Global Tool Radar

Security & Privacy / Cloud Security Posture Management (CSPM) Software

AWS Security Hub Review, Pricing, Pros & Cons

AWS Security Hub is a unified cloud security service whose Essentials plan combines Security Hub CSPM, Amazon Inspector vulnerability management, security-focused inventory, contextual exposure analytics, and response workflows under resource-unit pricing.

Research by Global Tool Radar Research SystemEvidence checked: Aug 10, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Visit product websiteChoose similar tools to compare

Buying snapshot

Quick buying snapshot

A compact view of who this tool fits, what it costs, and what to confirm before choosing it.

Best for
  • Your primary cloud estate is AWS and security teams need one operational view across accounts and Regions: Security Hub combines organization administration, cross-Region aggregation, posture findings, vulnerability findings, inventory, trends, and exposure prioritization.
  • Teams need contextual prioritization beyond lists of failed controls and vulnerabilities: Exposure findings map attack paths and combine reachability, exploitability, permissions, criticality, resource relationships, and available data context.
More buying conditions
  • The organization also operates Azure and accepts AWS-led multicloud administration: The Azure connector supports posture controls, resource discovery, exposure context, and active Network Scanning under the Essentials resource model.
  • Response teams already use AWS automation, Jira Cloud, or ServiceNow: Security Hub supports automated finding rules, EventBridge-driven actions, and direct ticketing workflows with organization-aware routing.
Not for
  • You need native posture depth across AWS, Azure, and Google Cloud in one policy plane: Current official Security Hub material establishes AWS and Azure coverage but not Google Cloud, and Azure standards cannot be placed in CSPM configuration policies.
  • You want a complete compliance audit and evidence-management system: Security Hub performs automated checks and helps prepare for audits, but AWS explicitly states that a perfect standard score does not mean an audit will pass.
More buying conditions
  • You cannot operate AWS Config or related cross-account and cross-Region prerequisites: The CSPM component requires AWS Config resource recording for most configuration checks, and organization-wide rollout needs deliberate policy, role, account, and Region configuration.
  • Procurement requires a fixed total price before the resource estate and optional service usage are known: The core rate is public, but total cost varies with resource-unit conversions, monitored time, Regions, and optional threat, code, data, and partner capabilities.
Pricing
  • The required Essentials plan uses pay-as-you-go, pro-rated resource-unit pricing with unlimited included scans. One EC2 instance or Azure VM equals one unit; Lambda functions, container images, and identities use published conversion ratios. Threat analytics, Lambda code scanning, and Extended partner solutions are separately priced enhancements.
  • Essentials plan · $3.75 USD · per resource unit · per month · usage based
Free or trial access
  • AWS provides a 30-day Essentials plan trial for every AWS account in each enabled Region, including accounts that previously used Security Hub CSPM or Inspector trials. Azure monitoring receives its own 30-day trial after integration. Threat Analytics, Lambda code scanning, and the Extended plan are excluded.

Product scope

Product functionality and purchase scope

This profile evaluates the current unified AWS Security Hub and its required Essentials plan as the exact target. Essentials combines Security Hub risk and exposure analytics, AWS Security Hub CSPM posture management, Amazon Inspector vulnerability management, a security-focused resource inventory, and response workflows. Optional AWS and partner capabilities are separated from the core plan.

Product checked: Aug 10, 2026

Functionality reviewed
  • Security Hub Essentials risk and exposure analytics, resource inventory, posture management, vulnerability management, and security response management
  • AWS Security Hub CSPM continuous standards checks, security scores, finding aggregation, configurable control parameters, automation rules, and EventBridge actions
  • Amazon Inspector EC2, ECR container image, Lambda standard vulnerability scanning, and CIS assessment capabilities included in Essentials
  • AWS and connected Microsoft Azure posture, inventory, exposure, and Network Scanning capabilities where supported
  • AWS Organizations delegated administration, configuration policies, and cross-Region aggregation
  • OCSF and ASFF finding workflows, APIs, AWS CLI, SDKs, EventBridge, Jira Cloud, ServiceNow, and supported partner integrations
  • Pay-as-you-go Essentials resource-unit pricing and the 30-day Essentials trial
Non-target functionality excluded from scoring
  • Threat Analytics powered by Amazon GuardDuty, which is an optional usage-priced add-on
  • Amazon Inspector Lambda code scanning, which is an optional separately priced capability
  • Amazon Macie sensitive-data discovery, which is a separate AWS service and is not automatically included as an Essentials entitlement
  • Extended plan partner solutions across endpoint, identity, email, network, data, browser, cloud, AI, and security operations
  • Standalone AWS Security Hub CSPM, Amazon Inspector, Amazon GuardDuty, and Amazon Macie individual-service pricing when unified Security Hub is not enabled
  • AWS Audit Manager evidence collection and full audit management
  • AWS Config charges or operations outside the controls and service-linked rules included by Security Hub
  • Google Cloud posture management, which is not established by current official Security Hub sources
Purchase paths

Pricing checked: Aug 10, 2026

  • Individual AWS security services: When unified Security Hub is not enabled for an account, buyers can operate and pay separately for Security Hub CSPM, Amazon Inspector, Amazon GuardDuty, and Amazon Macie. This route does not include unified Security Hub exposure correlation, trends, resource inventory, or streamlined Essentials pricing.

Pricing plans

AWS Security Hub pricing table

Pricing checked: Aug 10, 2026

Official factConfidence 99%1 linked source

Security Hub has one current core offer: the required Essentials plan. AWS publishes a USD 3.75 monthly resource-unit rate in its US East example and pro-rates charges for monitored time. Total spend depends on the mix of EC2 or Azure VMs, Lambda or Azure functions, ECR or Azure container images, IAM or Azure identities, Regions, and optional capabilities. Accounts without unified Security Hub can continue using separately billed AWS security services, but they do not receive the same automated correlation and unified pricing.

Official pricing page
PlanPriceKey differencesBest for
Essentials plan
  • $3.75 USD · per resource unit · per month · usage based
  • Resource-unit conversions: 1 EC2 instance or Azure VM; 12 Lambda functions or Azure Function Apps; 18 ECR or Azure container images; 125 IAM users and roles or Azure identities; Each listed quantity equals one billable resource unit; all other supported monitored resource types are included.
  • Prorated monitoring: Charges are prorated for monitored time; Monthly cost changes with active resource counts and monitored duration.
AWS-centered teams that need the required unified foundation for posture, vulnerability, inventory, exposure, and response workflows across AWS and connected Azure resources.
Variable usage cost

Usage cost scenarios

Calculate additional usage only where the plan allowance, unit, and period are established. Published rates are shown separately when an estimate is not available.

Threat Analytics CloudTrail management events

$4.00 USD / 1,000,000 CloudTrail management events

Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.

Threat Analytics logs first monthly tier

$0.55 USD / GB of data events, network activity, and other logs

Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.

Threat Analytics logs second monthly tier

$0.25 USD / GB of data events, network activity, and other logs

Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.

Threat Analytics logs third monthly tier

$0.10 USD / GB of data events, network activity, and other logs

Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.

This calculation compares usage with the published allowance on the same unit and period basis. It excludes taxes, negotiated terms, and unverified packaging conditions.

What is included, connected, or sold separately

Product scope

What is included, connected, or sold separately

Material capabilities are separated by their verified relationship to the target product.

AWS and Azure posture checks and security scoresRelationship not verified

Security Hub CSPM is the included posture-management component; most checks require AWS Config recording.

Plan: Essentials plan: Not verifiedAWS Security Hub CSPM
Official source
Active public internet reachability scanning for AWS and AzureRelationship not verified

Included at no additional cost in supported commercial Regions; existing customers must enable it and exclusions can be tagged.

Plan: Essentials plan: Not verified
Official source
Audit evidence collection and assessment managementRelationship not verified

Security Hub control results support audit preparation but do not establish complete evidence management or guarantee audit success.

AWS Audit Manager
Official source
Contextual exposure findings and attack-path analysisRelationship not verified

Context depth depends on enabled contributing sources; GuardDuty threat and Macie sensitive-data signals are not treated as free core entitlements.

Plan: Essentials plan: Not verified
Official source
Curated partner security solutionsRelationship not verified

Partner products remain distinct solutions with their own category, unit, minimum, trial, and usage terms.

Plan: Essentials plan: Not verifiedAWS Security Hub Extended plan partner solutions
Official source
EC2, ECR, Lambda standard, and Azure workload vulnerability managementRelationship not verified

The included Inspector capabilities are bounded by the pricing comparison; Lambda application code scanning is separate.

Plan: Essentials plan: Not verifiedAmazon Inspector
Official source
GuardDuty-powered threat analyticsRelationship not verified

Usage-priced enhancement for CloudTrail, VPC, DNS, S3, EKS, Lambda, and related threat signals; it cannot be used without Essentials.

Plan: Essentials plan: Not verifiedAmazon GuardDuty
Official source
Jira Cloud finding ticketingRelationship not verified

Manual or automated ticket creation requires a separately purchased Jira Cloud subscription and connector configuration.

Jira Cloud
Official source
Lambda application code vulnerability scanningRelationship not verified

Separately priced per Lambda function; no numeric amount is retained from the public pricing state.

Plan: Essentials plan: Not verifiedAmazon Inspector
Official source
Microsoft Azure posture and resource integrationRelationship not verified

Requires an Azure connector, permissions, data collection, selected scope, and Azure standards; the same resource-unit pricing applies to Azure equivalents.

Plan: Essentials plan: Not verifiedMicrosoft Azure
Official source
Resource configuration recording for CSPM checksRelationship not verified

AWS Config recording is required for most CSPM controls and must be configured separately from Security Hub configuration policies.

AWS Config
Official source
Sensitive-data discovery contextRelationship not verified

Security Hub can correlate Macie signals, but Macie is not automatically enabled or treated as included Essentials licensing.

Amazon Macie
Official source
ServiceNow ITSM finding ticketingRelationship not verified

Requires a separate ServiceNow ITSM subscription, application, credentials, Secrets Manager, KMS permissions, and connector configuration.

ServiceNow ITSM
Official source
How the score is calculated

Scoring method

How the score is calculated

The score uses the category-specific buying dimensions below and their displayed weights.

This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.

Evidence confidence
76%
AI claim confidence
99%
Required-field evidence status
100%
Evidence freshness
54%
Field traceability
100%
Model agreement
95%
Why this confidence level
  • Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
  • Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
  • 8 of 8 weighted claims have evidence links.
  • 0 A1 documentary official sources and 11 A2 official product sources are linked.
  • 2 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
  • 4 weighted claims are past the review window.
  • No blocking evidence conflict was identified.
Cloud coverage and visibility18%
82

Security-focused inventory, Active Network Scanning for publicly reachable AWS and Azure resources, delegated administration for up to 10,000 accounts, and cross-Region aggregation provide broad visibility when Regions and connectors are enabled.

Detection and policy depth18%
82

Provides configurable control parameters and continuous checks on AWS resources, while Azure checks are managed under distinct, disconnected policies.

Risk prioritization and context16%
87

Risk analytics combine vulnerability signals with exposure context such as attack paths, exploitability, reachability, and permissions to inform prioritization decisions.

Remediation operations15%
76

Automation rules, EventBridge response, and ticketing integrations support remediation operations, but the service does not by itself guarantee resource changes because action execution still depends on external automation or people.

Compliance and governance13%
75

Identifies compliance posture gaps through automated checks, but does not prove full audit compliance or replace evidence collection workflows.

Integrations and reporting10%
80

Exports findings using ASFF, OCSF, and APIs to external ticketing systems, but the enhanced Security Hub interface cannot ingest third-party findings directly.

Support and total cost10%
65

Pay-as-you-go Essentials pricing at the published USD 3.75 per resource unit per month with proration and a 30-day trial keeps entry flexible, but total cost scales with all monitored units plus separately priced Threat Analytics, Lambda code scanning, Macie, Extended solutions, and integrations.

Public review signals

AWS Security Hub is rated strongly for native consolidation, with recurring setup and cost cautions

Current exact-product aggregates are favorable across G2 and TrustRadius. Both sources support centralized AWS security visibility and compliance monitoring as the main value, while setup complexity, finding volume, reporting depth, and cost planning remain recurring buyer concerns.

Public review signals updated: Aug 10, 2026

Commonly reported strengths

  • Centralized security findings and posture visibility across AWS services and accounts
  • Automated compliance checks and standards-based monitoring
  • Useful integration with AWS security and response services

Commonly reported concerns

  • Initial multi-account and multi-Region configuration can be complex
  • Finding volume and reporting require tuning and operational discipline
  • Cost can become difficult to manage as coverage and services expand
G24.4/5
Review count
29 reviews
Source context
AWS Security Hub on G2Exact product
View sourceHistory baseline established: Aug 10, 2026
TrustRadius9/10
Reviews and ratings
21 reviews and ratings
Source context
AWS Security Hub on TrustRadiusExact product
View sourceHistory baseline established: Aug 10, 2026
Score79
Pricing modelThe required Essentials plan uses pay-as-you-go, pro-rated resource-unit pricing with unlimited included scans. One EC2 instance or Azure VM equals one unit; Lambda functions, container images, and identities use published conversion ratios. Threat analytics, Lambda code scanning, and Extended partner solutions are separately priced enhancements.
Use caseprioritize and respond to cloud security risks by combining posture, vulnerability, exposure, inventory, and response workflows across AWS and connected Microsoft Azure environments
Company sizeEnterprise, Mid-market, Small business
Structured tags

AWS Security Hub tag profile

Company size
  • Enterprise
  • Mid-market
  • Small business
Key features

AWS Security Hub core capabilities

  • Required Essentials foundation combining CSPM, vulnerability management, security-focused inventory, risk analytics, and response management
  • Continuous AWS and Azure standards checks with configurable control parameters and security scores
  • Contextual exposure findings with attack paths, blast radius, exploitability, reachability, permissions, and remediation guidance
  • Active Network Scanning for publicly reachable AWS and Azure resources in supported commercial Regions
  • AWS Organizations delegated administration for up to 10,000 member accounts and cross-Region aggregation
  • Automation rules, EventBridge response, and Jira Cloud or ServiceNow ticketing
Detailed strengths and purchase cautions
Pros

Why it is worth considering

  • Combines cloud security posture, vulnerability management, inventory, exposure analytics, and response workflows under a unified resource-unit billing structure.
  • Delivers comprehensive exposure findings that map attack paths, blast radius, exploitability, reachability, and permissions context.
  • Enables delegated administration through AWS Organizations for up to 10,000 member accounts with cross-Region aggregation.
Cons

What to confirm before buying

  • Provides no native support or control plane capabilities for Google Cloud environments.
  • Requires separate connectors and distinct controls for Microsoft Azure, and Azure standards cannot be managed via CSPM configuration policies.
  • Remediation is not natively executed out of the box, requiring separate runbooks, configured automations, or downstream ticketing integrations.
Cross-model buying perspectives

Multi-AI review

Cross-model buying perspectives

Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.

AI assessment updated: Sep 23, 2026

Score comparisonGPTGeminixAIRange
Cloud coverage and visibility8480834
Detection and policy depth8082855
Risk prioritization and context8885873
Remediation operations7678735
Compliance and governance7275775
Integrations and reporting7980812
Support and total cost6170649
cspm cloud misconfig detection8685861
cspm cloud compliance policy8280802
cspm risk prioritization context8985884
cspm remediation guidance workflow7880746
cspm multicloud operability6760589
Where models differ
  • cspm multicloud operability: 58–67 (9-point range)
  • Support and total cost: 61–70 (9-point range)
  • cspm remediation guidance workflow: 74–80 (6-point range)
GPTAI-assisted buyer perspective79

AWS Security Hub fits AWS-centered security teams that want a single CSPM and exposure workflow for AWS plus connected Azure resources, with the main check being whether the team accepts resource-unit pricing and the AWS-Config-dependent control setup.

Review confidence
79/100
Model details
Strengths
  • The Essentials plan combines CSPM, vulnerability management, security-focused inventory, exposure analytics, and response workflows in one required foundation, which can reduce the need to stitch those functions together from separate services.
  • The service provides continuous AWS and Azure standards checks with configurable control parameters and security scores, which supports ongoing posture monitoring for regulated cloud environments.
  • The service adds contextual exposure findings with attack paths, blast radius, exploitability, reachability, permissions, and remediation guidance, which gives security teams more context for triage than a raw finding list.
  • The service supports automation rules, EventBridge response, and Jira Cloud or ServiceNow ticketing, which can connect findings to an operational response workflow.
Cautions
  • Essentials uses pay-as-you-go, pro-rated resource-unit pricing, so spend varies with monitored resources and monitored time rather than a fixed subscription.
  • Most CSPM controls require correctly scoped AWS Config recording, so missing recording can leave compliance results unknown or incomplete.
  • Security Hub is Regional and complete visibility depends on enablement and aggregation design across the relevant accounts and Regions.
  • Azure support has separate controls and connectors, so Azure standards are not managed through CSPM configuration policies.
GeminiAI-assisted buyer perspective78

A pay-as-you-go, native cloud security posture management solution designed for AWS-centric environments with connected Microsoft Azure assets, offering unified exposure analytics and delegated administration across multiple accounts while requiring external configurations and workflows for automated remediation.

Review confidence
78/100
Model details
Strengths
  • Combines cloud security posture, vulnerability management, inventory, exposure analytics, and response workflows under a unified resource-unit billing structure.
  • Delivers comprehensive exposure findings that map attack paths, blast radius, exploitability, reachability, and permissions context.
  • Enables delegated administration through AWS Organizations for up to 10,000 member accounts with cross-Region aggregation.
Cautions
  • Provides no native support or control plane capabilities for Google Cloud environments.
  • Requires separate connectors and distinct controls for Microsoft Azure, and Azure standards cannot be managed via CSPM configuration policies.
  • Remediation is not natively executed out of the box, requiring separate runbooks, configured automations, or downstream ticketing integrations.
xAIAI-assisted buyer perspective78

AWS Security Hub Essentials fits AWS-centered teams that need unified CSPM, vulnerability correlation, exposure context, and response workflows across many accounts and connected Azure resources, provided buyers accept resource-unit pricing and configure Config, Regions, Organizations, and Azure connectors correctly.

Review confidence
78/100
Model details
Strengths
  • Essentials combines CSPM posture checks, Amazon Inspector vulnerability management, security-focused inventory, risk analytics, and response management under one required foundation.
  • Contextual exposure findings include attack paths, blast radius, exploitability, reachability, and permissions to help prioritize which cloud risks matter first.
  • Delegated administration supports up to 10,000 member accounts with cross-Region aggregation for centralized multi-account visibility.
  • Automation rules, EventBridge-triggered response, and Jira Cloud or ServiceNow ticketing can route findings into existing operational workflows.
Cautions
  • Charges apply to every monitored billable resource unit at the published usage rate regardless of which included capability a team actually uses.
  • Threat Analytics, Lambda code scanning, Macie, Extended partner solutions, and ticketing or downstream services can add separate costs beyond Essentials.
  • Most CSPM controls depend on correctly scoped AWS Config recording
  • missing recording can produce unknown or incomplete compliance results.

Research transparency

How this page was researched

A compact record of the evidence used, what was not tested, and which conclusions still need verification.

Official sources
11
Broad product review sources
2
Marketplace and app-store sources
0
Editorial sources
0
Latest evidence check
Aug 10, 2026
Research basis

Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.

Conflict handling

No unresolved evidence conflict is currently recorded.

View research methodology
Verified findingsAWS provides a 30-day Essentials plan trial for every AWS account in each enabled Region, including accounts that previously used Security Hub CSPM or Inspector trials. Azure monitoring receives its own 30-day trial after integration. Threat Analytics, Lambda code scanning, and the Extended plan are excluded.
  • The required Essentials plan uses pay-as-you-go, pro-rated resource-unit pricing with unlimited included scans. One EC2 instance or Azure VM equals one unit; Lambda functions, container images, and identities use published conversion ratios. Threat analytics, Lambda code scanning, and Extended partner solutions are separately priced enhancements.
  • Required Essentials foundation combining CSPM, vulnerability management, security-focused inventory, risk analytics, and response management Continuous AWS and Azure standards checks with configurable control parameters and security scores Contextual exposure findings with attack paths, blast radius, exploitability, reachability, permissions, and remediation guidance Active Network Scanning for publicly reachable AWS and Azure resources in supported commercial Regions AWS Organizations delegated administration for up to 10,000 member accounts and cross-Region aggregation Automation rules, EventBridge response, and Jira Cloud or ServiceNow ticketing OCSF findings, ASFF CSPM findings, APIs, CLI, SDKs, and AWS or partner security integrations
  • USD 3.75 per resource unit per month for Security Hub Essentials in the published US East (N. Virginia) example
  • Security Hub has one current core offer: the required Essentials plan. AWS publishes a USD 3.75 monthly resource-unit rate in its US East example and pro-rates charges for monitored time. Total spend depends on the mix of EC2 or Azure VMs, Lambda or Azure functions, ECR or Azure container images, IAM or Azure identities, Regions, and optional capabilities. Accounts without unified Security Hub can continue using separately billed AWS security services, but they do not receive the same automated correlation and unified pricing.
Verification notes and unresolved itemsThe exact target is the current unified AWS Security Hub, not the legacy product now named AWS Security Hub CSPM.
  • Only the required Essentials plan is retained in pricing.plans.
  • Threat Analytics, Lambda code scanning, and Extended partner solutions are add-ons
  • separately billed AWS security services are recorded only as a related purchase path.
  • The USD 3.75 rate is bound to AWS's current US East (N.
Sources checked

Sources checked

AWS Security Hub source links

Third-Party Integrations for Security HubAmazon Web ServicesLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
Security Hub and the Open Cybersecurity Findings FormatAmazon Web ServicesLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
How Configuration Policies Work in Security Hub CSPMAmazon Web ServicesLevel A2Linked to 1 scored claimChecked Aug 10, 2026
Understanding Cross-Region Aggregation in Security HubAmazon Web ServicesLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
Managing Security Hub CSPM for Multiple Accounts with AWS OrganizationsAmazon Web ServicesLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
AWS Security Hub Now Offers Network ScanningAmazon Web ServicesLevel A2Linked to 1 scored claimChecked Aug 10, 2026
Configuring Security Hub CSPM to Integrate with Microsoft AzureAmazon Web ServicesLevel A2Linked to 1 scored claimChecked Aug 10, 2026
Exposure Findings in Security HubAmazon Web ServicesLevel A2Linked to 1 scored claimChecked Aug 10, 2026

FAQ

AWS Security Hub FAQ

What is the current core AWS Security Hub plan?

The Essentials plan is the required core. It includes risk and exposure analytics, resource inventory, Security Hub CSPM posture management, Amazon Inspector vulnerability management, and security response workflows.

How much does AWS Security Hub Essentials cost?

AWS's current US East example uses USD 3.75 per resource unit per month. Resource counts are converted from EC2 or Azure VMs, Lambda or Azure functions, ECR or Azure images, and AWS or Azure identities, with charges prorated for monitored time.

Is there a free plan or free trial?

There is no permanent free Essentials edition. Each AWS account receives a 30-day Essentials trial in each enabled Region, and Azure monitoring has an independent 30-day trial after connection. Optional add-ons and Extended partner solutions are excluded.

Does AWS Security Hub support multiple clouds?

It supports AWS and connected Microsoft Azure environments, including Azure posture controls, resource context, and Network Scanning. Current official sources do not establish Google Cloud support.

Are GuardDuty and Macie included in Essentials?

GuardDuty-powered Threat Analytics is a separately priced add-on. Security Hub can correlate Macie findings, but Macie sensitive-data discovery is a separate service and is not automatically enabled as an Essentials entitlement.

Does Security Hub automatically remediate cloud risks?

It provides remediation guidance, automated finding updates, EventBridge-triggered response, and Jira or ServiceNow ticketing. Actual resource changes generally require configured automation, runbooks, integrated tools, or human action.

Does a 100 percent Security Hub standard score prove audit compliance?

No. AWS states that Security Hub checks only the controls that can be automated and that a perfect score does not imply passing the corresponding audit.

Popular comparisons

Common AWS Security Hub comparisons

Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.

VS #1
AWS Security HubvsTenable Cloud Security
79Gap 180

Enterprise / Mid-market

VS #2
AWS Security HubvsSysdig Secure
79Gap 178

Enterprise / Mid-market

VS #3
AWS Security HubvsLacework FortiCNAPP
79Gap 376

Enterprise / Mid-market