCSF makes Security Hub the export point for your SIEM
Security Hub uses the Open Cybersecurity Schema Framework, so findings from GuardDuty and every other integrated source leave AWS in one standardized format. If you feed a SIEM or data lake, integrate it with Security Hub once instead of building a separate export pipeline per detector.
Key Takeaways
Related Content
Need Architecture Guidance?
These comparisons are a starting point. Every architecture is different. Contact us for tailored AWS security assessments and architectural guidance.