AWS GuardDuty vs Microsoft Defender for Cloud comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Jun 6, 2024
 

Categories and Ranking

SentinelOne Singularity Clo...
Sponsored
Ranking in Cloud Workload Protection Platforms (CWPP)
5th
Average Rating
8.6
Number of Reviews
85
Ranking in other categories
Vulnerability Management (5th), Cloud and Data Center Security (5th), Container Security (5th), Cloud Security Posture Management (CSPM) (4th), Cloud-Native Application Protection Platforms (CNAPP) (4th), Compliance Management (5th)
AWS GuardDuty
Ranking in Cloud Workload Protection Platforms (CWPP)
4th
Average Rating
8.2
Number of Reviews
20
Ranking in other categories
No ranking in other categories
Microsoft Defender for Cloud
Ranking in Cloud Workload Protection Platforms (CWPP)
3rd
Average Rating
8.0
Number of Reviews
46
Ranking in other categories
Vulnerability Management (6th), Container Management (10th), Container Security (3rd), Cloud Security Posture Management (CSPM) (3rd), Cloud-Native Application Protection Platforms (CNAPP) (3rd), Data Security Posture Management (DSPM) (3rd), Microsoft Security Suite (3rd), Compliance Management (2nd)
 

Mindshare comparison

As of July 2024, in the Cloud Workload Protection Platforms (CWPP) category, the mindshare of SentinelOne Singularity Cloud Security is 2.1%, up from 1.2% compared to the previous year. The mindshare of AWS GuardDuty is 9.9%, down from 11.7% compared to the previous year. The mindshare of Microsoft Defender for Cloud is 15.2%, down from 16.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Cloud Workload Protection Platforms (CWPP)
Unique Categories:
Vulnerability Management
1.4%
Cloud and Data Center Security
2.2%
No other categories found
Container Management
1.1%
 

Featured Reviews

William Mailhot - PeerSpot reviewer
Sep 27, 2023
Is able to auto-scale and remediate, as well as save us time
My favorite feature is Storyline. It creates a neat graph that shows us how any threat played out, in real time. We can see all the information about what was modified or changed on our system, such as files that were modified, created, or deleted, and register keys that were created or edited. For a SOC analyst, this information is super useful. We can deep dive into all the information and see exactly what happened on each computer individually. The second feature is actually part of the SDR platform, and it provides native integrations with other security software vendors, such as Okta or Azure AD. This allows us to ingest all of our audit logs for security events and to take action on them. For example, we can set up an automation alert so that if a threat is detected on an endpoint, we can automatically take action on our Okta or AD environment, such as locking the account that was signed in or forcing a password reset.
Saurabh Khan - PeerSpot reviewer
Mar 13, 2024
combines ML and integrated threat intelligence from AWS and leading third parties to help protect your AWS accounts, workloads, and data.
The product has automated protection powered by ML, which is now far more powerful than before. It uses ML in its detection algorithm, providing fast and quick results. If someone attempts to attack our tools, especially through brute force attacks, we receive notifications. This applies even if such attempts originate from within our teams, engaging in malicious activities. AWS GuardDuty's integration with other AWS services, such as email addresses and support IDs helps our team members to stay informed about the activities in the account and the necessary actions to take when it triggers an alert. It has been instrumental in identifying issues, particularly instances where EC2 instances had their ports (e.g., 22 and 3389) exposed publicly. This has helped us stay vigilant against potential attacks, and the severity classification allows us to prioritize addressing critical issues. AWS GuardDuty has introduced several new features, including malware protection and continuous monitoring.
NS
Apr 20, 2023
It's easy to use and enables us to automate routine security tasks
We use Defender for network security Defender for Cloud is easy to use and enables us to automate routine security tasks. We save a few hours each week. Defender's single dashboard helps us centrally manage security operations and detect threats faster. Defender is user-friendly and provides…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Support has been very helpful and provides regular feedback and help whenever needed. They've been very useful."
"The solution is a good alerting tool."
"The user interface is well-designed and easy to navigate."
"The most valuable features of PingSafe are cloud misconfiguration, Kubernetes, and IaC scanning."
"PingSafe released a new security graph tool that helps us identify the root issue. Other tools give you a pass/fail type of profile on all misconfigurations, and those will run into the thousands. PingSafe's graphing algorithm connects various components together and tries to identify what is severe and what is not. It can correlate various vulnerabilities and datasets to test them on the back end to pinpoint the real issue."
"The user-friendliness is the most valuable feature."
"We mostly use alerts. That has been pretty good. If we use the alert system from Amazon, it is much costlier to us, so we use PingSafe."
"PingSafe offers three key features: vulnerability management notifications, cloud configuration assistance, and security scanning."
"The solution is easy to use."
"The out-of-band malware detection from the EBS volumes. It's really cool. No agents or anything needed, it automatically finds and correlates based on malware."
"The product has automated protection powered by AI/ML, which is now far more powerful than before. It uses AI/ML in its detection algorithm, providing fast and quick results."
"The solution provides AWS GuardDuty S3 protection, EKS runtime protection, and malware protection."
"The solution will detect abnormalities in the AWS workload and alert us so that we can monitor and take action."
"The most valuable features are the single system for data collection and the alert mechanisms."
"Deployment is great, and we didn't face any big challenges."
"It kinda just gives us another layer of security. So it does provide some sort of comfort that we do have something that is monitoring for abnormal behavior."
"Everything is built into Azure, and if we go for cross-cloud development with Azure Arc, we can use most of the features. While it's possible to deploy and convert third-party applications, it is difficult to maintain, whereas Azure deployments to the cloud are always easier. Also, Microsoft is a big company, so they always provide enough support, and we trust the Microsoft brand."
"When we started out, our secure score was pretty low. We adopted some of the recommendations that Security Center set out and we were able to make good progress on improving it. It had been in the low thirties and is now in the upper eighties."
"Most importantly, it's an integrated solution. We not only have Defender for Cloud, but we also have Defender for Endpoint, Defender for Office 365, and Defender for Identity. It's an integrated, holistic solution."
"Microsoft Defender has a lot of features including regulatory compliance and attaching workbooks but the most valuable is the recommendations it provides for each and every resource when we open Microsoft Defender."
"It isn't a highly complex solution. It's something that a lot of analysts can use. Defender gives you a broad overview of what's happening in your environment, and it's a great solution if you're a Microsoft shop."
"It has seamless integration with any of the services I mentioned, on Azure, such as IaaS platforms, virtual machines, applications, or databases, because it's an in-house product from Microsoft within the Azure ecosystem."
"Good compliance policies."
"The solution's robust security posture is the most valuable feature."
 

Cons

"With Cloud Native Security, we can't selectively enable or disable alerts based on our specific use case."
"We don't get any notifications from PingSafe when the clusters are down."
"We wanted it to provide us with something like Claroty Hub in AWS for lateral movement. For example, if an EC2 instance or a virtual machine is compromised in a public subnet based on a particular vulnerability, such as Log4j, we want it to not be able to reach some of our databases. This kind of feature is not supported in PingSafe."
"I used to work on AWS. At times, I would generate a normal bug in my system, and then I would check PingSafe. The alert used to come after about three and a half hours. It used to take that long to generate the alert about the vulnerability in my system. If a hacker attacks a system and PingSafe takes three to four hours to generate an alert, it will not be beneficial for the company. It would be helpful if we get the alert in five to ten minutes."
"For vulnerabilities, they are showing CVE ID. The naming convention should be better so that it indicates the container where a vulnerability is present. Currently, they are only showing CVE ID, but the same CVE ID might be present in multiple containers. We would like to have the container name so that we can easily fix the issue."
"We'd like to have better notifications. We'd like them to happen faster."
"It took us a while to configure the software to work well in this type of environment, as the support documents were not always clear."
"A beneficial improvement for PingSafe would be integration with Jira, allowing for a more streamlined ticketing system."
"For the next release, they could provide IPS features as well."
"While sending the alerts to the email, they are not being patched. we have to do the patching and mapping manually. If GuardDuty could include a feature to do this automatically, it will make our job easier. That is something I believe can be improved."
"AWS GuardDuty needs to be more customer-oriented."
"AWS GuardDuty sometimes shows false positives and should have better detection accuracy."
"The solution's user interface could be improved because it will help users to understand multiple options."
"It would be great if the solution had some automation capabilities."
"It is evolving, and at the moment, I will just need it on a larger scale. Then, it will satisfy my demand, initially."
"Because it's a threat detection service, they need to keep up with the various threat factors because new threat factors and attack factors come up all the time."
"The most significant areas for improvement are in the security of our identity and endpoints and the posture of the cloud environment. Better protection for our cloud users and cloud apps is always welcome."
"Customizing some of the compliance requirements based on individual needs seems like the biggest area of improvement. There should be an option to turn specific controls on and off based on how your solution is configured."
"Another thing is that Defender for Cloud uses more resources than CrowdStrike, which my current company uses. Defender for Cloud has two or three processes running simultaneously that consume memory and processor time. I had the chance to compare that with CrowdStrike a few days ago, which was significantly less. It would be nice if Defender were a little lighter. It's a relatively large installation that consumes more resources than competitors do."
"No possibility to write or edit any capability."
"Sometimes it's very difficult to determine when I need Microsoft Defender for Cloud for a special resource group or a special kind of product."
"Azure's system could be more on point like AWS support. For example, if I have an issue with AWS, I create a support ticket, then I get a call or a message. With Azure support, you raise a ticket, and somebody calls back depending on their availability and the priority, which might not align with your business priority."
"I would suggest building a single product that addresses endpoint server protection, attack surface, and everything else in one solution. That is the main disadvantage with the product. If we are incorporating some features, we end up in a situation where this solution is for the server, and that one is for the client, or this is for identity, and that is for our application. They're not bundling it. Commercially, we can charge for different licenses, but on the implementation side, it's tough to help our end-customer understand which product they're getting."
"The solution could extend its capabilities to other cloud providers. Right now, if you want to monitor a virtual machine on another cloud, you can do that. However, this cannot be done with other cloud platform services. I hope once that is available then Defender for Cloud will be a unified solution for all cloud platform services."
 

Pricing and Cost Advice

"The price depends on the extension of the solution that you want to buy. If you want to buy just EDR, the price is less. XDR is a little bit more expensive. There are going to be different add-ons for Singularity."
"PingSafe's pricing is good because it provides us with a solution."
"Its pricing was a little less than other providers."
"The pricing for PingSafe in India was more reasonable than other competitors."
"PingSafe is affordable."
"Their pricing appears to be based simply on the number of accounts we have, which is common for cloud-based products."
"PingSafe is priced reasonably for our workload."
"PingSafe falls somewhere in the middle price range, neither particularly cheap nor expensive."
"In terms of the costs associated with Amazon GuardDuty, it was $1 per GB from what I recall. Pricing was based on per gigabyte. For example, for the first five hundred gigabytes per month, it'll be $1 per GB, so it'll be $500. If your usage was greater, there's another bracket, for example, the next two thousand GB, then there's an add-on cost of 50 cents per GB. That's how Amazon GuardDuty pricing slowly goes up. I can't remember if there was any kind of additional cost apart from standard licensing for the solution. Nothing else that at least comes to mind. What the service was charging was worth it. That was one good thing when using Amazon GuardDuty because my company could be in a certain tier for a certain period. My company wasn't under a licensing model where it could overestimate its usage and under-utilize its usage and pay much more. This was what made the pricing model for Amazon GuardDuty better."
"80 percent of the customers are using AWS GuardDuty, and we recommend it due to its low cost, especially for small customers, ranging from five to ten dollars a month. In our policies, we enforce the usage of this service, making it a recommended practice for security."
"The tool's licensing model is pay-as-you-go."
"GuardDuty only enables accounts in regions where you have an active workload. If there are places where you don't have an active workload, you wouldn't even enable them. That's one area where they could allow you to cut down your cost."
"On a scale of one to ten, where one is a high price, and ten is a low price, I rate the pricing a four or five, which is somewhere in the middle."
"The platform is inexpensive."
"It can get very expensive. If you turn on every feature, it can turn into hundreds of thousands of dollars."
"The price of the solution is exactly right."
"Azure Defender is definitely pricey, but their competitors cost about the same. For example, a Palo Alto solution is the same price per endpoint, but the ground strikes cost a bit more than Azure Defender. Still, it's pricey for a company like ours. Maybe well-established organizations can afford it, but it might be too costly for a startup."
"Pricing depends on your workload size, but it is very cheap. If you're talking about virtual machines, it is $5 or something for each machine, which is minimal. If you go for some agent-based solution for every virtual machine, then you need to pay the same thing or more than that. For an on-premises solution like this, we were paying around $30 to $50 based on size. With Defender, Microsoft doesn't bother about the size. You pay based on the number of machines. So, if you have 10 virtual machines, and 10 virtual machines are being monitored, you are paying based on that rather than the size of the virtual machine. Thus, you are paying for the number of units rather than paying for the size of your units."
"This solution is more cost-effective than some competing products. My understanding is that it is based on the number of integrations that you have, so if you have fewer subscriptions then you pay less for the service."
"There are two different plans. We're using the secure basic plan, but we have used the end security plan as well. There are additional costs, but it gives us more functionalities compared to the basic plan."
"There are improvements that have to be made to the licensing. Currently, for servers, it has to be done by grouping the servers on a single subscription... We don't have an option whereby, if all those resources are in one subscription, we can have each of the individual servers subject to different planning."
"I'm not privy to that information, but I know it's probably close to a million dollars a year."
"Our clients complain about the cost of Microsoft Defender for Cloud."
"The price of the solution is good for the features we receive and there is an additional cost for Microsoft premier support. However, some of my potential customers have found it to be expensive and have gone on to choose another solution."
report
Use our free recommendation engine to learn which Cloud Workload Protection Platforms (CWPP) solutions are best for your needs.
793,295 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
19%
Financial Services Firm
15%
Manufacturing Company
10%
Insurance Company
5%
Financial Services Firm
17%
Computer Software Company
16%
Manufacturing Company
9%
Healthcare Company
6%
Computer Software Company
17%
Financial Services Firm
14%
Manufacturing Company
8%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about PingSafe?
The dashboard gives me an overview of all the things happening in the product, making it one of the tool's best featu...
What is your experience regarding pricing and costs for PingSafe?
The price depends on the extension of the solution that you want to buy. If you want to buy just EDR, the price is le...
What needs improvement with PingSafe?
All EDRs are made of different modules. There is a firewall module, an IPS module, and an application module. The app...
What do you like most about Amazon GuardDuty?
With anomaly detection, active threat monitoring, and set correlation, GuardDuty alerts me to any unusual user behavi...
What needs improvement with Amazon GuardDuty?
The product needs to improve its cost-efficiency since it is expensive.
How is Prisma Cloud vs Azure Security Center for security?
Azure Security Center is very easy to use, integrates well, and gives very good visibility on what is happening acros...
What do you like most about Microsoft Defender for Cloud?
The entire Defender Suite is tightly coupled, integrated, and collaborative.
What is your experience regarding pricing and costs for Microsoft Defender for Cloud?
Our clients complain about the cost of Microsoft Defender for Cloud. Microsoft needs to bring the cost down. What we'...
 

Also Known As

PingSafe
No data available
Microsoft Azure Security Center, Azure Security Center, Microsoft ASC, Azure Defender
 

Interactive Demo

Demo not available
Demo not available
 

Overview

 

Sample Customers

Information Not Available
autodesk, mapbox, fico, webroot
Microsoft Defender for Cloud is trusted by companies such as ASOS, Vatenfall, SWC Technology Partners, and more.
Find out what your peers are saying about AWS GuardDuty vs. Microsoft Defender for Cloud and other solutions. Updated: July 2024.
793,295 professionals have used our research since 2012.