Skip to content
SPECIFICTION
Get listed

Amazon GuardDuty

aws.amazon.com

From $0.03/mo Free plan WebLinuxAPI
Visit aws.amazon.com
Spec score 9.3 #1 of 25 in Cloud Detection and Response Software

What it is

Amazon GuardDuty monitors AWS accounts and workloads for malicious activity and generates security findings for response. It analyzes CloudTrail, VPC Flow, DNS, S3, Aurora login, AWS Backup, AI workload, and runtime activity. Detection combines AI, machine learning, anomaly detection, and AWS and third-party threat intelligence. Runtime Monitoring covers EKS, ECS workloads including those on Fargate, and EC2 instances. GuardDuty can scan EC2-attached EBS volumes after suspicious activity and detect potentially harmful uploads to S3 buckets. AI Protection addresses threats such as unusual model invocations, cost harvesting, and prompt injection attempts in Amazon Bedrock and SageMaker workloads. Findings can go to AWS Security Hub, EventBridge, Amazon Detective, or third-party solutions. Foundational protections require no additional security software or infrastructure to deploy and maintain. The service is pay as you go: charges depend on analyzed data and vary by source and AWS Region. New accounts can receive a 30-day trial in supported Regions, and some features are unavailable in some Regions.

Spec sheet

What it does
Amazon GuardDuty continuously monitors AWS data sources and logs to detect suspicious or malicious activity using threat intelligence and machine learning.Read 14 Oct 2026 · docs.aws.amazon.com
Purpose
Amazon GuardDuty continuously monitors AWS accounts and workloads for malicious activity and generates detailed security findings.Read 2 Oct 2026 · aws.amazon.com
Intended users
GuardDuty is for organizations seeking threat detection across AWS accounts, workloads, and data, including compute, storage, database, and AI workloads.Read 2 Oct 2026 · aws.amazon.com
Deployment
Foundational GuardDuty protections require no additional security software or infrastructure to deploy and maintain.Read 2 Oct 2026 · aws.amazon.com
Integrations
GuardDuty findings can be routed to AWS Security Hub, Amazon EventBridge, Amazon Detective, or third-party solutions.Read 2 Oct 2026 · aws.amazon.com
Account threat detection
It identifies unusual geolocation, atypical API calls, attempts to disable CloudTrail, suspicious infrastructure launches and other signs of account compromise.Read 14 Oct 2026 · aws.amazon.com
AI Protection
AI Protection detects anomalous Bedrock and SageMaker model invocations, cost-harvesting attacks and prompt injection through Bedrock Guardrails integration.Read 14 Oct 2026 · docs.aws.amazon.com
CLI and console
Users can operate GuardDuty through the browser console, AWS CLI, HTTPS API or AWS SDKs.Read 14 Oct 2026 · docs.aws.amazon.com
Company facts
LinkedIn lists Amazon Web Services as headquartered in Seattle, launched in 2006, with 148,106 employees shown on its global page.Read 14 Oct 2026 · linkedin.com
Company legal name
The launch announcement identifies the maker as Amazon Web Services Inc., an Amazon.com company.Read 14 Oct 2026 · press.aboutamazon.com
Compute protection
Runtime Monitoring covers EKS, ECS workloads including those on Fargate, and EC2 instances.Read 2 Oct 2026 · aws.amazon.com
Container protection
GuardDuty monitors EKS audit logs and runtime activity in EKS and ECS, including Fargate workloads, for container compromise.Read 14 Oct 2026 · aws.amazon.com
Data sources
GuardDuty analyzes CloudTrail logs, VPC Flow Logs, DNS query logs, S3 data events, Aurora login events, AWS Backup data, AI workload activity, and runtime activity.Read 2 Oct 2026 · aws.amazon.com
Detection methods
GuardDuty uses AI, machine learning, anomaly detection, and AWS and third-party threat intelligence to detect threats.Read 2 Oct 2026 · aws.amazon.com
Documentation depth
AWS publishes a user guide, API reference, CLI reference, setup tutorials, finding-type catalog, regional availability, security guidance and a dated document history.Read 14 Oct 2026 · docs.aws.amazon.com
Extended investigations
AI-powered investigations in preview analyze findings, 90 days of related activity, threat indicators and affected resources, then provide confidence scores and remediation recommendations.Read 14 Oct 2026 · aws.amazon.com
Instance compromise
Detection covers cryptocurrency mining, command-and-control activity, domain-generation algorithms, unusual protocols, malicious IP communications and DNS exfiltration.Read 14 Oct 2026 · aws.amazon.com
Lambda protection
Lambda Protection analyzes network activity logs generated by Lambda executions for serverless-specific threats.Read 14 Oct 2026 · aws.amazon.com
Limit: alert handling
G2 reviewers say teams must integrate GuardDuty with monitored platforms or SIEMs because console-only alerts can be missed and larger environments need triage processes.Read 14 Oct 2026 · g2.com
Limit: detection scope
G2 reviewers criticize its mainly rule-based approach, saying novel threats outside known patterns may be missed and GuardDuty detects rather than actively blocks threats.Read 14 Oct 2026 · g2.com
Limit: latency and usability
G2 reviewers report alert delays and say interpreting findings can require security expertise; one reviewer found the service difficult for some users to understand.Read 14 Oct 2026 · g2.com
Limits
Some features are unavailable in some Regions, and pricing varies by data source and Region.Read 2 Oct 2026 · aws.amazon.com
Maker history
Amazon Web Services says it launched in 2006.Read 2 Oct 2026 · aws.amazon.com
Malware Protection
Malware Protection can scan EBS volumes, newly uploaded S3 objects and AWS Backup data for malware such as trojans, worms, rootkits and crypto miners.Read 14 Oct 2026 · aws.amazon.com
Multi-account management
AWS Organizations integration lets an administrator aggregate and manage GuardDuty findings across member accounts.Read 14 Oct 2026 · aws.amazon.com
Notable 2026 update
AWS document history records Runtime Monitoring security agent version 1.16.0 for EKS, EC2 and ECS-Fargate on July 17, 2026.Read 14 Oct 2026 · docs.aws.amazon.com
Praise: detection quality
G2 reviewers describe timely alerts, useful anomaly detection, low alert volume and effective identification of suspicious account and workload behavior.Read 14 Oct 2026 · g2.com
Praise: ease and deployment
G2 reviewers repeatedly praise quick enablement, agentless deployment, low operational overhead and straightforward integration with AWS environments.Read 14 Oct 2026 · g2.com
Pricing model
GuardDuty is pay as you go, with prices based on analyzed logs, events, workloads, or data and varying by AWS Region.Read 2 Oct 2026 · aws.amazon.com
Public API
The service exposes an HTTPS API with documented operations, request and response formats, errors and regional endpoints.Read 14 Oct 2026 · docs.aws.amazon.com
Rating on G2
4.1 out of 5 from 57 reviewsRead 14 Oct 2026 · g2.com
Rating on Gartner Peer Insights
4.6 out of 5 from 536 AWS ratings; the page lists AWS broadly rather than GuardDuty specifically.Read 14 Oct 2026 · gartner.com
Rating on TrustRadius
9.9 out of 10 from 4 reviewsRead 14 Oct 2026 · trustradius.com
RDS protection
RDS Protection profiles Aurora and supported RDS database login activity to identify anomalous access threats.Read 14 Oct 2026 · aws.amazon.com
Reconnaissance detection
GuardDuty detects suspicious API activity, database login attempts, intra-VPC port scanning and port probes associated with reconnaissance.Read 14 Oct 2026 · aws.amazon.com
Runtime Monitoring
Runtime Monitoring provides agent-based visibility for EKS, EC2 and ECS-Fargate workloads; automated agent configuration is available for supported EC2 instances.Read 14 Oct 2026 · docs.aws.amazon.com
S3 protection
S3 Protection analyzes CloudTrail S3 data events such as GetObject, ListObjects and DeleteObject for suspicious bucket access.Read 14 Oct 2026 · aws.amazon.com
SDKs
AWS SDK support includes libraries and samples for Java, Python, Ruby, .NET, iOS, Android and other platforms.Read 14 Oct 2026 · docs.aws.amazon.com
Security compliance
AWS states GuardDuty has been validated for PCI DSS compliance and documents shared-responsibility obligations for customers.Read 14 Oct 2026 · docs.aws.amazon.com
Security integrations
GuardDuty integrates with Security Hub CSPM, Amazon Detective and EventBridge for centralized findings, investigation context and near-real-time response automation.Read 14 Oct 2026 · docs.aws.amazon.com
Security operations
The service provides detailed, actionable alerts designed to integrate with existing event management and workflow systems.Read 2 Oct 2026 · aws.amazon.com
Self-hosting
GuardDuty is a fully managed AWS service activated in the console or by API; foundational protection requires no customer-deployed security software or infrastructure.Read 14 Oct 2026 · aws.amazon.com
Service launch
AWS announced GuardDuty on November 28, 2017, initially analyzing CloudTrail, VPC Flow Logs and other sources with machine learning and threat intelligence.Read 14 Oct 2026 · aws.amazon.com
System requirements
Basic enablement requires an AWS account and Region; multi-account administration requires AWS Organizations and access to its management account, while runtime agents have resource-specific OS and Kubernetes prerequisites.Read 14 Oct 2026 · docs.aws.amazon.com
Third-party integrations
AWS partners and customer workflows can send findings to tools such as Splunk, Sumo Logic, PagerDuty, Jira, ServiceNow and Slack.Read 14 Oct 2026 · techcrunch.com
TrustRadius user experience
A TrustRadius reviewer using GuardDuty across dozens of Control Tower accounts called it highly useful for monitoring multi-account AWS environments.Read 14 Oct 2026 · trustradius.com

Plans and prices

30-day free trial Free 30 days per AWS account and Region for most protection plans Malware Protection for S3 has a separate free tier · on-demand EC2 scans and AWS Backup malware scans excluded Read 14 Oct 2026 · docs.aws.amazon.com
Amazon GuardDuty Free Pay as you go; charges depend on the volume of logs, events, workloads, or data analyzed, and vary by data source and AWS Region. 30-day free trial in supported Regions for new accounts; protection plans can have separate trials; Malware Protection for Amazon S3 has a free tier without a trial period Read 2 Oct 2026 · aws.amazon.com
Malware Protection for EBS $0.03 a month per GB scanned additional EBS snapshot charges may apply Read 14 Oct 2026 · aws.amazon.com
Malware Protection for S3 $0.09 a month per GB scanned plus $0.215 per 1,000 objects evaluated US East example · regional pricing varies Read 14 Oct 2026 · aws.amazon.com
Foundational threat detection — VPC Flow Logs and DNS query logs $1 a month per GB; $1.00 first 500 GB, $0.50 next 2,000 GB, $0.25 thereafter volume discounts · regional pricing varies Read 14 Oct 2026 · aws.amazon.com
Foundational threat detection — CloudTrail management events $4 a month per 1 million events, prorated US East example · regional pricing varies Read 14 Oct 2026 · aws.amazon.com

Every Amazon GuardDuty plan and price →

Strong points and limits

Strong points

  • Analyzes logs, events, and runtime activity across AWS workloads.
  • Runtime Monitoring covers EKS, ECS, Fargate, and EC2.
  • Findings can be routed to AWS and third-party services.
  • Foundational protections need no extra security software or infrastructure.

Limits

  • No free plan is listed.
  • Charges vary by data source and AWS Region.
  • Some features are unavailable in some Regions.
  • The 30-day trial is limited to supported Regions and new accounts.

Who it suits

It suits organizations seeking threat detection across AWS accounts, compute, storage, database, and AI workloads. It also fits teams that want findings routed into existing security or event workflows.

Amazon GuardDuty in depth

Read the full write-up

Overview

Amazon GuardDuty is a threat-detection service for AWS accounts and workloads. It suits organizations that want security signals across cloud infrastructure, data, and AI services. Its breadth and routing options are useful, but usage-based charges and Regional gaps make it a less straightforward fit for teams that need predictable costs or uniform coverage.

Key features

GuardDuty draws on CloudTrail, VPC Flow and DNS logs, S3 data events, Aurora login events, AWS Backup data, AI workload activity, and runtime activity. AI, machine learning, anomaly detection, and AWS and third-party threat intelligence inform its detections. That range is valuable for teams seeking visibility across multiple AWS activity types, although analyzing more sources can affect the bill.

Runtime Monitoring covers EKS and ECS workloads, including Fargate, and EC2 instances. GuardDuty can scan EC2-attached EBS volumes after suspicious activity and detect potentially harmful uploads to S3 buckets. These protections extend detection from account activity into compute and storage, but some features are unavailable in some Regions.

AI Protection targets anomalous model invocations, cost harvesting attacks, and prompt injection attempts in Amazon Bedrock and SageMaker workloads. Organizations running those services can include AI-specific risks in the same detection service; teams without such workloads have less reason to value this part of the coverage.

Findings can be routed to AWS Security Hub, Amazon EventBridge, Amazon Detective, or third-party solutions. Detailed alerts are designed to fit existing event-management and workflow systems. Response paths include EventBridge notifications, AWS Lambda processing, Amazon SNS alerts, and targets such as EC2 Systems, Kinesis, ECS, Step Functions, and Run Command. Foundational protections require no additional security software or infrastructure to deploy and maintain, which reduces deployment overhead for AWS environments.

Pricing

The Amazon GuardDuty plan is billed Pay as you go; charges depend on the volume of logs, events, workloads, or data analyzed and vary by data source and AWS Region. Its listed price is free, but GuardDuty has no free plan, so that figure should not be read as ongoing free service. New accounts can receive a 30-day free trial in supported Regions. Protection plans may have separate trials, and Malware Protection for Amazon S3 has a free allowance.

This model fits organizations that want to start with a trial and pay in relation to analyzed activity rather than a fixed seat count. It is less suitable when spend must be fixed in advance: data volume, selected sources, and Region all influence charges. Check trial and feature availability in each Region used before relying on a consistent rollout.

Platforms

GuardDuty is available through web and API platforms and runs on AWS. Its deployment model is hybrid. Container, serverless, and Kubernetes protection are supported. Supported host operating systems include Bottlerocket, Ubuntu, Amazon Linux 2, Amazon Linux 2023, Red Hat 9.4, and Fedora 34.

Who it's for

GuardDuty is best for organizations seeking threat detection across AWS accounts and workloads, especially those combining compute, storage, database, and AI activity. Teams already using AWS security and event-management services can route findings into those workflows. Organizations spread across Regions should verify feature coverage there; those seeking a fixed subscription price may prefer a service with a published fixed rate.

Pros and cons

Pro: Broad coverage spans logs, data events, runtime activity, and AI workloads, giving AWS-focused teams more than a single-workload detector.

Pro: Findings can flow into AWS services or third-party solutions, with several response targets for existing operations workflows.

Pro: Foundational protection needs no additional security software or infrastructure to deploy and maintain.

Con: Charges vary with analyzed data, source, and Region, making total cost harder to forecast than a fixed-price plan.

Con: Some features are unavailable in some Regions, which can leave coverage uneven across a multi-Region environment.

Alternatives

For broader discovery, compare Cloud Detection and Response Software and Cloud Workload Protection Platforms.

CrowdStrike Falcon Surface is worth considering if Linux, macOS, or Windows platforms matter; its Falcon Exposure Management plan uses custom pricing and offers a free trial, but no free plan. Oligo Security may suit teams seeking a free runtime-security subscription with no end date, though additional AWS infrastructure costs may apply.

SentinelOne Singularity Cloud Security is an option for teams comparing per-endpoint plans with stated data-retention periods. Sysdig Secure may be a better match when host-count-based licensing is the preferred basis for pricing. Palo Alto Networks Cortex Cloud API Security is another paid API-focused option.

Red Hat OpenShift Pipelines may fit teams already considering an OpenShift subscription, with pricing varying by edition, sizing, and subscription choice. ARMO Platform offers a free plan and maintains Kubescape as its data engine; its price depends on vCPU. FortiCNAPP offers Standard tiers with one- and three-year terms and entitlement per vCPU.

Verdict

Choose Amazon GuardDuty if your organization runs substantial workloads on AWS and wants one service to detect threats across accounts, runtime, storage, databases, and supported AI workloads, with findings routed into existing operations. Its principal trade-off is variable usage-based cost, compounded by features that differ by Region. Look elsewhere if predictable pricing or consistent feature coverage across Regions is a priority.

Verdict

GuardDuty brings threat detection across a broad set of AWS data sources and workloads, with integrations for routing findings. Costs depend on analyzed data, and both feature availability and the trial vary by Region.

Where Specifiction places it

Alternatives to Amazon GuardDutyAll alternatives →