Amazon GuardDuty

Visit site Alternatives

Score6.7

Rank#2 of 21

Free planNo

Free trialYes

Runs onAPI, Web

Summary

Amazon GuardDuty monitors AWS accounts, workloads, and data for malicious activity, then produces security findings for response. It analyzes CloudTrail, VPC Flow, DNS, S3, Aurora login, AWS Backup, AI workload, and runtime activity. Detection combines AI, machine learning, anomaly detection, and AWS and third-party threat intelligence. Runtime Monitoring covers EKS, ECS workloads—including those on Fargate—and EC2 instances. GuardDuty can scan EC2-attached EBS volumes after suspicious activity and flag potentially harmful uploads to S3. Its AI Protection detects threats such as unusual model invocations, cost harvesting attacks, and prompt injection attempts in Amazon Bedrock and SageMaker workloads. Findings can be routed to AWS Security Hub, EventBridge, Amazon Detective, or third-party solutions, and alerts are designed to fit existing security workflows. Foundational protections need no additional security software or infrastructure. GuardDuty is available through API and web. Charges depend on analyzed data and vary by source and Region; a 30-day trial is available in supported Regions for new accounts. Some features are unavailable in some Regions.

Who it is for

It suits organizations seeking threat detection across AWS accounts, compute, storage, database, and AI workloads. Teams that need findings routed into existing security or event workflows may also find its integrations relevant.

What is good

Monitors multiple AWS log and activity sources.
Runtime coverage includes EKS, ECS, and EC2.
AI Protection covers Bedrock and SageMaker threats.
Findings can route to AWS and third-party tools.
Foundational protections need no added infrastructure.

What to know first

No free plan is listed.
Pricing varies by data source and Region.
Some features are unavailable in some Regions.

Verdict

GuardDuty brings monitoring across AWS accounts, workloads, and data sources, with routing options for security operations. Check regional feature availability and data-dependent charges before choosing it.

Amazon GuardDuty plans and pricing

All plans

Amazon GuardDuty Free Pay as you go; charges depend on the volume of logs, events, workloads, or data analyzed, and vary by data source and AWS Region. 30-day free trial in supported Regions for new accounts; protection plans can have separate trials; Malware Protection for Amazon S3 has a free tier without a trial period aws.amazon.com · 2 Oct 2026

Compared on cloud workload protection platforms

Free plan: Noaws.amazon.com

Facts

Purpose: Amazon GuardDuty continuously monitors AWS accounts and workloads for malicious activity and generates detailed security findings.aws.amazon.com · 2 Oct 2026
Detection methods: GuardDuty uses AI, machine learning, anomaly detection, and AWS and third-party threat intelligence to detect threats.aws.amazon.com · 2 Oct 2026
Data sources: GuardDuty analyzes CloudTrail logs, VPC Flow Logs, DNS query logs, S3 data events, Aurora login events, AWS Backup data, AI workload activity, and runtime activity.aws.amazon.com · 2 Oct 2026
Compute protection: Runtime Monitoring covers EKS, ECS workloads including those on Fargate, and EC2 instances.aws.amazon.com · 2 Oct 2026
Malware protection: GuardDuty can scan EC2 attached EBS volumes after suspicious activity and detect potentially harmful uploads to S3 buckets.aws.amazon.com · 2 Oct 2026
AI protection: GuardDuty AI Protection detects threats such as anomalous model invocations, cost harvesting attacks, and prompt injection attempts in Amazon Bedrock and SageMaker workloads.aws.amazon.com · 2 Oct 2026
Integrations: GuardDuty findings can be routed to AWS Security Hub, Amazon EventBridge, Amazon Detective, or third-party solutions.aws.amazon.com · 2 Oct 2026
Security operations: The service provides detailed, actionable alerts designed to integrate with existing event management and workflow systems.aws.amazon.com · 2 Oct 2026
Deployment: Foundational GuardDuty protections require no additional security software or infrastructure to deploy and maintain.aws.amazon.com · 2 Oct 2026
Pricing model: GuardDuty is pay as you go, with prices based on analyzed logs, events, workloads, or data and varying by AWS Region.aws.amazon.com · 2 Oct 2026
Limits: Some features are unavailable in some Regions, and pricing varies by data source and Region.aws.amazon.com · 2 Oct 2026
Intended users: GuardDuty is for organizations seeking threat detection across AWS accounts, workloads, and data, including compute, storage, database, and AI workloads.aws.amazon.com · 2 Oct 2026
Maker history: Amazon Web Services says it launched in 2006.aws.amazon.com · 2 Oct 2026