AWS GuardDuty vs Check Point CloudGuard CNAPP comparison

Amazon Web Services (AWS) and Check Point Software Technologies are both solutions in the Cloud Workload Protection Platforms (CWPP) category. Amazon Web Services (AWS) is ranked #5 with an average rating of 8.4, while Check Point Software Technologies is ranked #6 with an average rating of 8.6. Amazon Web Services (AWS) holds a 9.2% mindshare in CWPP, compared to Check Point Software Technologies’s 2.5% mindshare. Additionally, 91% of Amazon Web Services (AWS) users are willing to recommend the solution, compared to 94% of Check Point Software Technologies users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jan 12, 2025

Check Point CloudGuard CNAPP and AWS GuardDuty compete in cloud security, offering unique solutions. Check Point CloudGuard holds an advantage in multi-cloud environments and compliance management, while AWS GuardDuty excels in AWS-specific threat detection.

Features: Check Point CloudGuard CNAPP offers centralized security management, compliance features, and support for multi-cloud environments including AWS and Azure. AWS GuardDuty uses machine learning and anomaly detection to identify threats, with integration capabilities for various AWS services, enhancing threat detection specifically for AWS environments.

Room for Improvement: Users of Check Point CloudGuard CNAPP seek better integration with third-party tools, enhanced support for on-premise and VMware environments, and improvements in false positives and policy validation. AWS GuardDuty could improve through cost efficiency, better integration with AWS services, and improved dashboards for insight visualization.

Ease of Deployment and Customer Service: Check Point CloudGuard CNAPP is known for user-friendly deployment across various cloud models, including hybrid and private clouds, and provides responsive technical support. AWS GuardDuty is appreciated for seamless deployment in public cloud environments and robust support, though Check Point users report slower technical support response times compared to AWS.

Pricing and ROI: Check Point CloudGuard CNAPP is considered expensive, using a cloud asset management-based licensing model but provides ROI through time savings and reduced human errors. AWS GuardDuty offers a pay-as-you-go model, cost-effective for smaller deployments, but costs can increase with higher usage. Both offer enhanced security ROI, with CloudGuard CNAPP providing a more comprehensive security approach across multiple clouds, while GuardDuty focuses on AWS environments.

To learn more, read our detailed AWS GuardDuty vs. Check Point CloudGuard CNAPP Report (Updated: January 2025).

Buyer's Guide

AWS GuardDuty vs. Check Point CloudGuard CNAPP

January 2025

Download the complete report

Helped 838,640 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

SentinelOne Singularity Clo...

Mindshare comparison

As of February 2025, in the Cloud Workload Protection Platforms (CWPP) category, the mindshare of SentinelOne Singularity Cloud Security is 2.2%, up from 0.8% compared to the previous year. The mindshare of AWS GuardDuty is 9.2%, down from 9.8% compared to the previous year. The mindshare of Check Point CloudGuard CNAPP is 2.5%, down from 2.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Cloud Workload Protection Platforms (CWPP)

Featured Reviews

Andrew W

VP - Information Technology at a financial services firm with 201-500 employees

Tells us about vulnerabilities as well as their impact and helps to focus on real issues

Looking at all the different pieces, it has got everything we need. Some of the pieces we do not even use. For example, we do not have Kubernetes Security. We are not running any K8 clusters, so it is good for us. Overall, we find the solution to be fantastic. There can be additional education components. This may not be truly fair to them because of what the product is going for, but it would be great to see additional education for compliance. It is not a criticism of the tool per se, but anything to help non-development resources understand some of the complexities of the cloud is always appreciated. Any additional educational resources are always helpful for security teams, especially those without a development background.

Read full review

Terence Dube

AWS Cloud Engineer at Standard Telephones and Cables

Comprehensive threat detection simplifies security management

GuardDuty is limited to AWS environments. While incorporating Amazon Detective for detailed investigation can be useful, including more granular details in findings, such as specific user actions or historical comparisons, would be beneficial. Furthermore, managing global AWS environments requires setting up additional tools for viewing GuardDuty findings across multiple regions. A unified dashboard that aggregates findings across all regions without requiring manual aggregation could enhance convenience for users.

Read full review

Bart Coddens

Cloud Engineer at Cloudar

Evolved cloud security with active monitoring but needs interface consistency

The user interface needs work. Sometimes, it is a transition from the old tool to the new CNAPP Two that I currently have, and remnants of the old environment can still be detected. I require consistency in the user interface to ensure everything is streamlined into the same look and feel. More work is needed in fine-tuning the threat data towards your CSPM and activity logs, aligning them with business intelligence, which requires a cohesive console interface. My assessment of CloudGuard CDRs in intrusion detection and threat hunting capabilities is that it still needs some work. All the threat data that comes in, you need to fine tune it a bit.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Its performance impact on the systems is low, which means there is a minimal impact on system performance compared to traditional antivirus solutions."

"As a frequently audited company, we value PingSafe's compliance monitoring features. They give us a report with a compliance score for how well we meet certain regulatory standards, like HIPAA. We can show our compliance as a percentage. It's also a way to show that we are serious about security."

"PingSafe's most valuable feature is its unified console."

"Singularity Cloud Security offers autonomous response capabilities, automatically remediating threats and restoring affected files without manual intervention."

"Support has been very helpful and provides regular feedback and help whenever needed. They've been very useful."

"The offensive security where they do a fix is valuable. They go to a misconfiguration and provide detailed alerts on what could be there. They also provide a remediation feature where if we give the permission, they can also go and fix the issue."

"It is pretty easy to integrate with this platform. When properly integrated, it monitors end-to-end."

"The management console is highly intuitive to comprehend and operate."

More SentinelOne Singularity Cloud Security pros

"It is a highly scalable solution since it is a service by AWS. Scalability-wise, I rate the solution a ten out of ten."

"GuardDuty's comprehensive threat detection does not only monitor data - it also detects a wide range of security threats."

"The solution will detect abnormalities in the AWS workload and alert us so that we can monitor and take action."

"Since our environment is cloud based and accessible from the internet, we like the ability to check where the user has logged in from and what kind of API calls that user is doing."

"The out-of-band malware detection from the EBS volumes. It's really cool. No agents or anything needed, it automatically finds and correlates based on malware."

"AWS GuardDuty helps by providing continuous threat detection and signaling potential threats. Its most valuable feature is continuous monitoring. The tool's integration with other AWS services has improved security. It provides continuous monitoring and intelligent threat detection, quickly signaling any issues. I would rate this improvement a seven out of ten."

"The product has automated protection powered by AI/ML, which is now far more powerful than before. It uses AI/ML in its detection algorithm, providing fast and quick results."

"The correlation back end is the solution's most valuable feature."

More AWS GuardDuty pros

"It provides critical insights that enable the IT team to plan and launch smart investigations when there are security breaches."

"The ability to drill down to individual hosts on an account and see which ones are affected is valuable."

"Cloud security posture management is the feature we've been using the longest."

"The posture management and remediation features are the most valuable. We use GSL Builder to build custom rules in alignment with our organization's policies. CloudGuard has canned rules using multiple standard frameworks, but we also have additional rules."

"The administration portal panel is very intuitive."

"It offers a range of features tailored to address the unique security challenges."

"Dome9 wraps our FTP infrastructure with its network security configurations, and this also gives us the ability to monitor FTP activity."

"It's helped with misconfigurations."

More Check Point CloudGuard CNAPP pros

Cons

"The recommended actions aren't always specific, so it might suggest recommendations that don't apply to the particular infrastructure code I'm reviewing."

"They need more experienced support personnel."

"Some of the navigation and some aspects of the portal may be a little bit confusing."

"SentinelOne currently lacks a break glass account feature, which is critical for implementing Single Sign-On."

"The integration with Oracle has room for improvement."

"The areas with room for improvement include the cost, which is higher compared to other security platforms. The dashboard can also be laggy."

"I would like PingSafe to add real-time detection of vulnerabilities and cloud misconfigurations."

"There can be a specific type of alert showing that a new type of risk has been identified."

More SentinelOne Singularity Cloud Security cons

"The solution has to be integrated with new services that AWS adds like QuickSight, Managed Airflow, AppFlow and MWAA."

"I work in a bank, and it would be good if AWS GuardDuty could be integrated with other monitoring and detection tools we use."

"Because it's a threat detection service, they need to keep up with the various threat factors because new threat factors and attack factors come up all the time."

"Amazon GuardDuty could be better enriched in threat intelligence data."

"AWS GuardDuty needs to be more customer-oriented."

"I would like to see more integration with other AWS provided services."

"Some of the pain points in Amazon GuardDuty was the cost. When compared to some of the other services, depending on how many we had to monitor, if we had a huge range of accounts, as our accounts increased, we had a cost factor that came into play. Sometimes there were issues, for example, with findings that came up, we wanted to add notes and there were issues back then where notes couldn't be entered properly. If we wanted to leave a note such as "Okay, we have assessed this and this is how we feel", or "This is a false positive", Amazon GuardDuty wasn't allowing us to do that. Even with the suppression of certain findings, there was some issue that we had faced at one time. Those were some of the pain points of the solution."

"The solution's user interface could be improved because it will help users to understand multiple options."

More AWS GuardDuty cons

"When rules change, it messes up the remediation. They haven't found a fix for that yet. The remediation rule goes into limbo. It's an architectural design flaw within their end compliance engine—a serious bug."

"Automatic remediation requires read/write access. When providing read/write access to third-party applications, this can add risk. It should have some options of triggering API calls to the cloud platform, which in turn, can make the required changes."

"The integration process could be enhanced by enabling integration at the organizational level rather than requiring the manual setup of individual accounts."

"I’d like to see more integration with third-party tools. For example, it would be helpful to have an integration between Dome9 and ServiceNow to manage security incidents and security changes."

"Almost all features are good, however, they still require improvements to the code security portion on which integration with the major source code repository is required."

"I would like to see tighter integration with other compliance tools, like Chef Compliance, in addition to Inspector."

"Adding a feature that allows me to easily identify the changes that have been made to the CIS benchmark and update my own policy accordingly would be a valuable addition to Check Point CloudGuard Posture Management."

"Reporting should have more options."

More Check Point CloudGuard CNAPP cons

Pricing and Cost Advice

"SentinelOne offers excellent pricing and licensing options."

"PingSafe is affordable."

"While SentinelOne Singularity Cloud Security offers robust protection, its high cost may be prohibitive for small and medium-sized businesses."

"Its pricing was a little less than other providers."

"It is cheap."

"The pricing is somewhat high compared to other market tools."

"The price depends on the extension of the solution that you want to buy. If you want to buy just EDR, the price is less. XDR is a little bit more expensive. There are going to be different add-ons for Singularity."

"SentinelOne is relatively cheap. If ten is the most expensive, I would rate it a seven."

More SentinelOne Singularity Cloud Security pricing and cost advice

"GuardDuty only enables accounts in regions where you have an active workload. If there are places where you don't have an active workload, you wouldn't even enable them. That's one area where they could allow you to cut down your cost."

"It can get very expensive. If you turn on every feature, it can turn into hundreds of thousands of dollars."

"We use a pay-as-you-use license, which is competitively priced in the market."

"The tool's licensing model is pay-as-you-go."

"The platform is inexpensive."

"I have heard that the solution's price is quite high."

"I don't have all the details in terms of licensing for Amazon GuardDuty, but my organization does have a license set up for it."

"The price of the solution is exactly right."

More AWS GuardDuty pricing and cost advice

"Everything in this field is very expensive."

"Its price is very fair."

"The price is on the higher end."

"The licensing and costs are straightforward, as they have a baseline of 100 workloads (number of instances) within one license with no additional nor hidden charges. If you want to have 200 workloads under Dome9, then you need to take out two licenses for that. Also, it does not have any impact on cloud billing, as data is shared using the API call. This is well within the limit of free API calls provided by the cloud provider."

"From a pricing perspective, they are pretty expensive."

"Right now, we have licenses on 500 machines, and they are not cheap."

"It is a very straightforward licensing model that is based on the number of assets you are discovering and managing with the solution."

"The license for CloudGuard Posture Management is about $80 a year, and it's based on your cloud footprint, not the number of users. So you could have a million users, and it doesn't matter."

More Check Point CloudGuard CNAPP pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Cloud Workload Protection Platforms (CWPP) solutions are best for your needs.

See recommendations

838,640 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

18%

Financial Services Firm

15%

Manufacturing Company

Government

Financial Services Firm

16%

Computer Software Company

15%

Manufacturing Company

Government

Computer Software Company

15%

Financial Services Firm

14%

Manufacturing Company

University

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about PingSafe?

The dashboard gives me an overview of all the things happening in the product, making it one of the tool's best featu...

See all answers

What is your experience regarding pricing and costs for PingSafe?

SentinelOne is relatively cheap. If ten is the most expensive, I would rate it a seven.

See all answers

What needs improvement with PingSafe?

From my personal experience, the alerting system needs to be faster. If something happens in our infrastructure, the ...

See all answers

What do you like most about Amazon GuardDuty?

With anomaly detection, active threat monitoring, and set correlation, GuardDuty alerts me to any unusual user behavi...

See all answers

What is your experience regarding pricing and costs for Amazon GuardDuty?

GuardDuty is very cheap and operates on a pay-as-you-go basis. It's priced around a dollar per million requests, maki...

See all answers

What needs improvement with Amazon GuardDuty?

GuardDuty is limited to AWS environments. While incorporating Amazon Detective for detailed investigation can be usef...

See all answers

What do you like most about Check Point CloudGuard Posture Management?

The visibility in our cloud environment is the most valuable feature.

See all answers

What is your experience regarding pricing and costs for Check Point CloudGuard Posture Management?

The price is on the higher end.

See all answers

What needs improvement with Check Point CloudGuard Posture Management?

We have concerns regarding the pricing and would appreciate seeing some improvements.

See all answers

Comparisons

Wiz vs SentinelOne Singularity Cloud Security

Compared 25% of the time

Cortex Cloud by Palo Alto Networks vs SentinelOne Singularity Cloud Security

Compared 22% of the time

Microsoft Defender for Cloud vs SentinelOne Singularity Cloud Security

Compared 7% of the time

Orca Security vs SentinelOne Singularity Cloud Security

Compared 6% of the time

Aqua Cloud Security Platform vs SentinelOne Singularity Cloud Security

Compared 3% of the time

More SentinelOne Singularity Cloud Security Competitors

Microsoft Defender for Cloud vs AWS GuardDuty

Compared 49% of the time

CrowdStrike Falcon Cloud Security vs AWS GuardDuty

Compared 13% of the time

Wiz vs AWS GuardDuty

Compared 11% of the time

Cortex Cloud by Palo Alto Networks vs AWS GuardDuty

Compared 7% of the time

Lacework FortiCNAPP vs AWS GuardDuty

Compared 2% of the time

More AWS GuardDuty Competitors

Cortex Cloud by Palo Alto Networks vs Check Point CloudGuard CNAPP

Compared 24% of the time

Wiz vs Check Point CloudGuard CNAPP

Compared 20% of the time

Microsoft Defender for Cloud vs Check Point CloudGuard CNAPP

Compared 9% of the time

Cloudflare vs Check Point CloudGuard CNAPP

Compared 5% of the time

Orca Security vs Check Point CloudGuard CNAPP

Compared 4% of the time

More Check Point CloudGuard CNAPP Competitors

Product Reports

Buyer's Guide

SentinelOne Singularity Cloud Security

January 2025

SentinelOne Singularity Cloud Security report

Download SentinelOne Singularity Cloud Security product report

Buyer's Guide

AWS GuardDuty

February 2025

Download AWS GuardDuty product report

Buyer's Guide

Check Point CloudGuard CNAPP

February 2025

Download Check Point CloudGuard CNAPP product report

Also Known As

PingSafe

No data available

Check Point CloudGuard Posture Management, Dome9, Check Point CloudGuard Workload Protection, Check Point CloudGuard Intelligence

Overview

SentinelOne Singularity Cloud Security protects cloud workloads, offering advanced threat detection and automated response. It integrates seamlessly with cloud environments and secures containerized applications and virtual machines against vulnerabilities.

SentinelOne Singularity Cloud Security is renowned for its efficiency in mitigating threats in real-time. The platform integrates effortlessly with existing cloud environments, ensuring robust cloud security management with minimal manual intervention. Securing containerized applications and virtual machines, it excels in threat intelligence and endpoint protection. However, improvements are needed in performance during high workload periods, and more integrations with third-party tools and better documentation would be beneficial. Users often find the installation process complex, support response times slow, and the dashboard's navigation unintuitive.

What are the key features of SentinelOne Singularity Cloud Security?

Real-time Threat Detection: Identifies and mitigates threats as they occur.
Automated Response: Automatically responds to threats to minimize impact.
Ease of Deployment: Simple setup process with scalable options.
Machine Learning Insights: AI-driven insights enhance threat prevention.
Seamless Integration: Integrates with cloud environments for unified security management.

What are the primary benefits or ROI to expect from SentinelOne Singularity Cloud Security?

Enhanced Threat Mitigation: Improved security against real-time threats.
Reduced Manual Intervention: Automated processes save time and resources.
Scalability: Easily adapts to growing security requirements.
Centralized Management: Manage security across platforms from a single console.
Advanced Threat Intelligence: Provides in-depth analysis and protection.

In specific industries, SentinelOne Singularity Cloud Security is implemented to safeguard critical data and infrastructure. Organizations in finance, healthcare, and technology depend on its real-time threat detection and automated response to protect sensitive information. Its ability to secure containerized applications and virtual machines is particularly valuable in dynamic environments where rapid scaling is necessary.

SentinelOne

Amazon Guard Duty is a continuous cloud security monitoring service that consistently monitors and administers several data sources. These include AWS CloudTrail data events for EKS (Elastic Kubernetes Service) audit logs, VPC (Virtual Private Cloud) flow logs, DNS (Domain Name System) logs, S3 (Simple Cloud Storage), and AWS CloudTrail event logs.

Amazon GuardDuty intuitively uses threat intelligence data - such as lists of malicious domains and IP addresses - and ML (machine learning) to quickly discover suspicious and problematic activity in a user's AWS ecosystem. Activities may include concerns such as interactions with malicious IP addresses or domains, exposed credentials usage, or changes and/or escalation of privileges.

GuardDuty is able to easily determine problematic AWS EC2 (Elastic Compute Cloud) instances delivering malware or mining bitcoin. It is also able to trace AWS account access history for evidence of destabilization. such as suspicious API calls resulting in changing password policies to minimize password strength or anomalous infrastructure deployments in new or different never-used regions.

GuardDuty will continually alert users regarding their AWS environment status and will send the security discoveries to the GuardDuty dashboard or Amazon CloudWatch events for users to view.

Users can access GuardDuty via:

AWS SDKs: Amazon provides users with several software development kits (SDKs) that are made up of libraries and sample code of numerous popular programming languages and platforms, such as Android, iOS, Java, .Net, Python, and Ruby. The SDKs make it easier to develop programmatic access to GuardDuty.
GuardDuty HTTPS API: This allows users to issue HTTPS requests directly to the service.
GuardDuty Console: This is a browser-based intuitive dashboard interface where users can access and use GuardDuty.

Amazon Elastic Kubernetes Service (Amazon EKS)

Kubernetes protection is an optional add-on in Amazon GuardDuty. This tool is able to discover malicious behavior and possible destabilization of an organization's Kubernetes clusters inside of Amazon Elastic Kubernetes Service (Amazon EKS).

When Amazon EKS is activated, GuardDuty will actively use various data sources to discover potential risks against Kubernetes API. When Kubernetes protection is enabled, GuardDuty uses optional data sources to detect threats against Kubernetes API.

Kubernetes audit logs are a Kubernetes feature that captures historical API activity from applications, the control plane, users, and endpoints. GuardDuty collates these logs from Amazon EKS to create Kubernetes discoveries for the organization's Amazon EKS assets; there is no need to store or turn on the logs.

As long as Kubernetes protection remains activated, GuardDuty will continuously dissect Kubernetes data sources from the Amazon EKS clusters to ensure no suspicious or anomalous behavior is taking place.

Amazon Simple Cloud Storage (S3) Protection

Amazon S3 allows Amazon GuardDuty to actively audit object-level API processes to discover possible security threats to data inside an organization's S3 buckets. GuardDuty continually audits risk to the organization’s S3 assets by carefully dissecting AWS CloudTrail management events and AWS CloudTrail S3 data events. These tools are continually auditing various CloudTrail management events for potential suspicious activities that affect S3 buckets, such as PutBucketReplication, DeleteBucket, ListBucket, and data events for S3 object-level API processes, such as PutObject, GetObject, ListObject, and DeleteObject.

Reviews from Real Users

“The most valuable features are the single system for data collection and the alert mechanisms. Prior to using GuardDuty, we had multiple systems to collect data and put it in a centralized location so we could look into it. Now we don't need to do that anymore as GuardDuty does it for us.” - Arunkumar A., Information Security Manager at Tata Consultancy Services

Amazon Web Services (AWS)

Check Point CloudGuard CNAPP is a cloud-native application protection platform designed to secure your cloud environments and applications. By combining CSPM, CWPP, CSNS, and WAF capabilities, it provides a comprehensive solution to protect your cloud environment from a wide range of threats.

CloudGuard CNAPP delivers end-to-end cloud security, including workload protection, vulnerability management, and identity management, all while maintaining continuous compliance. It uses advanced AI to detect and prevent threats, offering protection for containers, serverless applications, and APIs. CloudGuard CNAPP also emphasizes simplifying security management, integrating directly with cloud platforms like AWS, Azure, and GCP.

CloudGuard CNAPP provides customers with more context to drive actionable security and smarter prevention, from code-to-cloud, across the application lifecycle. More Context Means Actionable Security, Smarter Prevention. The primary components are:

Unified & Modular Platform - A single platform unifying SAST, CSPM, DSPM, CIEM, CWPP, WAF, and Cloud Detection and Response.
Continuous Cloud Security - Automatic enforcement of security requirements and internal policies from development to runtime.
Real-time Detection & Protection - Real-time incidents and vulnerability detection with a single-click or automated remediation.

What are the key features of CloudGuard CNAPP?

Workload Protection: Secures cloud-based workloads, including VMs, containers, and serverless functions, from vulnerabilities and attacks.
Posture Management: Continuously monitors cloud configurations and assets to ensure compliance with security standards and policies.
Threat Prevention: Uses AI-driven threat detection to block malware, ransomware, and zero-day exploits in real-time.
Compliance Automation: Automates compliance checks and ensures adherence to industry regulations, such as GDPR, HIPAA, and PCI-DSS.
Identity and Access Management (IAM) Protection: Secures identities by managing access policies and detecting misconfigurations in permissions.

What are the key benefits to consider?

Improved Cloud Visibility: Provides clear insights into cloud environments, assets, and workloads, helping teams detect misconfigurations and vulnerabilities early.
Risk Reduction: Threat prevention features help reduce the risk of breaches by identifying and blocking potential attacks before they can exploit system weaknesses.
Operational Efficiency: Automated compliance and posture management reduce the manual work needed to maintain security standards.
Multi-cloud Support: CloudGuard CNAPP integrates across AWS, Azure, and Google Cloud, streamlining security operations for hybrid and multi-cloud deployments.

Check Point CloudGuard CNAPP simplifies cloud security management with integrated protection and automation.

Check Point Software Technologies

Sample Customers

Information Not Available

autodesk, mapbox, fico, webroot

Symantec, Citrix, Car and Driver, Virgin, Cloud Technology Partners

Buyer's Guide

AWS GuardDuty vs. Check Point CloudGuard CNAPP

January 2025

Free Report: AWS GuardDuty vs. Check Point CloudGuard CNAPP

Find out what your peers are saying about AWS GuardDuty vs. Check Point CloudGuard CNAPP and other solutions. Updated: January 2025.

DOWNLOAD NOW

838,640 professionals have used our research since 2012.

See our AWS GuardDuty vs. Check Point CloudGuard CNAPP report.

See our list of best Cloud Workload Protection Platforms (CWPP) vendors.

We monitor all Cloud Workload Protection Platforms (CWPP) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.