Amazon GuardDuty vs Darktrace / EMAIL
Amazon GuardDuty
aws.amazon.com
Darktrace / EMAIL
darktrace.comSide by side
| Figure | Amazon GuardDuty | Darktrace / EMAIL |
|---|---|---|
| Price from | $0.03/mo | — |
| Free plan | Yes | — |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| Linux | Yes | — |
| API | Yes | Yes |
| Plans published | 6 | 1 |
| Spec score · Cloud Detection and Response Software | 9.3 (#1) | 7.4 (#8) |
| Deployment | Foundational GuardDuty protections require no additional security software or infrastructure to deploy and maintain. | Darktrace says EMAIL can be deployed as API-only or API plus journaling, with no disruption to mail flow. |
| Intended users | GuardDuty is for organizations seeking threat detection across AWS accounts, workloads, and data, including compute, storage, database, and AI workloads. | Darktrace describes the product as helping security teams protect organizations against email threats and reduce investigations in the SOC. |
| Purpose | Amazon GuardDuty continuously monitors AWS accounts and workloads for malicious activity and generates detailed security findings. | Darktrace / EMAIL uses behavioral AI to identify and stop email threats, including phishing, business email compromise, impersonation, and social engineering. |
| Security integrations | GuardDuty integrates with Security Hub CSPM, Amazon Detective and EventBridge for centralized findings, investigation context and near-real-time response automation. | The integrations page lists Microsoft 365, Google Workspace, Azure Sentinel, Elastic Security, ReliaQuest, and Splunk integrations. |
Plans
Amazon GuardDuty
- 30-day free trialFree
- Amazon GuardDutyFree
- Malware Protection for EBS$0.03 a month
- Malware Protection for S3$0.09 a month
- Foundational threat detection — VPC Flow Logs and DNS query logs$1 a month
- Foundational threat detection — CloudTrail management events$4 a month
In their own words
Amazon GuardDuty
Amazon GuardDuty monitors AWS accounts and workloads for malicious activity and generates security findings for response. It analyzes CloudTrail, VPC Flow, DNS, S3, Aurora login, AWS Backup, AI workload, and runtime activity. Detection combines AI, machine learning, anomaly detection, and AWS and third-party threat intelligence. Runtime Monitoring covers EKS, ECS workloads including those on Fargate, and EC2 instances. GuardDuty can scan EC2-attached EBS volumes after suspicious activity and detect potentially harmful uploads to S3 buckets. AI Protection addresses threats such as unusual model invocations, cost harvesting, and prompt injection attempts in Amazon Bedrock and SageMaker workloads. Findings can go to AWS Security Hub, EventBridge, Amazon Detective, or third-party solutions. Foundational protections require no additional security software or infrastructure to deploy and maintain. The service is pay as you go: charges depend on analyzed data and vary by source and AWS Region. New accounts can receive a 30-day trial in supported Regions, and some features are unavailable in some Regions.
Darktrace / EMAIL
Darktrace / EMAIL is a paid cloud security product that uses behavioral AI to identify and stop phishing, business email compromise, impersonation, and social-engineering threats. It learns an organization’s communication patterns and detects suspicious behavior without relying on known attack signatures. Responses can range from tagging messages to full quarantine. Coverage includes inbound, outbound, and lateral mail, plus account-based and messaging attacks. Data-loss prevention analyzes behavior and message content for sensitive information in outbound email, including unlabeled data. Darktrace also describes behavioral protection for Microsoft Teams chats. Deployment can use API-only or API plus journaling without disrupting mail flow. The product integrates with Microsoft 365 and Microsoft Exchange and is hosted on Microsoft Azure; listed integrations include Google Workspace, Azure Sentinel, Elastic Security, ReliaQuest, and Splunk. Pricing is on request, with a 30-day trial.