AWS GuardDuty vs Threat Stack Cloud Security Platform [EOL] comparison

Amazon Web Services (AWS) and F5 are both solutions in the Cloud Workload Protection Platforms (CWPP) category. Additionally, 91% of Amazon Web Services (AWS) users are willing to recommend the solution, compared to 88% of F5 users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on May 4, 2025

Threat Stack Cloud Security Platform EOL and AWS GuardDuty are competing in the cloud security domain. AWS GuardDuty has the upper hand with its comprehensive integration capabilities and robust automation features, although Threat Stack offers competitive pricing and support.

Features: Threat Stack provides extensive workload monitoring, anomaly detection, and compliance reporting. AWS GuardDuty focuses on automated threat detection, deep integration with AWS services, and leveraging machine learning for comprehensive security insights.

Room for Improvement: Threat Stack could improve by expanding its automation capabilities and enhancing its integration with more cloud environments. AWS GuardDuty may benefit from broadening its support for non-AWS services and offering more user-friendly interfaces for customization and configuration. Additionally, AWS GuardDuty could lower its cost to be more affordable for smaller businesses.

Ease of Deployment and Customer Service: Threat Stack is noted for its simple deployment and strong initial setup support. AWS GuardDuty, designed for seamless AWS integration, offers quick activation and vast AWS support resources, facilitating easier deployment in AWS-centric environments compared to Threat Stack's more hands-on model.

Pricing and ROI: Threat Stack is praised for its cost-effectiveness and customizable pricing, providing significant ROI through tailored spending. AWS GuardDuty, albeit more costly, justifies expenses with efficient automation and integration, which promises long-term ROI through enhanced scalability and functionality.

To learn more, read our detailed Cloud Workload Protection Platforms (CWPP) Report (Updated: June 2025).

Buyer's Guide

Cloud Workload Protection Platforms (CWPP)

June 2025

Download the complete report

Helped 860,592 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

SentinelOne Singularity Clo...

Featured Reviews

Andrew W

VP - Information Technology at a financial services firm with 201-500 employees

Tells us about vulnerabilities as well as their impact and helps to focus on real issues

Looking at all the different pieces, it has got everything we need. Some of the pieces we do not even use. For example, we do not have Kubernetes Security. We are not running any K8 clusters, so it is good for us. Overall, we find the solution to be fantastic. There can be additional education components. This may not be truly fair to them because of what the product is going for, but it would be great to see additional education for compliance. It is not a criticism of the tool per se, but anything to help non-development resources understand some of the complexities of the cloud is always appreciated. Any additional educational resources are always helpful for security teams, especially those without a development background.

Read full review

Terence Dube

AWS Cloud Engineer at Standard Telephones and Cables

Comprehensive threat detection simplifies security management

GuardDuty is limited to AWS environments. While incorporating Amazon Detective for detailed investigation can be useful, including more granular details in findings, such as specific user actions or historical comparisons, would be beneficial. Furthermore, managing global AWS environments requires setting up additional tools for viewing GuardDuty findings across multiple regions. A unified dashboard that aggregates findings across all regions without requiring manual aggregation could enhance convenience for users.

Read full review

Vincent Romney

Director of Information Security at Younique, LLC

Pivotal for SOX and Sarbanes-Oxley compliance as well as security in AWS, but needs work on the application layer side

It certainly has a lot of capabilities and we're not using much of what it can do. That's something that, as we mature as an organization, we'll expand into. The one thing that we know they're working on, but we don't have through the tool, is the application layer. As we move to a serverless environment, with AWS Fargate or direct Lambda, that's where Threat Stack does not have the capacity to provide feed. Those are areas that it's blind to now, so that's the biggest area for improvement. They're currently looking at changing that with an acquisition, but as it stands right now, that's the only spot that I consider weak.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"SentinelOne Singularity Cloud Security can integrate all your cloud accounts and resources you create in the AWS account, We have set it up to scan the AWS transfer services, EC2, security groups, and GitHub."

"It is very straightforward. It is not complicated. For the information that it provides, it does a pretty good job."

"SentinelOne Singularity Cloud Security has a dashboard that can detect the criticality of a particular problem, whether it falls under critical, medium, or low vulnerability."

"SentinelOne Singularity Cloud Security offers an intuitive user interface that lets us navigate quickly and easily."

"The visibility SentinelOne Singularity Cloud Security provides into the Cloud environment is a valuable feature."

"They're responsive to feature requests. If I suggest a feature for Prisma, I will need to wait until the next release on their roadmap. Cloud Native Security will add it right away."

"SentinelOne Singularity Cloud Security offers three key features: vulnerability management notifications, cloud configuration assistance, and security scanning."

"The real-time detection and response capabilities overall are great."

More SentinelOne Singularity Cloud Security pros

"GuardDuty is extensive in terms of configuration and security compliance."

"The product has automated protection powered by AI/ML, which is now far more powerful than before. It uses AI/ML in its detection algorithm, providing fast and quick results."

"We have over 1,000 employees, and we monitor their activity through AWS GuardDuty."

"The most valuable features are the single system for data collection and the alert mechanisms."

"AWS GuardDuty is a great solution; I appreciate it because it's native for the Cloud provider, and I don't need to acquire other tools from another vendor."

"The correlation back end is the solution's most valuable feature."

"The solution is easy to use."

"Overall, GuardDuty is a very easy-to-use tool, and I would recommend it even to those who are not tech-savvy."

More AWS GuardDuty pros

"The most valuable feature is the SecOps because they have our back and they help us with the reports... It's like having an extension of your team. And then, it grows with you."

"Technical support is very helpful."

"It is scalable. It deploys easily with curl and yum."

"We're using it on container to see when activity involving executables happens, and that's great."

"We like the ability of the host security module to monitor the processes running on our servers to help us monitor activity."

"The number-one feature is the monitoring of interactive sessions on our Linux machines. We run an immutable environment, so that nothing is allowed to be changed in production... We're constantly monitoring to make sure that no one is violating that. Threat Stack is what allows us to do that."

"Every other security tool we've looked is good at containers, or at Kubernetes, is good at AWS, or at instance monitoring. But nobody is good at tying all of those things together, and that's really where Threat Stack shines."

"An important feature of this solution is monitoring. Specifically, container monitoring."

More Threat Stack Cloud Security Platform [EOL] pros

Cons

"There is scope for more application security posture management features. Additionally, the runtime protection needs attention."

"For vulnerabilities, they are showing CVE ID. The naming convention should be better so that it indicates the container where a vulnerability is present. Currently, they are only showing CVE ID, but the same CVE ID might be present in multiple containers. We would like to have the container name so that we can easily fix the issue."

"SentinelOne Singularity Cloud Security could be improved with easier integrations to the Singularity Data Lake, particularly for various vendors."

"We've found a lot of false positives."

"A few YouTube videos could be helpful. There isn't a lot of information out there to look at."

"Sometimes the Storyline ID is a bit wacky."

"The areas with room for improvement include the cost, which is higher compared to other security platforms. The dashboard can also be laggy."

"Their search feature could be better."

More SentinelOne Singularity Cloud Security cons

"For me, I would say just the presentation of findings, like the dashboards and other stuff, could be improved a bit."

"Improvement-wise, Amazon GuardDuty should have an overall dashboard analytics function so we could see what's in the current environment, and then in addition to that, provide best practices and recommendations, particularly to provide some type of observability, and then figure out the login side of it, based on our current environment, in terms of what we're not monitoring and what we should monitor. The solution should also give us a sample code configuration to implement that added feature or feature request. What I'd like to see in the next release of Amazon GuardDuty are more security analytics, reporting, and monitoring. They should provide recommendations and additional options that answer questions such as "Hey, what can we see in our environment?", "What should we implement within the environment?", What's recommended?" We know that cost will always be associated with that, but Amazon GuardDuty should show us the increased costs or decreased costs if we implement it or don't implement it, and that would be a good feature request, particularly with all products within AWS, just for cloud products in general because there are times features are implemented, but once they're deployed, they don't tell you about costs that would be generated along with those features. After features are deployed, there should a summary of the costs that would be generated, and projected based on current usage, so they would give us the option to figure out how long we're going to use those features and the option to keep those on or turn those off. If more services were like that, a lot more people would use those on the cloud."

"Some of the pain points in Amazon GuardDuty was the cost. When compared to some of the other services, depending on how many we had to monitor, if we had a huge range of accounts, as our accounts increased, we had a cost factor that came into play. Sometimes there were issues, for example, with findings that came up, we wanted to add notes and there were issues back then where notes couldn't be entered properly. If we wanted to leave a note such as "Okay, we have assessed this and this is how we feel", or "This is a false positive", Amazon GuardDuty wasn't allowing us to do that. Even with the suppression of certain findings, there was some issue that we had faced at one time. Those were some of the pain points of the solution."

"I would like to see more integration with other AWS provided services."

"The product needs to improve its cost-efficiency since it is expensive."

"AWS GuardDuty sometimes shows false positives and should have better detection accuracy."

"For the next release, they could provide IPS features as well."

"It is evolving, and at the moment, I will just need it on a larger scale. Then, it will satisfy my demand, initially."

More AWS GuardDuty cons

"The compliance and governance need improvement."

"The API - which has grown quite a bit, so we're still learning it and I can't say whether it still needs improvement - was an area that had been needing it."

"Some features do not work as expected."

"The user interface can be a little bit clunky at times... There's a lot of information that needs to be waded through, and the UI just isn't great."

"The one thing that we know they're working on, but we don't have through the tool, is the application layer. As we move to a serverless environment, with AWS Fargate or direct Lambda, that's where Threat Stack does not have the capacity to provide feed. Those are areas that it's blind to now..."

"The reports aren't very good. We've automated the report generation via the API and replaced almost all the reports that they generate for us using API calls instead."

"I would like further support of Windows endpoint agents or the introduction of support for Windows endpoint agents."

"They could give a few more insights into security groups and recommendations on how to be more effective. That's getting more into the AWS environment, specifically. I'm not sure if that's Threat Stack's plan or not, but I would like them to help us be efficient about how we're setting up security groups. They could recommend separation of VPCs and the like - really dig into our architecture. I haven't seen a whole lot of that and I think that's something that, right off the bat, could have made us smarter."

More Threat Stack Cloud Security Platform [EOL] cons

Pricing and Cost Advice

"I am not involved in the pricing, but it is cost-effective."

"Pricing is based on modules, which was ideal for us."

"PingSafe is fairly priced."

"PingSafe falls somewhere in the middle price range, neither particularly cheap nor expensive."

"It is cheap."

"For pricing, it currently seems to be in line with market rates."

"I understand that SentinelOne is a market leader, but the bill we received was astronomical."

"PingSafe is cost-effective for the amount of infrastructure we have. It's reasonable for what they offer compared to our previous solution. It's at least 25 percent to 30 percent less."

More SentinelOne Singularity Cloud Security pricing and cost advice

"Pricing is determined by the number of events sent."

"80 percent of the customers are using AWS GuardDuty, and we recommend it due to its low cost, especially for small customers, ranging from five to ten dollars a month. In our policies, we enforce the usage of this service, making it a recommended practice for security."

"The platform is inexpensive."

"I have heard that the solution's price is quite high."

"It can get very expensive. If you turn on every feature, it can turn into hundreds of thousands of dollars."

"GuardDuty only enables accounts in regions where you have an active workload. If there are places where you don't have an active workload, you wouldn't even enable them. That's one area where they could allow you to cut down your cost."

"The tool has no subscription charges."

"In terms of the costs associated with Amazon GuardDuty, it was $1 per GB from what I recall. Pricing was based on per gigabyte. For example, for the first five hundred gigabytes per month, it'll be $1 per GB, so it'll be $500. If your usage was greater, there's another bracket, for example, the next two thousand GB, then there's an add-on cost of 50 cents per GB. That's how Amazon GuardDuty pricing slowly goes up. I can't remember if there was any kind of additional cost apart from standard licensing for the solution. Nothing else that at least comes to mind. What the service was charging was worth it. That was one good thing when using Amazon GuardDuty because my company could be in a certain tier for a certain period. My company wasn't under a licensing model where it could overestimate its usage and under-utilize its usage and pay much more. This was what made the pricing model for Amazon GuardDuty better."

More AWS GuardDuty pricing and cost advice

"It is very expensive compared to some other products. The pricing is definitely high."

"I'm happy with the amount that we spend for the product that we get and the overall service that we get. It's not cheap, but I'm still happy with the spend."

"It came in cheaper than Trend Micro when we purchased it a few years ago."

"It is a cost-effective choice versus other solutions on the market."

"Pricing seems to be in line with the market structure. It's fine."

"We find the licensing and pricing very easy to understand and a good value for the services provided."

"What we're paying now is somewhere around $15 to $20 per agent per month, if I recall correctly. The other cost we have is SecOps."

See which vendors are best for you

Use our free recommendation engine to learn which Cloud Workload Protection Platforms (CWPP) solutions are best for your needs.

See recommendations

860,592 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

17%

Financial Services Firm

15%

Manufacturing Company

Government

Financial Services Firm

16%

Computer Software Company

14%

Manufacturing Company

Government

Computer Software Company

18%

Real Estate/Law Firm

13%

Manufacturing Company

University

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about PingSafe?

The dashboard gives me an overview of all the things happening in the product, making it one of the tool's best featu...

See all answers

What is your experience regarding pricing and costs for PingSafe?

I don't handle the price part, but it isn't more expensive than Palo Alto Prisma Cloud. It's not cheap, but it is wor...

See all answers

What needs improvement with PingSafe?

There is scope for more application security posture management features. Additionally, the runtime protection needs ...

See all answers

What do you like most about Amazon GuardDuty?

With anomaly detection, active threat monitoring, and set correlation, GuardDuty alerts me to any unusual user behavi...

See all answers

What is your experience regarding pricing and costs for Amazon GuardDuty?

I don't worry much about the pricing, but I think it is a good price for what they deliver. This cost is cheaper beca...

See all answers

What needs improvement with Amazon GuardDuty?

I think that some detections in container environments such as container runtime, and on services such as AWS contain...

See all answers

Ask a question

Earn 20 points

Comparisons

Wiz vs SentinelOne Singularity Cloud Security

Compared 20% of the time

Prisma Cloud by Palo Alto Networks vs SentinelOne Singularity Cloud Security

Compared 16% of the time

Microsoft Defender for Cloud vs SentinelOne Singularity Cloud Security

Compared 7% of the time

Check Point CloudGuard CNAPP vs SentinelOne Singularity Cloud Security

Compared 5% of the time

Orca Security vs SentinelOne Singularity Cloud Security

Compared 4% of the time

More SentinelOne Singularity Cloud Security Competitors

Microsoft Defender for Cloud vs AWS GuardDuty

Compared 47% of the time

CrowdStrike Falcon Cloud Security vs AWS GuardDuty

Compared 14% of the time

Wiz vs AWS GuardDuty

Compared 11% of the time

Prisma Cloud by Palo Alto Networks vs AWS GuardDuty

Compared 6% of the time

Check Point CloudGuard CNAPP vs AWS GuardDuty

Compared 3% of the time

More AWS GuardDuty Competitors

Microsoft Defender for Cloud Apps vs Threat Stack Cloud Security Platform [EOL]

Compared 30% of the time

Netskope vs Threat Stack Cloud Security Platform [EOL]

Compared 26% of the time

Cisco IOS Security vs Threat Stack Cloud Security Platform [EOL]

Compared 22% of the time

BMC Helix Cloud Security vs Threat Stack Cloud Security Platform [EOL]

Compared 22% of the time

More Threat Stack Cloud Security Platform [EOL] Competitors

Product Reports

Buyer's Guide

SentinelOne Singularity Cloud Security

June 2025

SentinelOne Singularity Cloud Security report

Download SentinelOne Singularity Cloud Security product report

Buyer's Guide

AWS GuardDuty

June 2025

Download AWS GuardDuty product report

Buyer's Guide

Threat Stack Cloud Security Platform [EOL]

June 2025

Threat Stack Cloud Security Platform [EOL] report

Download Threat Stack Cloud Security Platform [EOL] product report

Also Known As

PingSafe

No data available

Threat Stack, CSP,

Overview

SentinelOne Singularity Cloud Security protects cloud workloads, offering advanced threat detection and automated response. It integrates seamlessly with cloud environments and secures containerized applications and virtual machines against vulnerabilities.

SentinelOne Singularity Cloud Security is renowned for its efficiency in mitigating threats in real-time. The platform integrates effortlessly with existing cloud environments, ensuring robust cloud security management with minimal manual intervention. Securing containerized applications and virtual machines, it excels in threat intelligence and endpoint protection. However, improvements are needed in performance during high workload periods, and more integrations with third-party tools and better documentation would be beneficial. Users often find the installation process complex, support response times slow, and the dashboard's navigation unintuitive.

What are the key features of SentinelOne Singularity Cloud Security?

Real-time Threat Detection: Identifies and mitigates threats as they occur.
Automated Response: Automatically responds to threats to minimize impact.
Ease of Deployment: Simple setup process with scalable options.
Machine Learning Insights: AI-driven insights enhance threat prevention.
Seamless Integration: Integrates with cloud environments for unified security management.

What are the primary benefits or ROI to expect from SentinelOne Singularity Cloud Security?

Enhanced Threat Mitigation: Improved security against real-time threats.
Reduced Manual Intervention: Automated processes save time and resources.
Scalability: Easily adapts to growing security requirements.
Centralized Management: Manage security across platforms from a single console.
Advanced Threat Intelligence: Provides in-depth analysis and protection.

In specific industries, SentinelOne Singularity Cloud Security is implemented to safeguard critical data and infrastructure. Organizations in finance, healthcare, and technology depend on its real-time threat detection and automated response to protect sensitive information. Its ability to secure containerized applications and virtual machines is particularly valuable in dynamic environments where rapid scaling is necessary.

SentinelOne

Amazon Guard Duty is a continuous cloud security monitoring service that consistently monitors and administers several data sources. These include AWS CloudTrail data events for EKS (Elastic Kubernetes Service) audit logs, VPC (Virtual Private Cloud) flow logs, DNS (Domain Name System) logs, S3 (Simple Cloud Storage), and AWS CloudTrail event logs.

Amazon GuardDuty intuitively uses threat intelligence data - such as lists of malicious domains and IP addresses - and ML (machine learning) to quickly discover suspicious and problematic activity in a user's AWS ecosystem. Activities may include concerns such as interactions with malicious IP addresses or domains, exposed credentials usage, or changes and/or escalation of privileges.

GuardDuty is able to easily determine problematic AWS EC2 (Elastic Compute Cloud) instances delivering malware or mining bitcoin. It is also able to trace AWS account access history for evidence of destabilization. such as suspicious API calls resulting in changing password policies to minimize password strength or anomalous infrastructure deployments in new or different never-used regions.

GuardDuty will continually alert users regarding their AWS environment status and will send the security discoveries to the GuardDuty dashboard or Amazon CloudWatch events for users to view.

Users can access GuardDuty via:

AWS SDKs: Amazon provides users with several software development kits (SDKs) that are made up of libraries and sample code of numerous popular programming languages and platforms, such as Android, iOS, Java, .Net, Python, and Ruby. The SDKs make it easier to develop programmatic access to GuardDuty.
GuardDuty HTTPS API: This allows users to issue HTTPS requests directly to the service.
GuardDuty Console: This is a browser-based intuitive dashboard interface where users can access and use GuardDuty.

Amazon Elastic Kubernetes Service (Amazon EKS)

Kubernetes protection is an optional add-on in Amazon GuardDuty. This tool is able to discover malicious behavior and possible destabilization of an organization's Kubernetes clusters inside of Amazon Elastic Kubernetes Service (Amazon EKS).

When Amazon EKS is activated, GuardDuty will actively use various data sources to discover potential risks against Kubernetes API. When Kubernetes protection is enabled, GuardDuty uses optional data sources to detect threats against Kubernetes API.

Kubernetes audit logs are a Kubernetes feature that captures historical API activity from applications, the control plane, users, and endpoints. GuardDuty collates these logs from Amazon EKS to create Kubernetes discoveries for the organization's Amazon EKS assets; there is no need to store or turn on the logs.

As long as Kubernetes protection remains activated, GuardDuty will continuously dissect Kubernetes data sources from the Amazon EKS clusters to ensure no suspicious or anomalous behavior is taking place.

Amazon Simple Cloud Storage (S3) Protection

Amazon S3 allows Amazon GuardDuty to actively audit object-level API processes to discover possible security threats to data inside an organization's S3 buckets. GuardDuty continually audits risk to the organization’s S3 assets by carefully dissecting AWS CloudTrail management events and AWS CloudTrail S3 data events. These tools are continually auditing various CloudTrail management events for potential suspicious activities that affect S3 buckets, such as PutBucketReplication, DeleteBucket, ListBucket, and data events for S3 object-level API processes, such as PutObject, GetObject, ListObject, and DeleteObject.

Reviews from Real Users

“The most valuable features are the single system for data collection and the alert mechanisms. Prior to using GuardDuty, we had multiple systems to collect data and put it in a centralized location so we could look into it. Now we don't need to do that anymore as GuardDuty does it for us.” - Arunkumar A., Information Security Manager at Tata Consultancy Services

Amazon Web Services (AWS)

Threat Stack Cloud Security Platform [EOL] offers robust security features including endpoint monitoring, rule customization, and integration capabilities, with easy connectivity to cloud services like Docker and AWS.

Threat Stack Cloud Security Platform [EOL] provides tools for enhancing security visibility across cloud infrastructure. It supports AWS and Docker integration, facilitating efficient threat detection and management. Users appreciate its capability to configure customizable alerts and monitor endpoints, sessions, API interactions, and cloud services. However, there are areas needing improvement, such as better serverless environment support and reduced alert frequency. The platform services smaller organizations by compensating for limited security resources with its comprehensive monitoring and auditing tools.

What are the key features?

Easy Cloud Service Integration: Streamlined connectivity with Docker and AWS for efficient monitoring.
Customizable Rule Sets: Tailor security rules to meet specific organizational needs.
Email Alerts: Receive timely notifications about security events and threats.
Interactive Session Monitoring: Track live sessions for suspicious activities.
API Integration: Connect effortlessly with third-party tools for an enhanced security posture.
SecOps Support: Assistance for organizations lacking dedicated security teams.

What are the benefits and ROI features?

Streamlined Threat Detection: Effective process monitoring to identify potential threats.
Cost Efficiency: Serves companies with limited resources by providing essential security functions.
Comprehensive Audits: Helps in regular examinations of cloud infrastructure, enhancing compliance.
Visibility into Cloud Operations: Offers a detailed dashboard for threat visibility and monthly vulnerability assessments.

In specific industries, Threat Stack Cloud Security Platform [EOL] is utilized for its strength in monitoring cloud infrastructure and preventing unauthorized access. Organizations in fields where cloud operations are critical use it for regular audits and monitoring. Its capabilities in threat management are leveraged to maintain secure operations and compliance, especially where there is no dedicated security team.

Sample Customers

Information Not Available

autodesk, mapbox, fico, webroot

StatusPage.io, Walkbase, Spanning, DNAnexus, Jobcase, Nextcapital, Smartling, Veracode, 6sense

Buyer's Guide

Cloud Workload Protection Platforms (CWPP)

June 2025

Download Free Report

Find out what your peers are saying about Wiz, Microsoft, Amazon Web Services (AWS) and others in Cloud Workload Protection Platforms (CWPP). Updated: June 2025.

DOWNLOAD NOW

860,592 professionals have used our research since 2012.

See our list of best Cloud Workload Protection Platforms (CWPP) vendors.

We monitor all Cloud Workload Protection Platforms (CWPP) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.