AWS GuardDuty vs Aqua Cloud Security Platform comparison

Aqua Security and Amazon Web Services (AWS) are both solutions in the Cloud Workload Protection Platforms (CWPP) category. Aqua Security is ranked #21, while Amazon Web Services (AWS) is ranked #2 with an average rating of 9.0. Aqua Security holds a 2.1% mindshare in CWPP, compared to Amazon Web Services (AWS)’s 14.3% mindshare. Additionally, 93% of Aqua Security users are willing to recommend the solution, compared to 92% of Amazon Web Services (AWS) users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Feb 8, 2026

Aqua Cloud Security Platform and AWS GuardDuty are competitors in cloud security. While both have unique strengths, AWS GuardDuty often has the upper hand due to its seamless integration within the AWS suite.

Features: Aqua Cloud Security Platform provides robust container security, extensive compliance management, and comprehensive visibility across cloud environments. AWS GuardDuty focuses on real-time threat detection, leveraging machine learning to monitor AWS environments and offering integration within the AWS ecosystem.

Room for Improvement: Aqua Cloud Security Platform could enhance its user interface to improve user experience, provide more detailed analytics, and bolster integration with non-cloud-native tools. AWS GuardDuty may benefit from expanding threat intelligence sources, improving alert fine-tuning to reduce false positives, and offering better multi-cloud support options for non-AWS services.

Ease of Deployment and Customer Service: Aqua Cloud Security Platform supports flexible deployment options and cross-platform compatibility, making it suitable for diverse computing environments. AWS GuardDuty, fully integrated with AWS, ensures straightforward deployment and extensive support resources, easing the setup process for AWS-centric users.

Pricing and ROI: Aqua Cloud Security Platform's complex pricing reflects its diverse features, demonstrating value through improved security for multi-cloud strategies. In contrast, AWS GuardDuty's pricing is competitive for AWS users, offering efficient threat detection and cost benefits within the AWS ecosystem.

To learn more, read our detailed AWS GuardDuty vs. Aqua Cloud Security Platform Report (Updated: March 2026).

Buyer's Guide

AWS GuardDuty vs. Aqua Cloud Security Platform

March 2026

Download the complete report

Helped 885,264 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

SentinelOne Singularity Clo...

Mindshare comparison

As of March 2026, in the Cloud Workload Protection Platforms (CWPP) category, the mindshare of SentinelOne Singularity Cloud Security is 4.4%, up from 2.4% compared to the previous year. The mindshare of Aqua Cloud Security Platform is 2.1%, down from 3.3% compared to the previous year. The mindshare of AWS GuardDuty is 14.3%, up from 12.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Cloud Workload Protection Platforms (CWPP) Mindshare Distribution
Product	Mindshare (%)
AWS GuardDuty	14.3%
SentinelOne Singularity Cloud Security	4.4%
Aqua Cloud Security Platform	2.1%
Other	79.19999999999999%

Cloud Workload Protection Platforms (CWPP)

Featured Reviews

Satyavijay Chavan

Information Security Engineer at DataVigilant Infotech

Enables us to prioritize and effectively address critical security issues

Evidence-based reporting helps us to prioritize and solve critical security issues. The new visualization feature demonstrates how an attacker can enter the system, highlighting the potential path that can be exploited and outlining all the steps the attacker could take. With that visibility, we can ensure the perimeter is strong and attackers cannot enter, thus reducing the risk. It has helped us prioritize issues. The visibility into how an attack could happen is valuable. For example, it highlights the system vulnerability and outlines where an attack could propagate. The visualization helps me to prioritize remediation, and if I don't know where to start, I can check to see the score that enables me to prioritize issues. I am using infrastructure-as-code scanning, and it's one of the useful features. In pre-production, it identifies embedded secrets and misconfigurations, including issues with Kubernetes or some privileged containers. This feature allows us to pass the audit and secure IaC code so that it isn't easily exploitable by attackers. We can more proactively work to identify and resolve vulnerabilities by using the dashboard and the alerting system that SentinelOne provides. It helps us with audits and compliance. We can show the compliance in percentage. We can confidently say that our company or infrastructure is very secure. It has improved our security posture by 30% to 35%. It has reduced our false positives by 30%. It has helped teams collaborate better. The security team manages SentinelOne Singularity Cloud Security, and when it flags vulnerabilities, they are forwarded to DevOps for remediation. Previously, we needed to identify and report the issues, but there would be lapses in communication. Now, there is a centralized dashboard that anyone can look at and see the open issues and work on them.

Read full review

Burak AKCAGUN

Business Development Manager at Axoft Ukraine

A robust and cost-effective solution, excelling in scalability, on-premises support, and responsive technical support, making it well-suited for enterprises navigating stringent regulatory environment

The most crucial aspect is runtime protection, specifically image scanning before preproduction and deployment. Customers find it invaluable to have the ability to check for vulnerabilities in an image before deployment, similar to a sandbox environment. This feature ensures that customers can identify any potential issues with the image, such as misconfigurations or vulnerabilities, before integrating it into their workloads and infrastructure. In their source pipeline, companies can identify issues before deploying changes. This is crucial because customers prefer resolving any problems or misconfigurations before the deployment process. Software change security, including GSPM Cloud, is a key feature customers seek in their infrastructure.

Read full review

ShantanuKhare

Senior IT Auditor at Ernst & Young

Has provided automated threat detection and daily malicious activity insights while supporting seamless orchestration with existing dashboards

I would assess the integration of AWS GuardDuty with Threat Intelligence as majorly positive; no threat intelligence is 100% accurate, and there are a few false positives, but as a security engineer, this must be accepted, and overall, the response and service is good for us. We do not directly use AWS GuardDuty dashboard by itself, as we have our own integrated security dashboard; AWS GuardDuty gives the feed to that dashboard, and it's giving us a satisfactory view of how the security landscape looks. We use metrics such as zero-day threats, any malicious traffic, and any traffic which originates from OFAC countries to measure its effectiveness, as we are majorly into a financial institution, as any traffic that is from a malicious IP or a rogue device. I don't see any significant negative points regarding AWS GuardDuty; it's a good product to have if you're a cloud consumer. I rate AWS GuardDuty nine out of ten overall.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The compliance monitoring feature of SentinelOne Singularity Cloud Security gives us a report with a compliance score to ensure we meet certain regulatory standards."

"The most valuable feature is the ability to gain deep visibility into the workloads inside containers."

"I recommend SentinelOne due to its high-security capabilities, which are essential to safeguard data and systems from potential threats."

"Cloud Native Security has helped us with our risk posture and securing our agenda. It has been tremendous in terms of supporting growth."

"SentinelOne Singularity Cloud Security provides email alerts and ranks issues based on severity, such as high, critical, etc., that help us prioritize issues."

"I would definitely recommend SentinelOne Singularity Cloud Security for infrastructure security."

"For Singularity, the task capability is easy to use and it has a very intuitive dashboard, which streamlines the processes."

"Cloud Native Security's most valuable features include cloud misconfiguration detection and remediation, compliance monitoring, a robust authentication security engine, and cloud threat detection and response capabilities."

More SentinelOne Singularity Cloud Security pros

"Valuable features include the ability to connect it to our Docker Hub where our images are stored, good integration with Slack, and the connection to the CV, to easily see which CVs are on each image."

"It is a very good product from an environmental perspective."

"The container security element of this product has been very valuable to our organization."

"The most valuable feature is the security."

"The most helpful feature of Aqua Security is Drift Prevention, which is a feature that allows images to be immutable, and one of the main reasons we went with Aqua Security is because it provides strong protection when it comes to runtime security."

"The image security and image scanning were quite easy compared to Prisma, the solution was very user-friendly, easy to set up, stable, and the documentation was robust."

"Aqua Security allowed us to gain visibility into the vulnerabilities that were present in the container images, that were being rolled out, the amount of risk that we were introducing to the platform, and provided us a look into the container environment by introducing access control mechanisms. In addition, when it came to runtime-level policies, we could restrict container access to resources in our environment, such as network-level or other application-level access."

"From what I understand, the initial setup is simple."

More Aqua Cloud Security Platform pros

"The solution is easy to use."

"We generally use AWS GuardDuty for detection of zero-day vulnerabilities and automatic threat responses; it serves as a SOAR, an orchestrated and automated response solution for us in the AWS platform."

"GuardDuty is extensive in terms of configuration and security compliance."

"Overall, GuardDuty is a very easy-to-use tool, and I would recommend it even to those who are not tech-savvy."

"GuardDuty is really scalable, which is helping us to upscale our environment to the cloud, and I really appreciate the scalability measures that Amazon is providing to all its customers."

"We use the tool for threat detection. AWS includes AI features as well. AWS GuardDuty gives us reports."

"It kinda just gives us another layer of security. So it does provide some sort of comfort that we do have something that is monitoring for abnormal behavior."

"GuardDuty is extensive in terms of configuration and security compliance."

More AWS GuardDuty pros

Cons

"The areas with room for improvement include the cost, which is higher compared to other security platforms. The dashboard can also be laggy."

"A vulnerability alert would appear, and we'd fix it, but then the same alert would return the next day."

"A two-month grace period for extended searches would be a valuable improvement."

"SentinelOne Singularity Cloud Security is an excellent CSPM tool, but its CWPP features need improvement, and there is scope for more application security posture management features."

"I export CSV. I cannot export graphs. Restricting it to the CSV format has its own disadvantages. These are all machine IP addresses and information. I cannot change it to the JSON format. The export functionality can be improved."

"I'd like to see better onboarding documentation."

"The cloud-based operations might pose challenges in areas with limited or unavailable internet connectivity."

"We don't get any notifications from SentinelOne Singularity Cloud Security when the clusters are down."

More SentinelOne Singularity Cloud Security cons

"Aqua Security lacks a lot in reporting."

"Aqua is a bit expensive so you have to really justify going for it or not."

"The solution could improve user-friendliness."

"Aqua Security could provide more open documentation so that their learning resources can be more easily accessed and searched through online."

"We would like to see an improvement in the overview visibility that this solution offers."

"Aqua Security could provide more open documentation so that their learning resources can be more easily accessed and searched through online. Right now, a lot of the documentation is closed and not available to the public."

"It's a bit hard to use the user roles. That was a bit confusing."

"There's room for improvement, particularly in management capabilities as it may not be comprehensive enough for all customers, and it has been lacking in the realm of cloud security posture management."

More Aqua Cloud Security Platform cons

"An improvement would be to have a mobile version where remote workers can log in and monitor and fix issues."

"AWS GuardDuty sometimes shows false positives and should have better detection accuracy."

"While sending the alerts to the email, they are not being patched. we have to do the patching and mapping manually. If GuardDuty could include a feature to do this automatically, it will make our job easier. That is something I believe can be improved."

"In future updates of AWS GuardDuty, I would suggest implementing better UI features."

"AWS GuardDuty needs to be more customer-oriented."

"I think that some detections in container environments such as container runtime, and on services such as AWS container service, Fargate service or EKS service could be improved."

"I would rate Amazon GuardDuty seven out of ten because some of the integrations may not work well with it, and depending on the integration that you're working with, the security tools have a lot of requirements to implement."

"Comparing AWS GuardDuty to similar products from Microsoft, Microsoft has a product called Sentinel, which is a completely integrated solution that basically does everything from vulnerability management to managing log analytics. This is something which AWS GuardDuty doesn't have since it's a separate service."

More AWS GuardDuty cons

Pricing and Cost Advice

"PingSafe is not very expensive compared to Prisma Cloud, but it's also not that cheap. However, because of its features, it makes sense to us as a company. It's fairly priced."

"As a partner, we receive a discount on the licenses."

"We found it to be fine for us. Its price was competitive. It was something we were happy with. We are not a Fortune 500 company, so I do not know how pricing scales at the top end, but for our cloud environment, it works very well."

"The pricing is fair. It is not inexpensive, and it is also not expensive. When managing a large organization, it is going to be costly, but it meets the business needs. In terms of what is out there on the market, it is fair and comparable to what I have seen, so I do not have any complaints about the cost"

"The licensing is easy to understand and implement, with some flexibility to accommodate dynamic environments."

"I wasn't sure what to expect from the pricing, but I was pleasantly surprised to find that it was a little less than I thought."

"The cost for PingSafe is average when compared to other CSPM tools."

"SentinelOne provided competitive pricing compared to other vendors, and we are satisfied with the deal."

More SentinelOne Singularity Cloud Security pricing and cost advice

"It comes at a reasonable cost."

"They were reasonable with their pricing. They were pretty down-to-earth about the way they pitched their product and the way they tried to close the deal. They were one of the rare companies that approached the whole valuation in a way that made sense for our company, for our needs, and for their own requirements as well... They will accommodate your needs if they are able to understand them and they're stated clearly."

"Dealing with licensing costs isn't my responsibility, but I know that the licenses don't depend on the number of users, but instead are priced according to your workload."

"The pricing of this solution could be improved."

"Aqua Security is not cheap, and it's not very expensive, such as Splunk, they are in the middle."

"I prefer to have something on demand for myself. That's why I haven't been paying for GuardDuty specifically. AWS provides a wide range of offerings, especially in the security area."

"We use a pay-as-you-use license, which is competitively priced in the market."

"The tool's licensing model is pay-as-you-go."

"GuardDuty only enables accounts in regions where you have an active workload. If there are places where you don't have an active workload, you wouldn't even enable them. That's one area where they could allow you to cut down your cost."

"On a scale of one to ten, where one is a high price, and ten is a low price, I rate the pricing a four or five, which is somewhere in the middle."

"Pricing is determined by the number of events sent."

"The pricing model is pay as you go and is based on the number of events per month."

"In terms of the costs associated with Amazon GuardDuty, it was $1 per GB from what I recall. Pricing was based on per gigabyte. For example, for the first five hundred gigabytes per month, it'll be $1 per GB, so it'll be $500. If your usage was greater, there's another bracket, for example, the next two thousand GB, then there's an add-on cost of 50 cents per GB. That's how Amazon GuardDuty pricing slowly goes up. I can't remember if there was any kind of additional cost apart from standard licensing for the solution. Nothing else that at least comes to mind. What the service was charging was worth it. That was one good thing when using Amazon GuardDuty because my company could be in a certain tier for a certain period. My company wasn't under a licensing model where it could overestimate its usage and under-utilize its usage and pay much more. This was what made the pricing model for Amazon GuardDuty better."

More AWS GuardDuty pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Cloud Workload Protection Platforms (CWPP) solutions are best for your needs.

See recommendations

885,264 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

14%

Computer Software Company

12%

Manufacturing Company

10%

Government

Financial Services Firm

21%

Manufacturing Company

10%

Computer Software Company

Government

Financial Services Firm

13%

Computer Software Company

11%

Manufacturing Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	49
Midsize Enterprise	22
Large Enterprise	55

By reviewers
Company Size	Count
Small Business	6
Midsize Enterprise	1
Large Enterprise	10

By reviewers
Company Size	Count
Small Business	8
Midsize Enterprise	3
Large Enterprise	15

Questions from the Community

What do you like most about PingSafe?

The dashboard gives me an overview of all the things happening in the product, making it one of the tool's best featu...

See all answers

What is your experience regarding pricing and costs for PingSafe?

Regarding the pricing for SentinelOne Singularity Cloud Security, I do not think it is something I can compare.

See all answers

What needs improvement with PingSafe?

I do not see room for improvement in SentinelOne Singularity Cloud Security. In the future, I would like to see the i...

See all answers

What do you think of Aqua Security vs Prisma Cloud?

Aqua Security is easy to use and very manageable. Its main focus is on Kubernetes and Docker. Security is a very valu...

See all answers

What do you like most about Amazon GuardDuty?

With anomaly detection, active threat monitoring, and set correlation, GuardDuty alerts me to any unusual user behavi...

See all answers

What is your experience regarding pricing and costs for Amazon GuardDuty?

AWS GuardDuty is an expensive feature, and while you can't expect the price to be low, it can be lower because it's p...

See all answers

What needs improvement with Amazon GuardDuty?

AWS GuardDuty is a good product; it's doing its job right now, and I don't see any additional improvements needed. Co...

See all answers

Comparisons

Wiz vs SentinelOne Singularity Cloud Security

Compared 10% of the time

Prisma Cloud by Palo Alto Networks vs SentinelOne Singularity Cloud Security

Compared 9% of the time

Microsoft Defender for Cloud vs SentinelOne Singularity Cloud Security

Compared 6% of the time

CrowdStrike Falcon Cloud Security vs SentinelOne Singularity Cloud Security

Compared 5% of the time

Orca Security vs SentinelOne Singularity Cloud Security

Compared 2% of the time

More SentinelOne Singularity Cloud Security Competitors

Sysdig Secure vs Aqua Cloud Security Platform

Compared 10% of the time

Prisma Cloud by Palo Alto Networks vs Aqua Cloud Security Platform

Compared 10% of the time

Wiz vs Aqua Cloud Security Platform

Compared 7% of the time

TrendAI Deep Security vs Aqua Cloud Security Platform

Compared 4% of the time

Tencent Cloud Workload Protection vs Aqua Cloud Security Platform

Compared 3% of the time

More Aqua Cloud Security Platform Competitors

Microsoft Defender for Cloud vs AWS GuardDuty

Compared 68% of the time

CrowdStrike Falcon Cloud Security vs AWS GuardDuty

Compared 5% of the time

Prisma Cloud by Palo Alto Networks vs AWS GuardDuty

Compared 5% of the time

Wiz vs AWS GuardDuty

Compared 4% of the time

More AWS GuardDuty Competitors

Product Reports

Buyer's Guide

SentinelOne Singularity Cloud Security

February 2026

SentinelOne Singularity Cloud Security report

Download SentinelOne Singularity Cloud Security product report

Buyer's Guide

Aqua Cloud Security Platform

March 2026

Download Aqua Cloud Security Platform product report

Buyer's Guide

AWS GuardDuty

March 2026

Download AWS GuardDuty product report

Also Known As

PingSafe

Aqua Security Platform, CloudSploit, Argon

No data available

Overview

SentinelOne Singularity Cloud Security offers a streamlined approach to cloud security with intuitive operation and strong integration capabilities for heightened threat detection and remediation efficiency.

Singularity Cloud Security stands out for its real-time detection and response, effectively minimizing detection and remediation timelines. Its automated remediation integrates smoothly with third-party tools enhancing operational efficiency. The comprehensive console ensures visibility and support for forensic investigations. Seamless platform integration and robust support for innovation are notable advantages. Areas for development include improved search functionality, affordability, better firewall capabilities for remote users, stable agents, comprehensive reporting, and efficient third-party integrations. Clarity in the interface, responsive support, and real-time alerting need enhancement, with a call for more automation and customization. Better scalability and cost-effective integration without compromising capabilities are desired.

What are SentinelOne Singularity Cloud Security's standout features?

Ease of Use: Intuitive operation simplifies navigation across platforms.
Real-Time Detection: Quick identification and response to threats.
Automated Remediation: Streamlines recovery processes with integration capabilities.
Forensic Visibility: Aids in thorough threat analysis and prevention strategies.
Comprehensive Console: Offers full visibility and historical data tracking.
Platform Integration: Supports seamless operation across cloud and hybrid environments.

What benefits should users expect from SentinelOne Singularity Cloud Security?

Enhanced Efficiency: Automation and third-party integration improve threat response.
Improved Detection: Reduces mean time to detect and respond to threats.
Operational Support: Comprehensive visibility and forensic tools aid operational decisions.
Cost Efficiency: Affordable integration with scaling capabilities without high overhead.

SentinelOne Singularity Cloud Security is deployed in industries needing robust cloud security posture management, endpoint protection, and threat hunting. Utilized frequently across AWS and Azure, it assists in monitoring, threat detection, and maintaining compliance in diverse environments while providing real-time alerts and recommendations for proactive threat management.

SentinelOne

Aqua Security stops cloud native attacks, preventing them before they happen and stopping them when they happen. Dedicated cloud native threat research and the most loved cloud native security open source community in the world put innovation at your fingertips so you can transform your business. Born cloud native, The Aqua Platform is the most integrated Cloud Native Application Protection Platform (CNAPP), securing from day one and protecting in real-time. Aqua has been stopping real cloud native attacks on hundreds of thousands of production nodes across the world since 2015.

Aqua Security Features

Aqua Security has many valuable key features. Some of the most useful ones include:

Vulnerability scanning
Dynamic threat analysis
Automates DevSecOps
CI/CD integrations
Cloud security posture management
Kubernetes security
Hybrid and multi-cloud
Container security
Serverless security
VM security
Cloud workloads protection

Aqua Security Benefits

There are many benefits to implementing Aqua Security. Some of the biggest advantages the solution offers include:

Designed for scale and performance: The Aqua Security platform was designed to scale to the largest environments in order to protect huge clusters and massive DevOps pipelines.

Empowers DevOps to detect issues early and fix them fast: The solution was designed to help you solve issues immediately - before they cause greater damage to your organization. It helps you gain insight into your vulnerability posture and prioritize remediation and mitigation according to contextual risk.

Automated compliance and security posture: Aqua Security checks your cloud services, Infrastructure-as-code templates, and Kubernetes setup against best practices and standards. This way, you can ensure the infrastructure you run your applications on is securely configured and in compliance.

Artifact scanning: The Aqua Security platform scans artifacts for vulnerabilities, malware, and other risks during development and staging. It allows you to set flexible and dynamic policies to control deployment into your runtime environments.

Minimizes false positives: Aqua Security relies on a variety of sources and proprietary research to curate and present vulnerabilities in the most accurate way, which helps to minimize false positives and unnecessary noise in the pipeline.

Automated security testing: The Aqua Security platform automates security testing in your CI/CD pipeline, and continuously scans registries and serverless function stores to detect emerging risks. By implementing the platform, you can get actionable feedback within your CI environments to empower your organization’s developers to fix issues rapidly.

Granular controls: The solution provides protection for your VM, container, and serverless workloads using granular controls with instant visibility and real-time detection and response.

Sandboxed environment: With Aqua Security, you can run images in a secure sandboxed environment that traces indicators of compromise (IOCs) such as container escapes, reverse shell backdoors, malware drops, code injection backdoors, and network anomalies.

Reviews from Real Users

Lizeth Z., Cloud Security Specialist at Telstra, says, “Aqua Security is the most advanced solution in the market for container security. Aqua Security allows us to check for vulnerabilities in the CI/CD pipeline, so application teams can remediate issues before going into production. Aqua Security helps us to check the vulnerability of image assurance and check for malware.”

Aqua Security

Amazon Guard Duty is a continuous cloud security monitoring service that consistently monitors and administers several data sources. These include AWS CloudTrail data events for EKS (Elastic Kubernetes Service) audit logs, VPC (Virtual Private Cloud) flow logs, DNS (Domain Name System) logs, S3 (Simple Cloud Storage), and AWS CloudTrail event logs.

Amazon GuardDuty intuitively uses threat intelligence data - such as lists of malicious domains and IP addresses - and ML (machine learning) to quickly discover suspicious and problematic activity in a user's AWS ecosystem. Activities may include concerns such as interactions with malicious IP addresses or domains, exposed credentials usage, or changes and/or escalation of privileges.

GuardDuty is able to easily determine problematic AWS EC2 (Elastic Compute Cloud) instances delivering malware or mining bitcoin. It is also able to trace AWS account access history for evidence of destabilization. such as suspicious API calls resulting in changing password policies to minimize password strength or anomalous infrastructure deployments in new or different never-used regions.

GuardDuty will continually alert users regarding their AWS environment status and will send the security discoveries to the GuardDuty dashboard or Amazon CloudWatch events for users to view.

Users can access GuardDuty via:

AWS SDKs: Amazon provides users with several software development kits (SDKs) that are made up of libraries and sample code of numerous popular programming languages and platforms, such as Android, iOS, Java, .Net, Python, and Ruby. The SDKs make it easier to develop programmatic access to GuardDuty.
GuardDuty HTTPS API: This allows users to issue HTTPS requests directly to the service.
GuardDuty Console: This is a browser-based intuitive dashboard interface where users can access and use GuardDuty.

Amazon Elastic Kubernetes Service (Amazon EKS)

Kubernetes protection is an optional add-on in Amazon GuardDuty. This tool is able to discover malicious behavior and possible destabilization of an organization's Kubernetes clusters inside of Amazon Elastic Kubernetes Service (Amazon EKS).

When Amazon EKS is activated, GuardDuty will actively use various data sources to discover potential risks against Kubernetes API. When Kubernetes protection is enabled, GuardDuty uses optional data sources to detect threats against Kubernetes API.

Kubernetes audit logs are a Kubernetes feature that captures historical API activity from applications, the control plane, users, and endpoints. GuardDuty collates these logs from Amazon EKS to create Kubernetes discoveries for the organization's Amazon EKS assets; there is no need to store or turn on the logs.

As long as Kubernetes protection remains activated, GuardDuty will continuously dissect Kubernetes data sources from the Amazon EKS clusters to ensure no suspicious or anomalous behavior is taking place.

Amazon Simple Cloud Storage (S3) Protection

Amazon S3 allows Amazon GuardDuty to actively audit object-level API processes to discover possible security threats to data inside an organization's S3 buckets. GuardDuty continually audits risk to the organization’s S3 assets by carefully dissecting AWS CloudTrail management events and AWS CloudTrail S3 data events. These tools are continually auditing various CloudTrail management events for potential suspicious activities that affect S3 buckets, such as PutBucketReplication, DeleteBucket, ListBucket, and data events for S3 object-level API processes, such as PutObject, GetObject, ListObject, and DeleteObject.

Reviews from Real Users

“The most valuable features are the single system for data collection and the alert mechanisms. Prior to using GuardDuty, we had multiple systems to collect data and put it in a centralized location so we could look into it. Now we don't need to do that anymore as GuardDuty does it for us.” - Arunkumar A., Information Security Manager at Tata Consultancy Services

Amazon Web Services (AWS)

Sample Customers

Information Not Available

HPE Salesforce Telstra Ellie Mae Cathay Pacific HomeAway

autodesk, mapbox, fico, webroot

Buyer's Guide

AWS GuardDuty vs. Aqua Cloud Security Platform

March 2026

Free Report: AWS GuardDuty vs. Aqua Cloud Security Platform

Find out what your peers are saying about AWS GuardDuty vs. Aqua Cloud Security Platform and other solutions. Updated: March 2026.

DOWNLOAD NOW

885,264 professionals have used our research since 2012.

See our AWS GuardDuty vs. Aqua Cloud Security Platform report.

See our list of best Cloud Workload Protection Platforms (CWPP) vendors.

We monitor all Cloud Workload Protection Platforms (CWPP) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.