AWS GuardDuty Reviews

Name: AWS GuardDuty
Brand: Amazon Web Services (AWS)
Rating: 4.1 (23 reviews)

4.1 out of 5

23 reviews
91% willing to recommend

What is AWS GuardDuty?

Amazon Guard Duty is a continuous cloud security monitoring service that consistently monitors and administers several data sources. These include AWS CloudTrail data events for EKS (Elastic Kubernetes Service) audit logs, VPC (Virtual Private Cloud) flow logs, DNS (Domain Name System) logs, S3 (Simple Cloud Storage), and AWS CloudTrail event logs.

Amazon GuardDuty intuitively uses threat intelligence data - such as lists of malicious domains and IP addresses - and ML (machine learning) to quickly discover suspicious and problematic activity in a user's AWS ecosystem. Activities may include concerns such as interactions with malicious IP addresses or domains, exposed credentials usage, or changes and/or escalation of privileges.

GuardDuty is able to easily determine problematic AWS EC2 (Elastic Compute Cloud) instances delivering malware or mining bitcoin. It is also able to trace AWS account access history for evidence of destabilization. such as suspicious API calls resulting in changing password policies to minimize password strength or anomalous infrastructure deployments in new or different never-used regions.

Get the AWS GuardDuty Buyer's Guide and find out what your peers are saying about AWS GuardDuty, Wiz, Microsoft Defender for Cloud and more!

AWS GuardDuty is the #3 ranked solution in Cloud Workload Protection Platforms. PeerSpot users give AWS GuardDuty an average rating of 8.2 out of 10. AWS GuardDuty is most commonly compared to Wiz: AWS GuardDuty vs Wiz. AWS GuardDuty is popular among the large enterprise segment, accounting for 65% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 16% of all views.

Helped 864,155 peers since 2012

Featured AWS GuardDuty reviews

Terence Dube

AWS Cloud Engineer at Standard Telephones and Cables

GuardDuty is limited to AWS environments. While incorporating Amazon Detective for detailed investigation can be useful, including more granular details in findings, such as specific user actions or historical comparisons, would be beneficial. Furthermore, managing global AWS environments requires setting up additional tools for viewing GuardDuty findings across multiple regions. A unified dashboard that aggregates findings across all regions without requiring manual aggregation could enhance convenience for users.

Read full review

Syeda Masarath Zaidi

DevOps Engineer at Cognizant

GuardDuty is extensive in terms of configuration and security compliance. It integrates with threat detection, offering end-to-end visibility. The best thing is that it notifies you immediately when something goes wrong, allowing quick response to threats. Our infrastructure is continuously monitored, safeguarding it against threats. Even internal threats are easy to identify. AWS monitors user behavior, which helps detect compromised credentials.

Read full review

Pratik-Savla

Security and Compliance Architect at a manufacturing company with 1,001-5,000 employees

Because it's a threat detection service, they need to keep up with the various threat factors because new threat factors and attack factors come up all the time. Sometimes they may detect a certain behavior. But if that behavior morphs into something else, GuardDuty may not pick up on that specifically if something new comes up which hasn't been found or uncovered before. If Amazon doesn't update the service to reflect that or address that or factor that in, it may not detect the threat. The end user then is obviously at the mercy of whatever it flags. GuardDuty must ensure they cover everything, including the latest threats.

Read full review

AWS GuardDuty mindshare

As of August 2025, the mindshare of AWS GuardDuty in the Cloud Workload Protection Platforms (CWPP) category stands at 11.8%, down from 12.8% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Cloud Workload Protection Platforms (CWPP)

PeerResearch reports based on AWS GuardDuty reviews

Type	Title	Date
Category	Cloud Workload Protection Platforms (CWPP)	Aug 1, 2025	Download
Product	Reviews, tips, and advice from real users	Aug 1, 2025	Download
Comparison	AWS GuardDuty vs Microsoft Defender for Cloud	Aug 1, 2025	Download
Comparison	AWS GuardDuty vs Wiz	Aug 1, 2025	Download
Comparison	AWS GuardDuty vs SentinelOne Singularity Cloud Security	Aug 1, 2025	Download

Title	Rating	Mindshare	Recommending
Wiz	4.5	18.3%	95%	22 interviews Add to research
Microsoft Defender for Cloud	4.0	13.6%	94%	78 interviews Add to research

Valuable Features

AWS GuardDuty offers valuable features such as comprehensive threat detection, monitoring AWS accounts efficiently without additional costs, and collecting data from CloudTrail, VPC Flow Logs, and DNS logs for anomaly analysis. It provides real-time notifications for suspicious activities, integrates with various AWS services, and offers behavior analysis and intrusion detection. Its machine learning capabilities enable swift identification of threats, making it essential for enhancing AWS security.

"AWS GuardDuty is a great solution; I appreciate it because it's native for the Cloud provider, and I don't need to acquire other tools from another vendor."
"Overall, GuardDuty is a very easy-to-use tool, and I would recommend it even to those who are not tech-savvy."
"GuardDuty's comprehensive threat detection does not only monitor data - it also detects a wide range of security threats."

Room for Improvement

AWS GuardDuty needs improved security analytics, integration with more AWS services, better presentation of findings, and enhanced cost-efficiency. Users desire automatic remediation, more threat intelligence integration, and a unified dashboard. The interface could be more user-friendly, and technical support response times need improvement. There are calls for better threat detection accuracy and the ability to assign findings to specific groups. Cost management and the ability to monitor through mobile devices are also points of interest.

"I think that some detections in container environments such as container runtime, and on services such as AWS container service, Fargate service or EKS service could be improved."
"GuardDuty is limited to AWS environments."
"GuardDuty is limited to AWS environments."

ROI

Users see ROI from AWS GuardDuty through enhanced threat detection and improved security posture, which builds customer trust. Early threat notifications lead to fewer incidents, saving time and easing investigations. Satisfaction with GuardDuty is evident, and continuous use suggests a return on investment. Some users note quick notifications, improved response times, and significant time savings, estimating a 40% time reduction. AWS GuardDuty supports threat detection, testing, and attack prevention, enhancing overall security frameworks.

Pricing

AWS GuardDuty pricing is based on a pay-as-you-go model, typically seen as competitively priced. Users appreciate its transparency, with costs like $1 per GB being a common mention. Expenses vary with usage, such as events sent or accounts integrated. While some feel it can be expensive at larger scales, others find it appropriate for smaller setups. Its flexibility allows cost savings by enabling services only in regions with active workloads.

"The tool's licensing model is pay-as-you-go."
"80 percent of the customers are using AWS GuardDuty, and we recommend it due to its low cost, especially for small customers, ranging from five to ten dollars a month. In our policies, we enforce the usage of this service, making it a recommended practice for security."
"It can get very expensive. If you turn on every feature, it can turn into hundreds of thousands of dollars."

Popular Use Cases

AWS GuardDuty is primarily utilized for threat detection, monitoring AWS accounts for malicious activity, protecting cloud infrastructure, and compliance support. Its functions include detecting security anomalies, unauthorized access, potential data exfiltration, and credential attacks through log analysis from sources like CloudTrail and VPC Flow Logs. Organizations use it extensively to enhance protection across Amazon EC2, serverless operations, and container workloads, providing insights into potential security threats and ensuring regulatory compliance.

Service and Support

AWS GuardDuty support is prompt and responsive, providing effective assistance via chat, phone, and web support. Users report quick issue resolution, often within 15 to 30 minutes, though phone support may require a longer wait. The support team is mostly helpful, addressing queries and providing screen-sharing services to resolve concerns. Documentation and resources are comprehensive, aiding easy setup. Users with enterprise plans receive prioritized support, while responses meet SLAs, ensuring customer satisfaction.

Deployment

Users describe AWS GuardDuty's initial setup as simple and intuitive. They indicate that deployment can be quick, often completed in a few minutes. Integration complexity may arise based on specific organizational architectures or when incorporating third-party solutions like Qualys. With seamless AWS account synchronization, multiple accounts can be managed efficiently. Users note the ease of deployment without the need for extensive training, facilitated by GuardDuty's integration with existing AWS environments and services.

Scalability

AWS GuardDuty is praised for its ability to handle various scaling demands, seamlessly adding users and managing multiple accounts. Users appreciate its adaptability to growing cloud environments and ability to analyze increased data volumes. The service is highly rated for scalability, consistently performing well without needing infrastructure adjustments, making it suitable for diverse organizational needs. Many note its user-friendly integration with existing AWS services while supporting both large enterprises and smaller businesses efficiently.

Stability

AWS GuardDuty exhibits high stability, with no significant downtime or outages reported. Many users experience reliable performance, quick analytics, and minimal false positives. Administrative capabilities in multi-account setups are praised. Even with minor pain points and occasional performance degradation, users rate stability between eight to ten out of ten. AWS's strong machine learning models enhance the tool’s dependability, making it a favored choice in production environments across different organizations.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our AWS GuardDuty Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

16%

Computer Software Company

14%

Manufacturing Company

Government

Retailer

Insurance Company

Comms Service Provider

Healthcare Company

Energy/Utilities Company

University

Media Company

Educational Organization

Construction Company

Legal Firm

Real Estate/Law Firm

Outsourcing Company

Transportation Company

Non Profit

Recreational Facilities/Services Company

Hospitality Company

Consumer Goods Company

Performing Arts

Wholesaler/Distributor

Pharma/Biotech Company

Recruiting/Hr Firm

Aerospace/Defense Firm

Sports Company

Compare AWS GuardDuty with alternative products

Learn more about AWS GuardDuty

GuardDuty will continually alert users regarding their AWS environment status and will send the security discoveries to the GuardDuty dashboard or Amazon CloudWatch events for users to view.

Users can access GuardDuty via:

AWS SDKs: Amazon provides users with several software development kits (SDKs) that are made up of libraries and sample code of numerous popular programming languages and platforms, such as Android, iOS, Java, .Net, Python, and Ruby. The SDKs make it easier to develop programmatic access to GuardDuty.
GuardDuty HTTPS API: This allows users to issue HTTPS requests directly to the service.
GuardDuty Console: This is a browser-based intuitive dashboard interface where users can access and use GuardDuty.

Amazon Elastic Kubernetes Service (Amazon EKS)

Kubernetes protection is an optional add-on in Amazon GuardDuty. This tool is able to discover malicious behavior and possible destabilization of an organization's Kubernetes clusters inside of Amazon Elastic Kubernetes Service (Amazon EKS).

When Amazon EKS is activated, GuardDuty will actively use various data sources to discover potential risks against Kubernetes API. When Kubernetes protection is enabled, GuardDuty uses optional data sources to detect threats against Kubernetes API.

Kubernetes audit logs are a Kubernetes feature that captures historical API activity from applications, the control plane, users, and endpoints. GuardDuty collates these logs from Amazon EKS to create Kubernetes discoveries for the organization's Amazon EKS assets; there is no need to store or turn on the logs.

As long as Kubernetes protection remains activated, GuardDuty will continuously dissect Kubernetes data sources from the Amazon EKS clusters to ensure no suspicious or anomalous behavior is taking place.

Amazon Simple Cloud Storage (S3) Protection

Amazon S3 allows Amazon GuardDuty to actively audit object-level API processes to discover possible security threats to data inside an organization's S3 buckets. GuardDuty continually audits risk to the organization’s S3 assets by carefully dissecting AWS CloudTrail management events and AWS CloudTrail S3 data events. These tools are continually auditing various CloudTrail management events for potential suspicious activities that affect S3 buckets, such as PutBucketReplication, DeleteBucket, ListBucket, and data events for S3 object-level API processes, such as PutObject, GetObject, ListObject, and DeleteObject.

Reviews from Real Users

“The most valuable features are the single system for data collection and the alert mechanisms. Prior to using GuardDuty, we had multiple systems to collect data and put it in a centralized location so we could look into it. Now we don't need to do that anymore as GuardDuty does it for us.” - Arunkumar A., Information Security Manager at Tata Consultancy Services