Try our new research platform with insights from 80,000+ expert users
AWS GuardDuty Logo

AWS GuardDuty Reviews

Vendor: Amazon Web Services (AWS)
4.1 out of 5
Badge Leader
Leave a review

What is AWS GuardDuty?

Amazon Guard Duty is a continuous cloud security monitoring service that consistently monitors and administers several data sources. These include AWS CloudTrail data events for EKS (Elastic Kubernetes Service) audit logs, VPC (Virtual Private Cloud) flow logs, DNS (Domain Name System) logs, S3 (Simple Cloud Storage), and AWS CloudTrail event logs.

Amazon GuardDuty intuitively uses threat intelligence data - such as lists of malicious domains and IP addresses - and ML (machine learning) to quickly discover suspicious and problematic activity in a user's AWS ecosystem. Activities may include concerns such as interactions with malicious IP addresses or domains, exposed credentials usage, or changes and/or escalation of privileges.

GuardDuty is able to easily determine problematic AWS EC2 (Elastic Compute Cloud) instances delivering malware or mining bitcoin. It is also able to trace AWS account access history for evidence of destabilization. such as suspicious API calls resulting in changing password policies to minimize password strength or anomalous infrastructure deployments in new or different never-used regions.

Get the AWS GuardDuty Buyer's Guide and find out what your peers are saying about AWS GuardDuty, Wiz, Microsoft Defender for Cloud and more!
AWS GuardDuty is the #2 ranked solution in Cloud Workload Protection Platforms. PeerSpot users give AWS GuardDuty an average rating of 8.2 out of 10. AWS GuardDuty is most commonly compared to Wiz: AWS GuardDuty vs Wiz. AWS GuardDuty is popular among the large enterprise segment, accounting for 62% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 15% of all views.
Buyer's Guide
AWS GuardDuty
January 2026
Get the report
Helped 881,384 peers since 2012

Featured AWS GuardDuty reviews

Read more reviews

AWS GuardDuty mindshare

As of February 2026, the mindshare of AWS GuardDuty in the Cloud Workload Protection Platforms (CWPP) category stands at 14.5%, up from 12.4% compared to the previous year, according to calculations based on PeerSpot user engagement data.
Cloud Workload Protection Platforms (CWPP) Market Share Distribution
ProductMarket Share (%)
AWS GuardDuty14.5%
Microsoft Defender for Cloud16.6%
Wiz12.3%
Other56.599999999999994%
Cloud Workload Protection Platforms (CWPP)

PeerResearch reports based on AWS GuardDuty reviews

TypeTitleDate
CategoryCloud Workload Protection Platforms (CWPP)Feb 2, 2026Download
ProductReviews, tips, and advice from real usersFeb 2, 2026Download
ComparisonAWS GuardDuty vs Microsoft Defender for CloudFeb 2, 2026Download
ComparisonAWS GuardDuty vs WizFeb 2, 2026Download
ComparisonAWS GuardDuty vs SentinelOne Singularity Cloud SecurityFeb 2, 2026Download
Suggested products
TitleRatingMindshareRecommending
Wiz4.512.3%97%35 interviewsAdd to research
Microsoft Defender for Cloud4.016.6%93%87 interviewsAdd to research
 
 
Key learnings from peers

Valuable Features

AWS GuardDuty offers valuable features including integrated data collection, alert mechanisms, and cost-efficient monitoring across AWS accounts. Users find threat detection, anomaly behavior analysis, and seamless integration with existing AWS services valuable. Its ability to monitor anomalies in DNS, VPC flow, and CloudTrail logs aids in security and compliance, providing rapid notifications and automated responses against malicious activity. Users value its machine learning-powered threat detection and end-to-end visibility, enhancing AWS environment security.
  • "We generally use AWS GuardDuty for detection of zero-day vulnerabilities and automatic threat responses; it serves as a SOAR, an orchestrated and automated response solution for us in the AWS platform."
  • "We generally use AWS GuardDuty for detection of zero-day vulnerabilities and automatic threat responses; it serves as a SOAR, an orchestrated and automated response solution for us in the AWS platform."
  • "AWS GuardDuty integrates seamlessly with third-party tools in our existing ecosystem, and we did not experience any challenges with integration."

Room for Improvement

AWS GuardDuty needs improvements such as mobile access, enhanced security analytics, and comprehensive dashboard features. Users want better integration with AWS services, increased threat intelligence, and improved cost efficiency. Automation and more effective user interfaces are desired, alongside better detection in container environments. Some users also seek unified dashboards for multi-region monitoring and integration with other security tools. Improved technical support and the ability to handle false positives effectively are also sought after.
  • "Comparing AWS GuardDuty to similar products from Microsoft, Microsoft has a product called Sentinel, which is a completely integrated solution that basically does everything from vulnerability management to managing log analytics. This is something which AWS GuardDuty doesn't have since it's a separate service."
  • "Comparing AWS GuardDuty to similar products from Microsoft, Microsoft has a product called Sentinel, which is a completely integrated solution that basically does everything from vulnerability management to managing log analytics. This is something which AWS GuardDuty doesn't have since it's a separate service."
  • "In future updates of AWS GuardDuty, I would suggest implementing better UI features."

ROI

AWS GuardDuty enhances threat detection, improving overall security posture and gaining customer trust, thus attracting more clients. It provides early threat notifications, reducing investigation time and costs. Users report satisfaction and continued use indicating a positive return. Time savings average around 40%, with significant improvements in response time. Although detailing financial implications remains ongoing, AWS GuardDuty has already improved security operations costs and shown a clear qualitative benefit in security and customer confidence.

Pricing

AWS GuardDuty pricing employs a pay-as-you-go model, making it competitive and flexible for varying organizational needs. Small businesses find it manageable, while larger enterprises may face higher costs. The model includes charges per gigabyte, with discounts at higher usage tiers. Clients appreciate its transparency, although some suggest improvements in cost-efficiency at larger scales. Pricing typically begins around $1 per GB or per million requests, deemed economical compared to competitors. GuardDuty is seamlessly integrated into AWS infrastructure.
  • "The tool's licensing model is pay-as-you-go."
  • "80 percent of the customers are using AWS GuardDuty, and we recommend it due to its low cost, especially for small customers, ranging from five to ten dollars a month. In our policies, we enforce the usage of this service, making it a recommended practice for security."
  • "It can get very expensive. If you turn on every feature, it can turn into hundreds of thousands of dollars."

Popular Use Cases

Organizations utilize AWS GuardDuty for threat detection, monitoring AWS accounts for suspicious activity, and compliance assistance. It helps identify potential security risks, detect anomalies, and safeguard AWS environments by analyzing logs and providing alerts on malicious activities. Companies often use it for monitoring user permissions, setting up CloudWatch alarms, and protecting infrastructure, including EC2 instances, S3 buckets, and Lambda functions, from unauthorized access, vulnerabilities, and cyber threats.

Service and Support

AWS GuardDuty support is highly responsive and effective. Many users have expressed satisfaction with AWS's swift resolution of queries through various channels, including chat, phone, and web support, with some rating it ten out of ten. Users appreciate the comprehensive documentation and availability of resources. Although there are minor delays and occasional variability in support quality, AWS's 24/7 access and commitment to resolving issues are valued, with few escalations needed.

Deployment

The initial setup of AWS GuardDuty is mostly described as straightforward and simple. Many mention a one-click process, requiring minimal resources and time for deployment. Users highlight that complexity can arise with certain integrations and specific architectural requirements. Configuring AWS environments, enabling Security Hub, and using infrastructure as code can present challenges. AWS GuardDuty's adaptability across multiple accounts and its ability to integrate with AWS environments are consistently praised.

Scalability

AWS GuardDuty is recognized for its impressive scalability, effectively supporting dynamic and growing cloud environments. It efficiently manages increased data volumes and adapts to changing network traffic. Many users appreciate its design, which allows seamless scaling across multiple accounts. Users consistently rate its scalability highly, often between eight and ten out of ten. It's adaptable for various demands and is considered essential for account management, making it suitable for both small businesses and larger organizations.

Stability

AWS GuardDuty demonstrates excellent stability with no significant outages or downtime. Many organizations report that GuardDuty operates smoothly in their production environments, even when integrating with CloudTrail and CloudWatch. Users often praise GuardDuty's reliability and rate its stability between eight and ten out of ten. Although some experience false positives, the tool remains highly dependable, backed by AWS's robust machine learning capabilities. Most users commend GuardDuty's quick analytics and overall responsiveness.
These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.
Download our AWS GuardDuty Buyer's Guide for additional reliable information.

Review data by company size

By reviewers
Company SizeCount
Small Business8
Midsize Enterprise3
Large Enterprise13
By reviewers
By visitors reading reviews
Company SizeCount
Small Business304
Midsize Enterprise197
Large Enterprise802
By visitors reading reviews

Top industries

By visitors reading reviews
Financial Services Firm
15%
Computer Software Company
11%
Manufacturing Company
9%
Government
6%
Retailer
6%
Comms Service Provider
5%
Insurance Company
5%
Healthcare Company
4%
University
4%
Energy/Utilities Company
3%
Outsourcing Company
3%
Media Company
3%
Educational Organization
3%
Construction Company
3%
Legal Firm
2%
Transportation Company
2%
Marketing Services Firm
2%
Real Estate/Law Firm
2%
Non Profit
2%
Hospitality Company
1%
Consumer Goods Company
1%
Recreational Facilities/Services Company
1%
Performing Arts
1%
Pharma/Biotech Company
1%
Wholesaler/Distributor
1%
Recruiting/Hr Firm
1%
Aerospace/Defense Firm
1%
Paper And Forest Products
1%

Compare AWS GuardDuty with alternative products

Go!

Learn more about AWS GuardDuty

GuardDuty will continually alert users regarding their AWS environment status and will send the security discoveries to the GuardDuty dashboard or Amazon CloudWatch events for users to view.

Users can access GuardDuty via:

  • AWS SDKs: Amazon provides users with several software development kits (SDKs) that are made up of libraries and sample code of numerous popular programming languages and platforms, such as Android, iOS, Java, .Net, Python, and Ruby. The SDKs make it easier to develop programmatic access to GuardDuty.

  • GuardDuty HTTPS API: This allows users to issue HTTPS requests directly to the service.

  • GuardDuty Console: This is a browser-based intuitive dashboard interface where users can access and use GuardDuty.

Amazon Elastic Kubernetes Service (Amazon EKS)

Kubernetes protection is an optional add-on in Amazon GuardDuty. This tool is able to discover malicious behavior and possible destabilization of an organization's Kubernetes clusters inside of Amazon Elastic Kubernetes Service (Amazon EKS).

When Amazon EKS is activated, GuardDuty will actively use various data sources to discover potential risks against Kubernetes API. When Kubernetes protection is enabled, GuardDuty uses optional data sources to detect threats against Kubernetes API.

Kubernetes audit logs are a Kubernetes feature that captures historical API activity from applications, the control plane, users, and endpoints. GuardDuty collates these logs from Amazon EKS to create Kubernetes discoveries for the organization's Amazon EKS assets; there is no need to store or turn on the logs.

As long as Kubernetes protection remains activated, GuardDuty will continuously dissect Kubernetes data sources from the Amazon EKS clusters to ensure no suspicious or anomalous behavior is taking place.

Amazon Simple Cloud Storage (S3) Protection

Amazon S3 allows Amazon GuardDuty to actively audit object-level API processes to discover possible security threats to data inside an organization's S3 buckets. GuardDuty continually audits risk to the organization’s S3 assets by carefully dissecting AWS CloudTrail management events and AWS CloudTrail S3 data events. These tools are continually auditing various CloudTrail management events for potential suspicious activities that affect S3 buckets, such as PutBucketReplication, DeleteBucket, ListBucket, and data events for S3 object-level API processes, such as PutObject, GetObject, ListObject, and DeleteObject.

Reviews from Real Users

“The most valuable features are the single system for data collection and the alert mechanisms. Prior to using GuardDuty, we had multiple systems to collect data and put it in a centralized location so we could look into it. Now we don't need to do that anymore as GuardDuty does it for us.” - Arunkumar A., Information Security Manager at Tata Consultancy Services

AWS GuardDuty customers

autodesk, mapbox, fico, webroot

Related questions

  • 25
What tools provide the best container environment security?
  • 16
When evaluating Cloud Workload Security, what aspect do you think is the most important to look for?
  • 19
Can we customize the dashboard in Threat Stack Cloud Security Platform? Any recommendations for an alternative solution supporting dashboards?
  • 15
What are the best cloud workload security software solutions?
  • 17
Why use cloud workload security software?
  • 31
Why are Cloud Workload Protection Platforms (CWPP) important for companies?
  • 17
Why is CWPP (Cloud Workload Protection Platforms) important for companies?

Product Categories

Product Categories
Cloud Workload Protection Platforms (CWPP)

Popular Comparisons

Popular Comparisons
Wiz vs AWS GuardDuty Logo
Wiz vs AWS GuardDuty
Microsoft Defender for Cloud vs AWS GuardDuty Logo
Microsoft Defender for Cloud vs AWS GuardDuty
SentinelOne Singularity Cloud Security vs AWS GuardDuty Logo
SentinelOne Singularity Cloud Security vs AWS GuardDuty
CrowdStrike Falcon Cloud Security vs AWS GuardDuty Logo
CrowdStrike Falcon Cloud Security vs AWS GuardDuty
Illumio vs AWS GuardDuty Logo
Illumio vs AWS GuardDuty
Akamai Guardicore Segmentation vs AWS GuardDuty Logo
Akamai Guardicore Segmentation vs AWS GuardDuty
Orca Security vs AWS GuardDuty Logo
Orca Security vs AWS GuardDuty
Check Point CloudGuard CNAPP vs AWS GuardDuty Logo
Check Point CloudGuard CNAPP vs AWS GuardDuty
Trend Vision One - Cloud Security vs AWS GuardDuty Logo
Trend Vision One - Cloud Security vs AWS GuardDuty
FortiCNAPP vs AWS GuardDuty Logo
FortiCNAPP vs AWS GuardDuty
Aqua Cloud Security Platform vs AWS GuardDuty Logo
Aqua Cloud Security Platform vs AWS GuardDuty
Cisco Secure Workload vs AWS GuardDuty Logo
Cisco Secure Workload vs AWS GuardDuty
Tenable Cloud Security vs AWS GuardDuty Logo
Tenable Cloud Security vs AWS GuardDuty
SUSE NeuVector vs AWS GuardDuty Logo
SUSE NeuVector vs AWS GuardDuty
Upwind vs AWS GuardDuty Logo
Upwind vs AWS GuardDuty
See all alternatives
 
AWS GuardDuty Reviews Summary
Author infoRatingReview Summary
Senior IT Auditor at Ernst & Young4.5I’ve used AWS GuardDuty for three years to detect threats and automate responses; it’s reliable and scalable, though integration could improve compared to Microsoft Sentinel. Despite being costly, overall, it’s a strong, effective security solution for our needs.
AWS Cloud Engineer at Standard Telephones and Cables4.5I mainly use AWS GuardDuty to detect compromised EC2 instances and monitor threats in S3 buckets and Lambda functions. Its ease of use and cost-effectiveness are valuable, but improvements are needed for multi-region management and more detailed investigations.
Senior Security Analyst (AppSec) at ELETROBRAS4.5I've extensively used AWS GuardDuty to detect threats and unauthorized access in my environment and appreciate its integration with the AWS ecosystem. While it's effective, I think container environment detections could be improved for services like Fargate and EKS.
DevOps Engineer at a consultancy with 10,001+ employees4.0I use AWS GuardDuty with AWS Security for detecting threats like brute force attacks and unauthorized SSH attempts. It's valued for its threat detection integration, though I wish it integrated with more AWS services. AWS's notifications improve response times significantly.
Cloud Engineer at Epsilon4.0I use AWS GuardDuty to continuously monitor AWS accounts and enhance security through intelligent threat detection and integration with other AWS services. Its machine learning capabilities are valuable, though the high cost needs improvement. Overall, it's crucial for detecting threats.
Cloud Engineer at Unicloud4.5In our AWS environment, GuardDuty offers strong automated protection using machine learning to quickly detect threats, such as brute force attacks. Its integration with AWS services keeps us informed, though a more insightful dashboard would enhance its usability.
Security and Compliance Architect at a manufacturing company with 1,001-5,000 employees4.5I use AWS GuardDuty for effective threat detection and monitoring of AWS accounts, containers, and Amazon S3 buckets. It needs updates to handle evolving threats, but it significantly improves incident prevention, offering early notifications and valuable ROI.
Solutions architect at University of Helsinki5.0AWS GuardDuty serves as a basic threat detection tool within AWS's vast portfolio. While not my primary focus, it's a good starting point for endpoint protection. For larger scale needs, I would consider AWS Shield or third-party solutions.