AWS Security Hub CSPM
AWS Security Hub CSPM checks AWS resources against security practices and combines findings from AWS services and partner tools.
What AWS Security Hub CSPM is
AWS Security Hub CSPM checks AWS resources against security practices and combines findings from AWS services and partner tools. It helps identify misconfigurations and assess posture across accounts and Regions, aligning with AWS Foundational Security Best Practices, CIS, PCI DSS, and NIST frameworks. Findings can be correlated and enriched to prioritize critical issues, with customizable dashboards and near-real-time analytics. Attack-path views map how vulnerabilities and configuration problems may connect to important resources. Visibility can extend to Microsoft Azure virtual machines, container images, Function Apps, and identities. The Essentials plan includes findings ingestion and aggregation, Automation Rules, CSPM, selected Inspector scanning, CIS Benchmark Assessments, and a service-linked AWS Config recorder. Per-resource charges apply to EC2, ECR images, Lambda functions, and IAM users and roles; other monitored resources are included. The Extended Plan adds curated partner solutions and requires Essentials. Threat Analytics and Lambda code scanning are separate tiered add-ons. A 30-day trial is available, with pay-as-you-go billing.
Good
- Correlates findings to prioritize critical issues
- Maps potential attack paths
- Supports Microsoft Azure resource visibility
- Includes Automation Rules in Essentials
- Offers curated partner integrations
Watch out
- No free plan
- Extended Plan requires Essentials
- Some AWS security features bill separately
- Pay-as-you-go resource charges apply
Who it suits
Security Hub CSPM suits startups, enterprises, nonprofits, and governments managing security posture across AWS accounts or Regions. It also fits teams needing Azure visibility, compliance checks, and automated remediation workflows.
Verdict
Security Hub CSPM centralizes posture checks, findings, attack-path analysis, and response workflows across AWS and selected Azure resources. Plan scope and separate service billing should be reviewed before enabling add-ons or partner solutions.
Plans and prices
From AWS Security Hub CSPM's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Security Hub Essentials | — | Per-resource charges apply to EC2 instances, ECR container images, Lambda functions, and IAM users/roles; other monitored resources are included; AWS and Azure coverage · Pay-as-you-go; resource unit / mo; prorated by monitored time |
| Security Hub Extended Plan | — | Essentials must be enabled first; charges are additional to Essentials; 23 curated partner solutions across 10 security categories · Pay-as-you-go per partner; no upfront commitments |
| Threat Analytics + Lambda Code Scanning add-ons | — | Threat Analytics covers CloudTrail management events, S3 data events, VPC Flow Logs, DNS query logs, and EKS audit logs; Lambda code scanning scans on deployment and periodically · Tiered by volume; in addition to Essentials |
The facts
Each one read from AWS Security Hub CSPM's own pages, with the date it was checked.
What it does
- Attack path analysis
- Security Hub visualizes potential attack paths by mapping how vulnerabilities and misconfigurations could connect to critical resources.checked 4 Oct 2026
- Compliance support
- AWS says it supports 143 security standards and compliance certifications, including PCI-DSS, HIPAA/HITECH, FedRAMP, GDPR, FIPS 140-3, and NIST 800-171.checked 4 Oct 2026
- Frameworks
- Its standards align with AWS Foundational Security Best Practices, CIS, PCI DSS, and NIST.checked 4 Oct 2026
- Included capabilities
- The Essentials plan includes findings ingestion and aggregation, Automation Rules, CSPM, several Inspector scanning capabilities, CIS Benchmark Assessments, and a service-linked AWS Config recorder.checked 4 Oct 2026
- Intended customers
- AWS says its customers range from startups and enterprises to nonprofits and governments.checked 4 Oct 2026
- Multicloud
- Security Hub can extend visibility to Microsoft Azure resources, including virtual machines, container images, Function Apps, and identities.checked 4 Oct 2026
- Partner integrations
- The Extended Plan offers curated partner solutions across endpoint, identity, email, network, data, browser, cloud, AI, security operations, and supply chain categories.checked 4 Oct 2026
- Pricing scope
- Per-resource pricing applies to EC2 instances, ECR container images, Lambda functions, and IAM users and roles; other monitored resources are included.checked 4 Oct 2026
- Purpose
- AWS Security Hub CSPM checks AWS resources against security best practices and combines findings from AWS security services and partner tools to identify misconfigurations and assess security posture.checked 4 Oct 2026
- Response automation
- Security Hub provides automated response workflows to streamline remediation at scale.checked 4 Oct 2026
- Risk prioritization
- Security Hub correlates and enriches findings to prioritize critical issues across accounts and AWS Regions, with customizable dashboard widgets and near-real-time risk analytics.checked 4 Oct 2026
- Shared responsibility
- AWS states security and compliance are shared responsibilities, with customers responsible for guest operating systems, application software, and configuration of AWS security group firewalls.checked 4 Oct 2026
- Support and procurement
- AWS describes Security Hub as offering one consolidated bill, consolidated support, and flexible pricing across AWS and partner solutions.checked 4 Oct 2026
Money
- Billing limit
- Other AWS security service capabilities not included in Security Hub plans, including remaining GuardDuty and Inspector capabilities, retain their original service billing.checked 4 Oct 2026
Alternatives to AWS Security Hub CSPM
- 1
Aikido CSPM
Free planWebAPILinuxmacOS7.9From $300 a month - 2
Mondoo CSPM
Free planOpen sourceWebAPIExtensionLinux7.7Free plan - 3
Microsoft Defender for Business
AndroidiOSAPImacOS7.5 - 4
Sysdig Secure
WebAPILinuxmacOS7.2From $20 a month - 5
Powerpipe
Free planWebLinuxmacOSSelf-hosted7.1Free plan - 6
Oracle Cloud Infrastructure Secret Management
Free planWebAPI7.0Free plan