AWS Security Hub is a AWS managed cloud service that helps companies and enterprises gather, analyze, and manage cloud security findings. Learn how companies use Security Hub and read best practices for getting started with AWS Security Hub.
What is AWS Security Hub?
AWS Security Hub is an Amazon Web Services (AWS) provided service for aggregating, viewing, and managing security alerts and findings across your cloud environments.
Security Hub enables teams to gather and manage security findings from AWS services, AWS Partner Solutions, and third-party security solutions and in one single view. Teams can collect security information for services including Amazon GuardDuty, IAM Access Analyzer, Amazon Macie, AWS Firewall Manager and AWS Partner solutions.
While other solutions may be available to gather findings from AWS services, Security Hub is specifically built as solution for managing AWS security findings.
Why Do Teams Use Security Hub?
DevOps and SecOps teams leverage a number of cloud security services when building and managing applications and workloads in AWS and the public cloud.
When managing applications in the cloud, security teams may implement services in to manage processes such as:
- Generating and collecting logs – with CloudTrail, CloudWatch, or similar
- Intrusion detection – with AWS GuardDuty or similar
- Vulnerability scanning – with AWS Inspector or similar
- Anti-virus solutions
- Endpoint Monitoring
- Cloud configuration management
All of these services generate security findings that need to be acted upon and resolved by the security team. For example, teams may need to update a vulnerable dependency discovered in vulnerability scanning, or remediate detected malware. Security Hub allows AWS users to gather security findings from all of these different services in one place and better view, sort, and act of these findings. Teams can use Security Hub to automate collection of security findings and remediation of cloud security issues.
What Are Some Use Cases for Security Hub?
There a several reasons why DevOps and Security teams may use AWS Security Hub within their organization. Security Hub provides teams with the following capabilities:
- Provides a central place to view events and findings from multiple security sources and AWS services
- Provides the ability to connect findings from multiple AWS accounts
- Provides view of your security alerts and security posture across your AWS accounts.
- Provides teams with the ability to search through all collected security findings
- Provides teams with standardized insights related to findings.
Security Hub provide more power insight into services such as EC2 and managed AWS services such as Amazon RDS and Lambda. Teams that utilize many AWS managed services and/or multiple AWS accounts may find more value in the service.
Ultimately, Security Hub is an AWS specialized service that teams may consider using Security Hub as one part of their cloud native security process.
What AWS Services Work with Security Hub?
AWS Security Hub can connect and digest findings from many data sources, including AWS cloud security services.
Currently users can connect Security Hub to AWS cloud services including:
- AWS CloudTrail – To gather events and API calls that occur across AWS and your cloud environment
- AWS GuardDuty – To gather intrusion detection data as it relates to cloud resources such as EC2 instances
- AWS Macie – To gather data classification information and findings related to personally identifiable information (PII)
- AWS Inspector – To gather events related to vulnerability scanning specifically related to EC2 instances
- IAM Access Analyzer – To gather security information and alerts related to IAM users, roles, and permissions.
- AWS Firewall Manager – To gather events related to AWS WAF, AWS Shield and Amazon VPCs
In order to get a better view of security events across your environment, it is recommended that teams enable AWS CloudTrail, AWS GuardDuty, AWS Macie, AWS Inspector in all AWS Accounts, to collect relevant security findings.
What Security Controls Can Be Enabled with Security Hub?
Alongside the large number of security solutions and cloud services can be connected to Security Hub, security teams can also leverage specific AWS provide controls sets across their cloud environments.
AWS Security Hub provides control sets for the following standards:
- CIS AWS Foundations
- Payment Card Industry Data Security Standard (PCI DSS)
- AWS Foundational Security Best Practices
Your team can enable one or more of these sets of controls in order to monitor configuration across your cloud. After enabling these standards AWS will start gathering security findings related to these controls.
In addition, teams can use a solution such as Dash ComplyOps in order to gather security findings and connect Security Hub findings to compliance standards and controls including HIPAA, SOC 2, NIST CSF and more. With Dash, your team can digest Security Hub events, map these findings to standards within compliance frameworks, and create robust controls sets to meet security and compliance needs.
What Security Hub Integrations Are Available?
Aside from collecting insight and findings from AWS native security services, AWS Security Hub can automatically aggregate security findings data from supported AWS Partner security solutions, so your team can get a more comprehensive view of security and compliance across your AWS environment.
This means third-party security solutions used by your team can be connected to Security Hub alongside AWS services. Many popular products and services used for threat detection, endpoint protection, anti-virus, and security configuration can integrate with Security Hub.
Teams can connect Security Hub to services such as:
- CrowdStrike
- Slack
- Sophos
- Dash ComplyOps
How Do Teams Manage Compliance with Security Hub?
Security Hub is a great service for gathering information across AWS cloud accounts. Security leaders can gather events and findings from AWS cloud services and 3rd party security solutions. Once these security events are being collected by Security Hub, it is up to the organization to establish a workflow related to security findings.
Dash ComplyOps provides teams with a solution for digesting Security Hub findings and managing security events as they relate to compliance standards and security programs. Security teams can use Dash to map Security Hub findings to regulatory and compliance standards including SOC 2, HIPAA, HITRUST and more. Learn how your team can manage compliance with Dash and Security Hub.
FAQ
What is AWS Security Hub used for?
AWS Security Hub centralizes and prioritizes security findings from services such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. Its cloud security posture management capability, Security Hub CSPM, checks resource configurations against security standards. Teams use these findings to identify risks, investigate issues, and automate response workflows across AWS accounts.
How much does AWS Security Hub cost?
As of October 7, 2026, AWS Security Hub offers an Essentials plan billed per monitored resource unit, with optional add-on charges. Standalone Security Hub CSPM uses usage-based pricing for security checks, finding ingestion events, and automation rule evaluations, with AWS Config recording charged separately. See AWS Security Hub pricing and Security Hub CSPM pricing for current rates.
What standards does AWS Security Hub support?
Security Hub CSPM supports AWS Foundational Security Best Practices, CIS AWS Foundations Benchmark, PCI DSS, NIST SP 800-53 Revision 5, and NIST SP 800-171 Revision 2. Additional standards include AI Security Best Practices, AWS Resource Tagging, and a service-managed AWS Control Tower standard. These checks support security monitoring but do not establish complete regulatory compliance. See the supported standards.
Is AWS Security Hub a SIEM?
No. AWS Security Hub is a cloud security solution for aggregating findings, assessing security posture, and prioritizing risks—not a general-purpose security information and event management (SIEM) platform. It complements a SIEM by supplying cloud security findings that can be analyzed alongside application, endpoint, identity, and other security logs.
What’s the difference between Security Hub and GuardDuty?
Amazon GuardDuty detects suspicious activity and potential threats by analyzing AWS activity and workload signals. AWS Security Hub brings GuardDuty findings together with vulnerability, configuration, and other security findings to provide broader context and prioritize response. GuardDuty is a threat detection source; Security Hub helps teams manage and act on findings across sources.
Do I need AWS Config to use Security Hub?
AWS Config recording is required for most AWS security checks in Security Hub CSPM, but not for findings aggregation alone. When both Security Hub and Security Hub CSPM are enabled, a service-linked recorder is created automatically. If you use standalone Security Hub CSPM, you must enable AWS Config and configure resource recording yourself. See AWS Config prerequisites.
