AWS GuardDuty vs Aqua Cloud Security Platform comparison

Aqua Security and Amazon Web Services (AWS) are both solutions in the Cloud Workload Protection Platforms (CWPP) category. Aqua Security is ranked #22, while Amazon Web Services (AWS) is ranked #2 with an average rating of 8.8. Aqua Security holds a 2.3% mindshare in CWPP, compared to Amazon Web Services (AWS)’s 14.8% mindshare. Additionally, 93% of Aqua Security users are willing to recommend the solution, compared to 92% of Amazon Web Services (AWS) users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Nov 2, 2025

Aqua Cloud Security Platform and AWS GuardDuty compete in cloud security, with Aqua distinguished by its deployment flexibility and customer support, whereas AWS GuardDuty leads in advanced security features.

Features: Aqua Cloud Security Platform emphasizes comprehensive workload protection, container security, and incident response capabilities. AWS GuardDuty is notable for threat detection, seamless AWS integration, and enhanced security insights.

Room for Improvement: Aqua could improve by expanding documentation and support for multi-cloud environments, offering more frequent updates, and enhancing UI intuitiveness. AWS GuardDuty could benefit from reducing complexity in threat configuration, expanding non-AWS service compatibility, and decreasing alert noise through better filtering.

Ease of Deployment and Customer Service: Aqua Cloud Security Platform offers easy deployment and strong customer support. AWS GuardDuty is easily deployable within the AWS ecosystem but may need adjustments for optimal performance.

Pricing and ROI: Aqua Cloud Security Platform provides competitive pricing with favorable ROI due to cost-effective security enhancements. AWS GuardDuty, although more expensive, offers high ROI through advanced threat intelligence and efficient AWS infrastructure use.

To learn more, read our detailed AWS GuardDuty vs. Aqua Cloud Security Platform Report (Updated: December 2025).

Buyer's Guide

AWS GuardDuty vs. Aqua Cloud Security Platform

December 2025

Download the complete report

Helped 881,082 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

SentinelOne Singularity Clo...

Mindshare comparison

As of January 2026, in the Cloud Workload Protection Platforms (CWPP) category, the mindshare of SentinelOne Singularity Cloud Security is 3.8%, up from 2.2% compared to the previous year. The mindshare of Aqua Cloud Security Platform is 2.3%, down from 3.4% compared to the previous year. The mindshare of AWS GuardDuty is 14.8%, up from 12.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Cloud Workload Protection Platforms (CWPP) Market Share Distribution
Product	Market Share (%)
AWS GuardDuty	14.8%
SentinelOne Singularity Cloud Security	3.8%
Aqua Cloud Security Platform	2.3%
Other	79.1%

Cloud Workload Protection Platforms (CWPP)

Featured Reviews

Satyavijay Chavan

Information Security Engineer at DataVigilant Infotech

Enables us to prioritize and effectively address critical security issues

Evidence-based reporting helps us to prioritize and solve critical security issues. The new visualization feature demonstrates how an attacker can enter the system, highlighting the potential path that can be exploited and outlining all the steps the attacker could take. With that visibility, we can ensure the perimeter is strong and attackers cannot enter, thus reducing the risk. It has helped us prioritize issues. The visibility into how an attack could happen is valuable. For example, it highlights the system vulnerability and outlines where an attack could propagate. The visualization helps me to prioritize remediation, and if I don't know where to start, I can check to see the score that enables me to prioritize issues. I am using infrastructure-as-code scanning, and it's one of the useful features. In pre-production, it identifies embedded secrets and misconfigurations, including issues with Kubernetes or some privileged containers. This feature allows us to pass the audit and secure IaC code so that it isn't easily exploitable by attackers. We can more proactively work to identify and resolve vulnerabilities by using the dashboard and the alerting system that SentinelOne provides. It helps us with audits and compliance. We can show the compliance in percentage. We can confidently say that our company or infrastructure is very secure. It has improved our security posture by 30% to 35%. It has reduced our false positives by 30%. It has helped teams collaborate better. The security team manages SentinelOne Singularity Cloud Security, and when it flags vulnerabilities, they are forwarded to DevOps for remediation. Previously, we needed to identify and report the issues, but there would be lapses in communication. Now, there is a centralized dashboard that anyone can look at and see the open issues and work on them.

Read full review

Burak AKCAGUN

Business Development Manager at Axoft Ukraine

A robust and cost-effective solution, excelling in scalability, on-premises support, and responsive technical support, making it well-suited for enterprises navigating stringent regulatory environment

The most crucial aspect is runtime protection, specifically image scanning before preproduction and deployment. Customers find it invaluable to have the ability to check for vulnerabilities in an image before deployment, similar to a sandbox environment. This feature ensures that customers can identify any potential issues with the image, such as misconfigurations or vulnerabilities, before integrating it into their workloads and infrastructure. In their source pipeline, companies can identify issues before deploying changes. This is crucial because customers prefer resolving any problems or misconfigurations before the deployment process. Software change security, including GSPM Cloud, is a key feature customers seek in their infrastructure.

Read full review

ShantanuKhare

Senior IT Auditor at Ernst & Young

Has provided automated threat detection and daily malicious activity insights while supporting seamless orchestration with existing dashboards

I would assess the integration of AWS GuardDuty with Threat Intelligence as majorly positive; no threat intelligence is 100% accurate, and there are a few false positives, but as a security engineer, this must be accepted, and overall, the response and service is good for us. We do not directly use AWS GuardDuty dashboard by itself, as we have our own integrated security dashboard; AWS GuardDuty gives the feed to that dashboard, and it's giving us a satisfactory view of how the security landscape looks. We use metrics such as zero-day threats, any malicious traffic, and any traffic which originates from OFAC countries to measure its effectiveness, as we are majorly into a financial institution, as any traffic that is from a malicious IP or a rogue device. I don't see any significant negative points regarding AWS GuardDuty; it's a good product to have if you're a cloud consumer. I rate AWS GuardDuty nine out of ten overall.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The GUI is one of the best features. Audit reports and documentation for alerts are also valuable."

"We noted immediate benefits from using the solution."

"The mean time to detect has been reduced."

"The ease of use of the platform is very nice."

"The most valuable feature of SentinelOne Singularity Cloud Security is its advanced AI and machine learning capabilities, which allow it to identify and respond to threats in real time."

"As a frequently audited company, we value SentinelOne Singularity Cloud Security's compliance monitoring features. They give us a report with a compliance score for how well we meet certain regulatory standards, like HIPAA. We can show our compliance as a percentage. It's also a way to show that we are serious about security."

"I like CSPM the most. It captures a lot of alerts within a short period of time. When an alert gets triggered on the cloud, it throws an alert within half an hour, which is very reasonable. It is a plus point for us."

"It is fairly simple. Anybody can use it."

More SentinelOne Singularity Cloud Security pros

"The most valuable feature of Aqua Security is the scanner."

"The container security element of this product has been very valuable to our organization."

"The DTA, which stands for Dynamic Threat Analysis, allows me to analyze Docker images in a sandbox environment before deployment, helping me anticipate risks."

"The most helpful feature of Aqua Security is Drift Prevention, which is a feature that allows images to be immutable. In addition, one of the main reasons we went with Aqua Security is because it provides strong protection when it comes to runtime security."

"Aqua Security helps us to check the vulnerability of image assurance and check for malware."

"Support is very helpful."

"Their sandboxing service is also really good."

"We use Aqua Security for the container security features."

More Aqua Cloud Security Platform pros

"We have over 1,000 employees, and we monitor their activity through AWS GuardDuty."

"The solution will detect abnormalities in the AWS workload and alert us so that we can monitor and take action."

"With anomaly detection, active threat monitoring, and set correlation, GuardDuty alerts me to any unusual user behavior or traffic patterns right away, which is great for staying on top of potential security risks."

"We use the tool for threat detection. AWS includes AI features as well. AWS GuardDuty gives us reports."

"It helps us detect brute-force attacks based on machine learning."

"The solution provides AWS GuardDuty S3 protection, EKS runtime protection, and malware protection."

"AWS GuardDuty is a great solution; I appreciate it because it's native for the Cloud provider, and I don't need to acquire other tools from another vendor."

"Since our environment is cloud based and accessible from the internet, we like the ability to check where the user has logged in from and what kind of API calls that user is doing."

More AWS GuardDuty pros

Cons

"I would like SentinelOne Singularity Cloud Security's detections to be openly available online instead of only accessible through their portal. Other tools have detections that are openly available without going through the tool."

"One area that could be improved in SentinelOne Singularity Cloud Security is their policies; the way they have configured the policies could be enhanced."

"SentinelOne Singularity Cloud Security has limited legacy system support and may not fully support older operating systems or legacy environments."

"SentinelOne Singularity Cloud Security takes four to five hours to detect and highlight an issue, and that time should be reduced."

"The dashboard can be more detailed."

"SentinelOne Singularity Cloud Security is an excellent CSPM tool, but the CWPP features need to improve, and there is a scope for more application security posture management features. There aren't many ASPM solutions on the market, and existing ones are costly. I would like to see SentinelOne Singularity Cloud Security develop into a single pane of glass for ASPM, CSPM, and CWPP. Another feature I'd like to see is runtime protection."

"The SentinelOne customer support needs improvement, as they are sometimes late in responding, which is critical in a production issue."

"They could generally give us better comprehensive rules."

More SentinelOne Singularity Cloud Security cons

"It's a bit hard to use the user roles. That was a bit confusing."

"They want to release improvements to their product to work with other servers because now there are more focused on the Kubernetes environment. They need to improve the normal servers. I would like to have more options."

"We would like to see an improvement in the overview visibility that this solution offers."

"Since we are working from home, we would like to have the proper training for Aqua."

"Sometimes I got stressed with the UI."

"Aqua Security could improve the forwarding of logging into Splunk and into other tools, it should be easier."

"I would like Aqua Security to look into is the development of a web security portal."

"Aqua Security lacks a lot in reporting."

More Aqua Cloud Security Platform cons

"Improvement-wise, Amazon GuardDuty should have an overall dashboard analytics function so we could see what's in the current environment, and then in addition to that, provide best practices and recommendations, particularly to provide some type of observability, and then figure out the login side of it, based on our current environment, in terms of what we're not monitoring and what we should monitor. The solution should also give us a sample code configuration to implement that added feature or feature request. What I'd like to see in the next release of Amazon GuardDuty are more security analytics, reporting, and monitoring. They should provide recommendations and additional options that answer questions such as "Hey, what can we see in our environment?", "What should we implement within the environment?", What's recommended?" We know that cost will always be associated with that, but Amazon GuardDuty should show us the increased costs or decreased costs if we implement it or don't implement it, and that would be a good feature request, particularly with all products within AWS, just for cloud products in general because there are times features are implemented, but once they're deployed, they don't tell you about costs that would be generated along with those features. After features are deployed, there should a summary of the costs that would be generated, and projected based on current usage, so they would give us the option to figure out how long we're going to use those features and the option to keep those on or turn those off. If more services were like that, a lot more people would use those on the cloud."

"While sending the alerts to the email, they are not being patched. we have to do the patching and mapping manually. If GuardDuty could include a feature to do this automatically, it will make our job easier. That is something I believe can be improved."

"It is evolving, and at the moment, I will just need it on a larger scale. Then, it will satisfy my demand, initially."

"There is currently no consolidated dashboard for AWS GuardDuty. It would be helpful if they could provide a dashboard based on severity levels (high, medium, low) and offer insights account-wise, especially for users utilizing automation structures."

"I work in a bank, and it would be good if AWS GuardDuty could be integrated with other monitoring and detection tools we use."

"An improvement would be to have a mobile version where remote workers can log in and monitor and fix issues."

"For the next release, they could provide IPS features as well."

"GuardDuty is limited to AWS environments."

More AWS GuardDuty cons

Pricing and Cost Advice

"We have an enterprise license. It is affordable. I'm not sure, but I think we pay 150,000 rupees per month."

"As a partner, we receive a discount on the licenses."

"We found it to be fine for us. Its price was competitive. It was something we were happy with. We are not a Fortune 500 company, so I do not know how pricing scales at the top end, but for our cloud environment, it works very well."

"The tool is cost-effective."

"I would rate the cost a seven out of ten with ten being the most costly."

"Pricing is based on modules, which was ideal for us."

"SentinelOne is relatively cheap. If ten is the most expensive, I would rate it a seven."

"The pricing is fair. It is not inexpensive, and it is also not expensive. When managing a large organization, it is going to be costly, but it meets the business needs. In terms of what is out there on the market, it is fair and comparable to what I have seen, so I do not have any complaints about the cost"

More SentinelOne Singularity Cloud Security pricing and cost advice

"It comes at a reasonable cost."

"They were reasonable with their pricing. They were pretty down-to-earth about the way they pitched their product and the way they tried to close the deal. They were one of the rare companies that approached the whole valuation in a way that made sense for our company, for our needs, and for their own requirements as well... They will accommodate your needs if they are able to understand them and they're stated clearly."

"Dealing with licensing costs isn't my responsibility, but I know that the licenses don't depend on the number of users, but instead are priced according to your workload."

"Aqua Security is not cheap, and it's not very expensive, such as Splunk, they are in the middle."

"The pricing of this solution could be improved."

"In terms of the costs associated with Amazon GuardDuty, it was $1 per GB from what I recall. Pricing was based on per gigabyte. For example, for the first five hundred gigabytes per month, it'll be $1 per GB, so it'll be $500. If your usage was greater, there's another bracket, for example, the next two thousand GB, then there's an add-on cost of 50 cents per GB. That's how Amazon GuardDuty pricing slowly goes up. I can't remember if there was any kind of additional cost apart from standard licensing for the solution. Nothing else that at least comes to mind. What the service was charging was worth it. That was one good thing when using Amazon GuardDuty because my company could be in a certain tier for a certain period. My company wasn't under a licensing model where it could overestimate its usage and under-utilize its usage and pay much more. This was what made the pricing model for Amazon GuardDuty better."

"Pricing is determined by the number of events sent."

"We use a pay-as-you-use license, which is competitively priced in the market."

"I prefer to have something on demand for myself. That's why I haven't been paying for GuardDuty specifically. AWS provides a wide range of offerings, especially in the security area."

"On a scale of one to ten, where one is a high price, and ten is a low price, I rate the pricing a four or five, which is somewhere in the middle."

"The tool's licensing model is pay-as-you-go."

"The price of the solution is exactly right."

"The pricing model is pay as you go and is based on the number of events per month."

More AWS GuardDuty pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Cloud Workload Protection Platforms (CWPP) solutions are best for your needs.

See recommendations

881,082 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

14%

Computer Software Company

12%

Manufacturing Company

10%

Government

Financial Services Firm

24%

Computer Software Company

10%

Manufacturing Company

10%

Government

Financial Services Firm

15%

Computer Software Company

12%

Manufacturing Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	48
Midsize Enterprise	20
Large Enterprise	54

By reviewers
Company Size	Count
Small Business	6
Midsize Enterprise	1
Large Enterprise	10

By reviewers
Company Size	Count
Small Business	8
Midsize Enterprise	3
Large Enterprise	15

Questions from the Community

What do you like most about PingSafe?

The dashboard gives me an overview of all the things happening in the product, making it one of the tool's best featu...

See all answers

What is your experience regarding pricing and costs for PingSafe?

I think the pricing of SentinelOne Singularity Cloud Security is a bit high.

See all answers

What needs improvement with PingSafe?

We did not try to use the threat investigations feature from SentinelOne Singularity Cloud Security.Drift detection w...

See all answers

What do you think of Aqua Security vs Prisma Cloud?

Aqua Security is easy to use and very manageable. Its main focus is on Kubernetes and Docker. Security is a very valu...

See all answers

What do you like most about Amazon GuardDuty?

With anomaly detection, active threat monitoring, and set correlation, GuardDuty alerts me to any unusual user behavi...

See all answers

What is your experience regarding pricing and costs for Amazon GuardDuty?

AWS GuardDuty is an expensive feature, and while you can't expect the price to be low, it can be lower because it's p...

See all answers

What needs improvement with Amazon GuardDuty?

AWS GuardDuty is a good product; it's doing its job right now, and I don't see any additional improvements needed. Co...

See all answers

Comparisons

Wiz vs SentinelOne Singularity Cloud Security

Compared 10% of the time

Prisma Cloud by Palo Alto Networks vs SentinelOne Singularity Cloud Security

Compared 10% of the time

Microsoft Defender for Cloud vs SentinelOne Singularity Cloud Security

Compared 6% of the time

CrowdStrike Falcon Cloud Security vs SentinelOne Singularity Cloud Security

Compared 4% of the time

Snyk vs SentinelOne Singularity Cloud Security

Compared 3% of the time

More SentinelOne Singularity Cloud Security Competitors

Prisma Cloud by Palo Alto Networks vs Aqua Cloud Security Platform

Compared 14% of the time

Wiz vs Aqua Cloud Security Platform

Compared 12% of the time

Sysdig Secure vs Aqua Cloud Security Platform

Compared 7% of the time

Trend Micro Deep Security vs Aqua Cloud Security Platform

Compared 4% of the time

Red Hat Advanced Cluster Security for Kubernetes vs Aqua Cloud Security Platform

Compared 4% of the time

More Aqua Cloud Security Platform Competitors

Microsoft Defender for Cloud vs AWS GuardDuty

Compared 68% of the time

CrowdStrike Falcon Cloud Security vs AWS GuardDuty

Compared 7% of the time

Wiz vs AWS GuardDuty

Compared 5% of the time

Prisma Cloud by Palo Alto Networks vs AWS GuardDuty

Compared 4% of the time

Trend Vision One - Cloud Security vs AWS GuardDuty

Compared 3% of the time

More AWS GuardDuty Competitors

Product Reports

Buyer's Guide

SentinelOne Singularity Cloud Security

January 2026

SentinelOne Singularity Cloud Security report

Download SentinelOne Singularity Cloud Security product report

Buyer's Guide

Aqua Cloud Security Platform

January 2026

Download Aqua Cloud Security Platform product report

Buyer's Guide

AWS GuardDuty

January 2026

Download AWS GuardDuty product report

Also Known As

PingSafe

Aqua Security Platform, CloudSploit, Argon

No data available

Overview

SentinelOne Singularity Cloud Security offers a streamlined approach to cloud security with intuitive operation and strong integration capabilities for heightened threat detection and remediation efficiency.

Singularity Cloud Security stands out for its real-time detection and response, effectively minimizing detection and remediation timelines. Its automated remediation integrates smoothly with third-party tools enhancing operational efficiency. The comprehensive console ensures visibility and support for forensic investigations. Seamless platform integration and robust support for innovation are notable advantages. Areas for development include improved search functionality, affordability, better firewall capabilities for remote users, stable agents, comprehensive reporting, and efficient third-party integrations. Clarity in the interface, responsive support, and real-time alerting need enhancement, with a call for more automation and customization. Better scalability and cost-effective integration without compromising capabilities are desired.

What are SentinelOne Singularity Cloud Security's standout features?

Ease of Use: Intuitive operation simplifies navigation across platforms.
Real-Time Detection: Quick identification and response to threats.
Automated Remediation: Streamlines recovery processes with integration capabilities.
Forensic Visibility: Aids in thorough threat analysis and prevention strategies.
Comprehensive Console: Offers full visibility and historical data tracking.
Platform Integration: Supports seamless operation across cloud and hybrid environments.

What benefits should users expect from SentinelOne Singularity Cloud Security?

Enhanced Efficiency: Automation and third-party integration improve threat response.
Improved Detection: Reduces mean time to detect and respond to threats.
Operational Support: Comprehensive visibility and forensic tools aid operational decisions.
Cost Efficiency: Affordable integration with scaling capabilities without high overhead.

SentinelOne Singularity Cloud Security is deployed in industries needing robust cloud security posture management, endpoint protection, and threat hunting. Utilized frequently across AWS and Azure, it assists in monitoring, threat detection, and maintaining compliance in diverse environments while providing real-time alerts and recommendations for proactive threat management.

SentinelOne

Aqua Security stops cloud native attacks, preventing them before they happen and stopping them when they happen. Dedicated cloud native threat research and the most loved cloud native security open source community in the world put innovation at your fingertips so you can transform your business. Born cloud native, The Aqua Platform is the most integrated Cloud Native Application Protection Platform (CNAPP), securing from day one and protecting in real-time. Aqua has been stopping real cloud native attacks on hundreds of thousands of production nodes across the world since 2015.

Aqua Security Features

Aqua Security has many valuable key features. Some of the most useful ones include:

Vulnerability scanning
Dynamic threat analysis
Automates DevSecOps
CI/CD integrations
Cloud security posture management
Kubernetes security
Hybrid and multi-cloud
Container security
Serverless security
VM security
Cloud workloads protection

Aqua Security Benefits

There are many benefits to implementing Aqua Security. Some of the biggest advantages the solution offers include:

Designed for scale and performance: The Aqua Security platform was designed to scale to the largest environments in order to protect huge clusters and massive DevOps pipelines.

Empowers DevOps to detect issues early and fix them fast: The solution was designed to help you solve issues immediately - before they cause greater damage to your organization. It helps you gain insight into your vulnerability posture and prioritize remediation and mitigation according to contextual risk.

Automated compliance and security posture: Aqua Security checks your cloud services, Infrastructure-as-code templates, and Kubernetes setup against best practices and standards. This way, you can ensure the infrastructure you run your applications on is securely configured and in compliance.

Artifact scanning: The Aqua Security platform scans artifacts for vulnerabilities, malware, and other risks during development and staging. It allows you to set flexible and dynamic policies to control deployment into your runtime environments.

Minimizes false positives: Aqua Security relies on a variety of sources and proprietary research to curate and present vulnerabilities in the most accurate way, which helps to minimize false positives and unnecessary noise in the pipeline.

Automated security testing: The Aqua Security platform automates security testing in your CI/CD pipeline, and continuously scans registries and serverless function stores to detect emerging risks. By implementing the platform, you can get actionable feedback within your CI environments to empower your organization’s developers to fix issues rapidly.

Granular controls: The solution provides protection for your VM, container, and serverless workloads using granular controls with instant visibility and real-time detection and response.

Sandboxed environment: With Aqua Security, you can run images in a secure sandboxed environment that traces indicators of compromise (IOCs) such as container escapes, reverse shell backdoors, malware drops, code injection backdoors, and network anomalies.

Reviews from Real Users

Lizeth Z., Cloud Security Specialist at Telstra, says, “Aqua Security is the most advanced solution in the market for container security. Aqua Security allows us to check for vulnerabilities in the CI/CD pipeline, so application teams can remediate issues before going into production. Aqua Security helps us to check the vulnerability of image assurance and check for malware.”

Aqua Security

Amazon Guard Duty is a continuous cloud security monitoring service that consistently monitors and administers several data sources. These include AWS CloudTrail data events for EKS (Elastic Kubernetes Service) audit logs, VPC (Virtual Private Cloud) flow logs, DNS (Domain Name System) logs, S3 (Simple Cloud Storage), and AWS CloudTrail event logs.

Amazon GuardDuty intuitively uses threat intelligence data - such as lists of malicious domains and IP addresses - and ML (machine learning) to quickly discover suspicious and problematic activity in a user's AWS ecosystem. Activities may include concerns such as interactions with malicious IP addresses or domains, exposed credentials usage, or changes and/or escalation of privileges.

GuardDuty is able to easily determine problematic AWS EC2 (Elastic Compute Cloud) instances delivering malware or mining bitcoin. It is also able to trace AWS account access history for evidence of destabilization. such as suspicious API calls resulting in changing password policies to minimize password strength or anomalous infrastructure deployments in new or different never-used regions.

GuardDuty will continually alert users regarding their AWS environment status and will send the security discoveries to the GuardDuty dashboard or Amazon CloudWatch events for users to view.

Users can access GuardDuty via:

AWS SDKs: Amazon provides users with several software development kits (SDKs) that are made up of libraries and sample code of numerous popular programming languages and platforms, such as Android, iOS, Java, .Net, Python, and Ruby. The SDKs make it easier to develop programmatic access to GuardDuty.
GuardDuty HTTPS API: This allows users to issue HTTPS requests directly to the service.
GuardDuty Console: This is a browser-based intuitive dashboard interface where users can access and use GuardDuty.

Amazon Elastic Kubernetes Service (Amazon EKS)

Kubernetes protection is an optional add-on in Amazon GuardDuty. This tool is able to discover malicious behavior and possible destabilization of an organization's Kubernetes clusters inside of Amazon Elastic Kubernetes Service (Amazon EKS).

When Amazon EKS is activated, GuardDuty will actively use various data sources to discover potential risks against Kubernetes API. When Kubernetes protection is enabled, GuardDuty uses optional data sources to detect threats against Kubernetes API.

Kubernetes audit logs are a Kubernetes feature that captures historical API activity from applications, the control plane, users, and endpoints. GuardDuty collates these logs from Amazon EKS to create Kubernetes discoveries for the organization's Amazon EKS assets; there is no need to store or turn on the logs.

As long as Kubernetes protection remains activated, GuardDuty will continuously dissect Kubernetes data sources from the Amazon EKS clusters to ensure no suspicious or anomalous behavior is taking place.

Amazon Simple Cloud Storage (S3) Protection

Amazon S3 allows Amazon GuardDuty to actively audit object-level API processes to discover possible security threats to data inside an organization's S3 buckets. GuardDuty continually audits risk to the organization’s S3 assets by carefully dissecting AWS CloudTrail management events and AWS CloudTrail S3 data events. These tools are continually auditing various CloudTrail management events for potential suspicious activities that affect S3 buckets, such as PutBucketReplication, DeleteBucket, ListBucket, and data events for S3 object-level API processes, such as PutObject, GetObject, ListObject, and DeleteObject.

Reviews from Real Users

“The most valuable features are the single system for data collection and the alert mechanisms. Prior to using GuardDuty, we had multiple systems to collect data and put it in a centralized location so we could look into it. Now we don't need to do that anymore as GuardDuty does it for us.” - Arunkumar A., Information Security Manager at Tata Consultancy Services

Amazon Web Services (AWS)

Sample Customers

Information Not Available

HPE Salesforce Telstra Ellie Mae Cathay Pacific HomeAway

autodesk, mapbox, fico, webroot

Buyer's Guide

AWS GuardDuty vs. Aqua Cloud Security Platform

December 2025

Free Report: AWS GuardDuty vs. Aqua Cloud Security Platform

Find out what your peers are saying about AWS GuardDuty vs. Aqua Cloud Security Platform and other solutions. Updated: December 2025.

DOWNLOAD NOW

881,082 professionals have used our research since 2012.

See our AWS GuardDuty vs. Aqua Cloud Security Platform report.

See our list of best Cloud Workload Protection Platforms (CWPP) vendors.

We monitor all Cloud Workload Protection Platforms (CWPP) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.