Security Hub

AWS Security Hub is a centralized security dashboard that aggregates findings from multiple AWS security services and third-party tools. It provides automated compliance checks against standards like CIS AWS Foundations Benchmark, AWS Foundational Security Best Practices (FSBP), and PCI DSS.

Key Features

• Aggregates findings from GuardDuty, Inspector, Macie, Firewall Manager, IAM Access Analyzer, and 60+ partner integrations
• Automated security checks against compliance frameworks
• Security score (0-100%) per standard
• Cross-region and cross-account aggregation
• Historical trend data (up to 1 year) and near real-time risk analytics (since December 2025)
• Automated response via EventBridge integration

How It Goes Wrong in Practice

The most common Security Hub failure is not technical, it is organizational: the service gets enabled, produces hundreds of failed control findings on day one, and nobody owns them. Six months later the dashboard shows the same failed controls plus new ones, the security score has become background noise, and the one finding that matters (an S3 bucket that went public last Tuesday) is buried under 400 known issues nobody triaged. Enabling Security Hub without a triage workflow produces a dashboard, not a security program. The fix is boring and effective: assign ownership per account or per control family, suppress findings only with a documented justification, and wire high-severity findings to a ticket queue or chat channel through EventBridge so they interrupt someone.

The second pattern is partial coverage. Security Hub findings are regional, so enabling it in your home region while workloads (or an attacker) operate in another region leaves blind spots. The same applies across accounts: without an organization-wide rollout and a delegated administrator account, each team sees only its own slice. Use cross-region aggregation to pull findings into a single aggregation region, and enable the service in every region you have not disabled at the SCP level.

Third, score-chasing. Teams disable controls or suppress findings to make the compliance score green before an audit, without compensating controls. The score is an indicator, not the objective; a 95% score with the remaining 5% being public databases is worse than an honest 80%.

A Practical Check

Verify which standards are actually enabled in the current region:

aws securityhub get-enabled-standards

The output lists your StandardsSubscriptions with the StandardsArn and a StandardsStatus field that should read READY. An empty list means Security Hub may be enabled but is running no compliance checks at all, which surprises more teams than it should. If you only care about one standard, pass its subscription ARN via --standards-subscription-arns to query it directly. Run the same check in each active region, and compare the enabled standards against what your compliance program claims.

Frequently Asked Questions

Does Security Hub detect threats itself? Mostly no. Threat detection is GuardDuty's job: it analyzes CloudTrail, VPC Flow Logs, and DNS activity for malicious behavior. Security Hub's own contribution is configuration checking: it evaluates your resources against control standards and aggregates everything (GuardDuty threats, Inspector vulnerabilities, Macie data findings, partner tools) into one normalized finding format. You need both: GuardDuty tells you someone is attacking, Security Hub tells you which doors were left open, and the aggregated view gives responders one place to look.

Do I need Security Hub in every region? Findings and checks are regional, so yes, enable it wherever you run workloads, and realistically in all commercial regions you have not blocked, since attackers deliberately use quiet regions. Cross-region aggregation then consolidates findings into a single region so your team monitors one dashboard instead of twenty.

What is the difference between Security Hub and AWS Config? They work together rather than compete. Config records resource configurations and evaluates individual rules; Security Hub packages security-focused checks into managed standards (CIS, FSBP, PCI DSS), scores them, and merges the results with findings from detection services. If you want raw configuration history and custom rules, that is Config; if you want a managed security posture view with compliance scoring, that is Security Hub.

How do I automate responses to findings? Security Hub emits findings as events to EventBridge. From there you route by severity or control ID to remediation targets: a Lambda function that removes a public ACL, an SSM automation document that enables bucket encryption, or simply a notification into the on-call channel. Start with notifications, prove the signal quality, then automate the repetitive fixes.