GuardDuty Runtime Monitoring now included in AWS Security Hub Threat Analytics plan
AWS has integrated Amazon GuardDuty Runtime Monitoring into the AWS Security Hub Threat Analytics plan, streamlining billing for customers. This change consolidates charges for GuardDuty's runtime threat detection on Amazon EC2, Amazon EKS, and Amazon ECS Fargate under a single Security Hub usage type. Customers using Security Hub will no longer receive separate GuardDuty charges for Runtime Monitoring, simplifying cost management. No reconfiguration or changes to detection coverage or GuardDuty security agents are required for existing users.
Notes (1) ›
- Streamlined Billing for GuardDuty Runtime Monitoring via Security Hub
Amazon GuardDuty Runtime Monitoring, which detects threats like container escapes and cryptomining on EC2, EKS, and ECS Fargate, is now included in the AWS Security Hub Threat Analytics plan. This change simplifies billing by consolidating usage under AWS Security Hub, eliminating separate GuardDuty charges for Runtime Monitoring without altering detection coverage, finding types, or security agents.
https://aws.amazon.com/about-aws/whats-new/2026/10/aws-security-hub-runtime-monitoring/
Related releases
- Amazon EKS Auto Mode now supports advanced compute configurations AWS What's New ·
- Amazon Q Developer gains enhanced visualizations in AWS Management Console AWS What's New ·
- Amazon WorkSpaces Core Managed Instances now support NVIDIA Blackwell GPU-powered G7 instances AWS What's New ·
- Amazon EC2 Capacity Reservations Now Support Postponing Start Dates AWS What's New ·
- AWS EC2 M8i and M8i-flex Instances Now Available in AWS European Sovereign Cloud AWS What's New ·
- Amazon EC2 C8i and C8i-flex Instances Now Available in AWS European Sovereign Cloud AWS What's New ·