SECURITY ATLAS / EVALUATION BRIEF
AWS Security Hub and Workload Security
Research reviewed: 2026-10-18
https://atlasofsecurity.com/landscape/vendors/aws-cloud-security/

THE ATLAS TAKE
AWS offers a collection and response architecture built close to the resources it protects. The current Security Hub experience correlates posture and service findings, while GuardDuty and Inspector still have distinct technical roles. Atlas would evaluate it as an organization-wide operating system for findings, rather than purchase a dashboard and assume coverage follows. The latest Essentials pricing also changes the commercial conversation: some capabilities are bundled, while other protections and add-ons retain separate meters. Prove which accounts, regions, resources, and features are enabled before comparing either coverage or cost with a third-party CNAPP.

SCOPE
Security Hub, Security Hub CSPM, Inspector, and GuardDuty retain distinct technical roles. Current Essentials pricing bundles specified capabilities while add-ons and excluded features have other meters. Verify regional enablement, resource support, and the actual plan.

WORTH A LOOK WHEN
AWS-centered organizations with cloud platform owners who can maintain organization-wide security configuration and a reliable findings handoff.

THINK TWICE WHEN
The requirement is one uniform sensor across arbitrary clouds, or nobody can own delegated administration and regional coverage.

IMPLEMENTATION
1. Build the coverage ledger
List production accounts, regions, resource types, enabled services, and delegated administrators before enabling a broad baseline.

2. Validate the findings route
Generate a supported sample and follow its identifiers through aggregation, alerting, case ownership, and closure.

3. Constrain remediation
Pilot one reversible resource change with narrow permissions, approval, and evidence that unrelated resources remained unchanged.

OPERATING REALITY
Security engineers own delegated administration, service configuration, regional rollout, exceptions, and the response workflow. Application owners must supply resource context and act on findings. Atlas would reconcile enabled services against the actual account inventory after every new account or region is introduced, because organization membership alone is not evidence of monitoring.

COMMERCIAL CONSIDERATIONS
Use the current Security Hub plan definition and actual resource inventory. Essentials consolidates specified capabilities; add-ons and excluded service features can produce additional charges.
- Resource units and monitored resource populations
- Threat analytics and Lambda scanning add-ons where selected
- Cloud resources, retained evidence, support, and response engineering

EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS
1. Audit an intentionally unenrolled account
Acceptance evidence: Record whether the account and selected region appear in the coverage ledger and how the monitoring gap becomes visible.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

2. Route a GuardDuty sample finding
Acceptance evidence: Preserve the finding ID, delivery timestamps, analyst assignment, and the evidence that a sample was not treated as a live compromise.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

3. Reconcile the commercial scope
Acceptance evidence: Map a representative resource set to Essentials, selected add-ons, and separately billed services; compare the estimate with observed lab usage.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

QUESTIONS FOR THE VENDOR
- Which checks require AWS Config recording or another explicitly enabled service?
- Does a finding belong to Security Hub CSPM or the unified correlation path, and which integrations consume it?
- Which Regions, workload types and runtime features are absent from the proposed configuration?

EVIDENCE GAPS
- No independent detection, response-time, or comparative cost benchmark was conducted.
- Provider coverage, plan bundling, and regional availability must be confirmed for the specific organization; sample findings do not establish attack detection quality.

SOURCES
Security Hub and Security Hub CSPM roles (Documentation)
https://docs.aws.amazon.com/securityhub/latest/userguide/
Current Security Hub plans and pricing (Pricing)
https://aws.amazon.com/security-hub/pricing/
Understanding and generating GuardDuty findings (Documentation)
https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings.html

Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement.
Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.