AWS GuardDuty vs Symantec Cloud Workload Protection comparison

AWS GuardDuty vs. Symantec Cloud Workload Protection

Download the complete report

Helped 879,310 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

SentinelOne Singularity Clo...

Mindshare comparison

As of December 2025, in the Cloud Workload Protection Platforms (CWPP) category, the mindshare of SentinelOne Singularity Cloud Security is 3.6%, up from 2.0% compared to the previous year. The mindshare of AWS GuardDuty is 14.4%, up from 12.5% compared to the previous year. The mindshare of Symantec Cloud Workload Protection is 0.2%, up from 0.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Cloud Workload Protection Platforms (CWPP) Market Share Distribution
Product	Market Share (%)
AWS GuardDuty	14.4%
SentinelOne Singularity Cloud Security	3.6%
Symantec Cloud Workload Protection	0.2%
Other	81.8%

Cloud Workload Protection Platforms (CWPP)

Featured Reviews

Satyavijay Chavan

Information Security Engineer at DataVigilant Infotech

Enables us to prioritize and effectively address critical security issues

Evidence-based reporting helps us to prioritize and solve critical security issues. The new visualization feature demonstrates how an attacker can enter the system, highlighting the potential path that can be exploited and outlining all the steps the attacker could take. With that visibility, we can ensure the perimeter is strong and attackers cannot enter, thus reducing the risk. It has helped us prioritize issues. The visibility into how an attack could happen is valuable. For example, it highlights the system vulnerability and outlines where an attack could propagate. The visualization helps me to prioritize remediation, and if I don't know where to start, I can check to see the score that enables me to prioritize issues. I am using infrastructure-as-code scanning, and it's one of the useful features. In pre-production, it identifies embedded secrets and misconfigurations, including issues with Kubernetes or some privileged containers. This feature allows us to pass the audit and secure IaC code so that it isn't easily exploitable by attackers. We can more proactively work to identify and resolve vulnerabilities by using the dashboard and the alerting system that SentinelOne provides. It helps us with audits and compliance. We can show the compliance in percentage. We can confidently say that our company or infrastructure is very secure. It has improved our security posture by 30% to 35%. It has reduced our false positives by 30%. It has helped teams collaborate better. The security team manages SentinelOne Singularity Cloud Security, and when it flags vulnerabilities, they are forwarded to DevOps for remediation. Previously, we needed to identify and report the issues, but there would be lapses in communication. Now, there is a centralized dashboard that anyone can look at and see the open issues and work on them.

Read full review

ShantanuKhare

Senior IT Auditor at Ernst & Young

Has provided automated threat detection and daily malicious activity insights while supporting seamless orchestration with existing dashboards

I would assess the integration of AWS GuardDuty with Threat Intelligence as majorly positive; no threat intelligence is 100% accurate, and there are a few false positives, but as a security engineer, this must be accepted, and overall, the response and service is good for us. We do not directly use AWS GuardDuty dashboard by itself, as we have our own integrated security dashboard; AWS GuardDuty gives the feed to that dashboard, and it's giving us a satisfactory view of how the security landscape looks. We use metrics such as zero-day threats, any malicious traffic, and any traffic which originates from OFAC countries to measure its effectiveness, as we are majorly into a financial institution, as any traffic that is from a malicious IP or a rogue device. I don't see any significant negative points regarding AWS GuardDuty; it's a good product to have if you're a cloud consumer. I rate AWS GuardDuty nine out of ten overall.

Read full review

Mahadi Ma

Engineer at M.Tech

Has a good active directory feature and good technical support

One area for improvement in Symantec Cloud Workload Protection is integration. Other features that could be improved are defense control and encryption, particularly in the USB. For example, users should be able to control the USB and have the capability of blocking and allowing USB reading and writing. Having a USB encryption feature in Symantec Cloud Workload Protection would also be very useful. An additional feature I'd like to see in the next release of Symantec Cloud Workload Protection is more advanced defense on mobile devices such as iOS and Android. For example, even offline or with no internet connection, it would be good if the solution could defend devices against malware and ransomware.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The user interface is well-designed and easy to navigate."

"I would definitely recommend SentinelOne Singularity Cloud Security for infrastructure security."

"The most valuable feature of the solution is its storyline, which helps trace an event back to its source, like an email or someone clicking on a link."

"My favorite feature is Storyline."

"The offensive security feature is valuable because it publicly detects the offensive and vulnerable things present in our domain or applications. It checks any applications with public access. Some of the applications give public access to certain files or are present over a particular domain. It detects and lets us know with evidence. That is quite good. It is protecting our infrastructure quite well."

"The cloud misconfiguration is the most valuable feature."

"I would rate SentinelOne Singularity Cloud Security a nine out of ten."

"Visibility is the most important aspect."

More SentinelOne Singularity Cloud Security pros

"It kinda just gives us another layer of security. So it does provide some sort of comfort that we do have something that is monitoring for abnormal behavior."

"The out-of-band malware detection from the EBS volumes. It's really cool. No agents or anything needed, it automatically finds and correlates based on malware."

"GuardDuty is extensive in terms of configuration and security compliance."

"We generally use AWS GuardDuty for detection of zero-day vulnerabilities and automatic threat responses; it serves as a SOAR, an orchestrated and automated response solution for us in the AWS platform."

"AWS GuardDuty integrates seamlessly with third-party tools in our existing ecosystem, and we did not experience any challenges with integration."

"What I like most about Amazon GuardDuty is that you can monitor your AWS accounts across, but you don't have to pay the additional cost. You can get all your CloudTrail VPC flow logs and DNS logs all in one, and then you get the monitoring with that. A lot of times, if you had a separate tool on-premise, you would have to set up your DNS logs, so usually, Amazon GuardDuty helps with all your additional networking requirements, so I utilize it for continuous monitoring because you can't detect anything if you're not monitoring, and the solution fills that gap. If you don't do anything else first, you can deploy your firewall, and then you've got your Route 53 DNS and DNSSEC, but then Amazon GuardDuty fills that, and then you have audit requirements in AU that says, "Hey, what are your additional logs?", so you can just say, "Hey, we utilize Amazon GuardDuty." You're getting your CloudTrail, your VPC flow logs, and all your DNS logs, and those are your additional logs right there, so the solution meets a lot of requirements. Now, everything comes with a cost, but I also like that the solution also provides threat response and remediation. It's a pretty good product. I've just used it more for log analysis and that's where the value is at, the niche value. Once you do threat detection, it goes into a lot of other integrations you need to implement, so threat detection is only good as the integration, as the user that knows the tools itself, and the architecture and how it's all set up and the rules that you set within that."

"AWS GuardDuty helps by providing continuous threat detection and signaling potential threats. Its most valuable feature is continuous monitoring. The tool's integration with other AWS services has improved security. It provides continuous monitoring and intelligent threat detection, quickly signaling any issues. I would rate this improvement a seven out of ten."

More AWS GuardDuty pros

"The most valuable features in Symantec Cloud Workload Protection are endpoint protection and active directory features. The active directory features in the product are very good, and in terms of security, the most valuable feature in Symantec Cloud Workload Protection is threat defense or threat protection."

"It will read various logs, diagnose what is wrong, and then alert you."

Cons

"The area of improvement is the cost, which is high compared to other traditional endpoint protections."

"There's an array of upcoming versions with numerous features to be incorporated into the roadmap. Customers particularly appreciate the service's emphasis on intensive security, especially the secret scanning aspect. During the proof of concept (POC) phase, the system is required to gather logs from the customer's environment. This process entails obtaining specific permissions, especially in terms of gateway access. While most permissions for POC are manageable, the need for various permissions may need improvement, especially in the context of security."

"We've found a lot of false positives."

"I would like to see the map feature improve. It's good, but it isn't fully developed. It lets us use custom resources and policies but does not allow us to perform some actions. I would also like more custom integration and runtime security for Kubernetes."

"The recommended actions aren't always specific, so it might suggest recommendations that don't apply to the particular infrastructure code I'm reviewing."

"While SentinelOne offers robust security features, its higher cost may present a challenge for budget-conscious organizations."

"The categorization of the results from the vulnerability assessment could be improved."

"There is room for improvement in the current active licensing model for SentinelOne Singularity Cloud Security."

More SentinelOne Singularity Cloud Security cons

"AWS GuardDuty needs to be more customer-oriented."

"It would be great if the solution had some automation capabilities."

"Because it's a threat detection service, they need to keep up with the various threat factors because new threat factors and attack factors come up all the time."

"For the next release, they could provide IPS features as well."

"GuardDuty is limited to AWS environments."

"In future updates of AWS GuardDuty, I would suggest implementing better UI features."

"Amazon GuardDuty could be better enriched in threat intelligence data."

"We currently find Lacework to be much better at detecting vulnerabilities than AWS GuardDuty. The engines of AWS GuardDuty have to be improved."

More AWS GuardDuty cons

"In the future, we may need to use features that are only available in one of the competing products."

"One area for improvement in Symantec Cloud Workload Protection is integration. Other features that could be improved are defense control and encryption, particularly in the USB. For example, users should be able to control the USB and have the capability of blocking and allowing USB reading and writing. Having a USB encryption feature in Symantec Cloud Workload Protection would also be very useful."

Pricing and Cost Advice

"PingSafe falls somewhere in the middle price range, neither particularly cheap nor expensive."

"The pricing for PingSafe in India was more reasonable than other competitors."

"It's not expensive. The product is in its initial growth stages and appears more competitive compared to others. It comes in different variants, and I believe the enterprise version costs around $55 per user per year. I would rate it a five, somewhere fairly moderate."

"Its pricing was a little less than other providers."

"PingSafe's pricing is good because it provides us with a solution."

"While SentinelOne Singularity Cloud Security offers robust protection, its high cost may be prohibitive for small and medium-sized businesses."

"I understand that SentinelOne is a market leader, but the bill we received was astronomical."

"SentinelOne Singularity Cloud Security is costly."

More SentinelOne Singularity Cloud Security pricing and cost advice

"We use a pay-as-you-use license, which is competitively priced in the market."

"80 percent of the customers are using AWS GuardDuty, and we recommend it due to its low cost, especially for small customers, ranging from five to ten dollars a month. In our policies, we enforce the usage of this service, making it a recommended practice for security."

"GuardDuty only enables accounts in regions where you have an active workload. If there are places where you don't have an active workload, you wouldn't even enable them. That's one area where they could allow you to cut down your cost."

"The price of the solution is exactly right."

"On a scale of one to ten, where one is a high price, and ten is a low price, I rate the pricing a four or five, which is somewhere in the middle."

"In terms of the costs associated with Amazon GuardDuty, it was $1 per GB from what I recall. Pricing was based on per gigabyte. For example, for the first five hundred gigabytes per month, it'll be $1 per GB, so it'll be $500. If your usage was greater, there's another bracket, for example, the next two thousand GB, then there's an add-on cost of 50 cents per GB. That's how Amazon GuardDuty pricing slowly goes up. I can't remember if there was any kind of additional cost apart from standard licensing for the solution. Nothing else that at least comes to mind. What the service was charging was worth it. That was one good thing when using Amazon GuardDuty because my company could be in a certain tier for a certain period. My company wasn't under a licensing model where it could overestimate its usage and under-utilize its usage and pay much more. This was what made the pricing model for Amazon GuardDuty better."

"The tool's licensing model is pay-as-you-go."

"Pricing is determined by the number of events sent."

More AWS GuardDuty pricing and cost advice

"The licensing cost for Symantec Cloud Workload Protection is paid yearly."

See which vendors are best for you

Use our free recommendation engine to learn which Cloud Workload Protection Platforms (CWPP) solutions are best for your needs.

See recommendations

879,310 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

15%

Financial Services Firm

14%

Manufacturing Company

10%

Government

Financial Services Firm

15%

Computer Software Company

12%

Manufacturing Company

Government

No data available

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	47
Midsize Enterprise	20
Large Enterprise	53

By reviewers
Company Size	Count
Small Business	8
Midsize Enterprise	3
Large Enterprise	15

No data available

Questions from the Community

What do you like most about PingSafe?

The dashboard gives me an overview of all the things happening in the product, making it one of the tool's best featu...

What is your experience regarding pricing and costs for PingSafe?

I think the pricing of SentinelOne Singularity Cloud Security is a bit high.

What needs improvement with PingSafe?

One area that could be improved in SentinelOne Singularity Cloud Security is their policies; the way they have config...

What do you like most about Amazon GuardDuty?

With anomaly detection, active threat monitoring, and set correlation, GuardDuty alerts me to any unusual user behavi...

What is your experience regarding pricing and costs for Amazon GuardDuty?

AWS GuardDuty is an expensive feature, and while you can't expect the price to be low, it can be lower because it's p...

What needs improvement with Amazon GuardDuty?

AWS GuardDuty is a good product; it's doing its job right now, and I don't see any additional improvements needed. Co...

Prisma Cloud by Palo Alto Networks vs SentinelOne Singularity Cloud Security

Ask a question

Earn 20 points

Comparisons

Compared 11% of the time

Wiz vs SentinelOne Singularity Cloud Security

Compared 10% of the time

Microsoft Defender for Cloud vs SentinelOne Singularity Cloud Security

Compared 6% of the time

Aqua Cloud Security Platform vs SentinelOne Singularity Cloud Security

Compared 4% of the time

CrowdStrike Falcon Cloud Security vs SentinelOne Singularity Cloud Security

Compared 4% of the time

More SentinelOne Singularity Cloud Security Competitors

Microsoft Defender for Cloud vs AWS GuardDuty

Compared 66% of the time

CrowdStrike Falcon Cloud Security vs AWS GuardDuty

Compared 7% of the time

Wiz vs AWS GuardDuty

Compared 6% of the time

Prisma Cloud by Palo Alto Networks vs AWS GuardDuty

Compared 4% of the time

Trend Vision One - Cloud Security vs AWS GuardDuty

Compared 3% of the time

More AWS GuardDuty Competitors

Check Point Harmony Email & Collaboration vs Symantec Cloud Workload Protection

Compared 46% of the time

More Symantec Cloud Workload Protection Competitors

Product Reports

SentinelOne Singularity Cloud Security

Download SentinelOne Singularity Cloud Security product report

SentinelOne Singularity Cloud Security report

AWS GuardDuty

Download AWS GuardDuty product report

Cloud Workload Protection Platforms (CWPP)

Download Symantec Cloud Workload Protection product report

Symantec Cloud Workload Protection report

Also Known As

PingSafe

No data available

Overview

SentinelOne Singularity Cloud Security offers a streamlined approach to cloud security with intuitive operation and strong integration capabilities for heightened threat detection and remediation efficiency.

Singularity Cloud Security stands out for its real-time detection and response, effectively minimizing detection and remediation timelines. Its automated remediation integrates smoothly with third-party tools enhancing operational efficiency. The comprehensive console ensures visibility and support for forensic investigations. Seamless platform integration and robust support for innovation are notable advantages. Areas for development include improved search functionality, affordability, better firewall capabilities for remote users, stable agents, comprehensive reporting, and efficient third-party integrations. Clarity in the interface, responsive support, and real-time alerting need enhancement, with a call for more automation and customization. Better scalability and cost-effective integration without compromising capabilities are desired.

What are SentinelOne Singularity Cloud Security's standout features?

Ease of Use: Intuitive operation simplifies navigation across platforms.
Real-Time Detection: Quick identification and response to threats.
Automated Remediation: Streamlines recovery processes with integration capabilities.
Forensic Visibility: Aids in thorough threat analysis and prevention strategies.
Comprehensive Console: Offers full visibility and historical data tracking.
Platform Integration: Supports seamless operation across cloud and hybrid environments.

What benefits should users expect from SentinelOne Singularity Cloud Security?

Enhanced Efficiency: Automation and third-party integration improve threat response.
Improved Detection: Reduces mean time to detect and respond to threats.
Operational Support: Comprehensive visibility and forensic tools aid operational decisions.
Cost Efficiency: Affordable integration with scaling capabilities without high overhead.

SentinelOne Singularity Cloud Security is deployed in industries needing robust cloud security posture management, endpoint protection, and threat hunting. Utilized frequently across AWS and Azure, it assists in monitoring, threat detection, and maintaining compliance in diverse environments while providing real-time alerts and recommendations for proactive threat management.

SentinelOne

Amazon Guard Duty is a continuous cloud security monitoring service that consistently monitors and administers several data sources. These include AWS CloudTrail data events for EKS (Elastic Kubernetes Service) audit logs, VPC (Virtual Private Cloud) flow logs, DNS (Domain Name System) logs, S3 (Simple Cloud Storage), and AWS CloudTrail event logs.

Amazon GuardDuty intuitively uses threat intelligence data - such as lists of malicious domains and IP addresses - and ML (machine learning) to quickly discover suspicious and problematic activity in a user's AWS ecosystem. Activities may include concerns such as interactions with malicious IP addresses or domains, exposed credentials usage, or changes and/or escalation of privileges.

GuardDuty is able to easily determine problematic AWS EC2 (Elastic Compute Cloud) instances delivering malware or mining bitcoin. It is also able to trace AWS account access history for evidence of destabilization. such as suspicious API calls resulting in changing password policies to minimize password strength or anomalous infrastructure deployments in new or different never-used regions.

GuardDuty will continually alert users regarding their AWS environment status and will send the security discoveries to the GuardDuty dashboard or Amazon CloudWatch events for users to view.

Users can access GuardDuty via:

AWS SDKs: Amazon provides users with several software development kits (SDKs) that are made up of libraries and sample code of numerous popular programming languages and platforms, such as Android, iOS, Java, .Net, Python, and Ruby. The SDKs make it easier to develop programmatic access to GuardDuty.
GuardDuty HTTPS API: This allows users to issue HTTPS requests directly to the service.
GuardDuty Console: This is a browser-based intuitive dashboard interface where users can access and use GuardDuty.

Amazon Elastic Kubernetes Service (Amazon EKS)

Kubernetes protection is an optional add-on in Amazon GuardDuty. This tool is able to discover malicious behavior and possible destabilization of an organization's Kubernetes clusters inside of Amazon Elastic Kubernetes Service (Amazon EKS).

When Amazon EKS is activated, GuardDuty will actively use various data sources to discover potential risks against Kubernetes API. When Kubernetes protection is enabled, GuardDuty uses optional data sources to detect threats against Kubernetes API.

Kubernetes audit logs are a Kubernetes feature that captures historical API activity from applications, the control plane, users, and endpoints. GuardDuty collates these logs from Amazon EKS to create Kubernetes discoveries for the organization's Amazon EKS assets; there is no need to store or turn on the logs.

As long as Kubernetes protection remains activated, GuardDuty will continuously dissect Kubernetes data sources from the Amazon EKS clusters to ensure no suspicious or anomalous behavior is taking place.

Amazon Simple Cloud Storage (S3) Protection

Amazon S3 allows Amazon GuardDuty to actively audit object-level API processes to discover possible security threats to data inside an organization's S3 buckets. GuardDuty continually audits risk to the organization’s S3 assets by carefully dissecting AWS CloudTrail management events and AWS CloudTrail S3 data events. These tools are continually auditing various CloudTrail management events for potential suspicious activities that affect S3 buckets, such as PutBucketReplication, DeleteBucket, ListBucket, and data events for S3 object-level API processes, such as PutObject, GetObject, ListObject, and DeleteObject.

Reviews from Real Users

“The most valuable features are the single system for data collection and the alert mechanisms. Prior to using GuardDuty, we had multiple systems to collect data and put it in a centralized location so we could look into it. Now we don't need to do that anymore as GuardDuty does it for us.” - Arunkumar A., Information Security Manager at Tata Consultancy Services

Amazon Web Services (AWS)

Symantec Cloud Workload Protection automates security for public cloud workloads, enabling business agility, risk reduction, and cost savings for organizations, while easing DevOps and administrative burdens. Rapid discovery, visibility, and elastic protection of AWS and Azure workloads enable automated security policy enforcement to protect applications from unknown exploits.

Broadcom

Sample Customers

Information Not Available

autodesk, mapbox, fico, webroot

LifeLock

AWS GuardDuty vs. Symantec Cloud Workload Protection