AWS GuardDuty vs Threat Stack Cloud Security Platform [EOL] comparison

Amazon Web Services (AWS) and F5 are both solutions in the Cloud Workload Protection Platforms (CWPP) category. Additionally, 91% of Amazon Web Services (AWS) users are willing to recommend the solution, compared to 88% of F5 users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jan 29, 2025

Threat Stack Cloud Security Platform [EOL] and AWS GuardDuty are competing in the cloud security domain. AWS GuardDuty seems to have the upper hand due to its superior features in automated threat detection and quick threat intelligence.

Features: Threat Stack Cloud Security Platform [EOL] offers comprehensive monitoring, intrusion detection, and deep security insights, beneficial for companies needing detailed analysis. AWS GuardDuty provides automated threat detection, quick threat intelligence, and efficient threat management, making it attractive for organizations prioritizing security efficiency.

Room for Improvement: Threat Stack Cloud Security Platform [EOL] could enhance its real-time threat analysis and expand integration capabilities beyond current platforms. Improved scalability options and a more user-friendly interface would also benefit users. AWS GuardDuty can improve by providing more detailed alert explanations, expanding support for non-AWS environments, and enhancing customer experience through clearer documentation.

Ease of Deployment and Customer Service: Threat Stack Cloud Security Platform [EOL] provides a straightforward deployment process with responsive customer support, suitable for businesses favoring ease of setup. AWS GuardDuty, seamlessly integrated within the AWS ecosystem, offers hassle-free deployment and benefits from AWS's extensive support network.

Pricing and ROI: Threat Stack Cloud Security Platform [EOL] offers competitive pricing with potential ROI through reduced security incidents. AWS GuardDuty's cost-effectiveness comes from a pay-as-you-go model, reducing upfront investment and offering strong ROI through efficient threat detection and response.

To learn more, read our detailed Cloud Workload Protection Platforms (CWPP) Report (Updated: February 2025).

Buyer's Guide

Cloud Workload Protection Platforms (CWPP)

February 2025

Download the complete report

Helped 839,422 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

SentinelOne Singularity Clo...

Featured Reviews

Andrew W

VP - Information Technology at a financial services firm with 201-500 employees

Tells us about vulnerabilities as well as their impact and helps to focus on real issues

Looking at all the different pieces, it has got everything we need. Some of the pieces we do not even use. For example, we do not have Kubernetes Security. We are not running any K8 clusters, so it is good for us. Overall, we find the solution to be fantastic. There can be additional education components. This may not be truly fair to them because of what the product is going for, but it would be great to see additional education for compliance. It is not a criticism of the tool per se, but anything to help non-development resources understand some of the complexities of the cloud is always appreciated. Any additional educational resources are always helpful for security teams, especially those without a development background.

Read full review

Terence Dube

AWS Cloud Engineer at Standard Telephones and Cables

Comprehensive threat detection simplifies security management

GuardDuty is limited to AWS environments. While incorporating Amazon Detective for detailed investigation can be useful, including more granular details in findings, such as specific user actions or historical comparisons, would be beneficial. Furthermore, managing global AWS environments requires setting up additional tools for viewing GuardDuty findings across multiple regions. A unified dashboard that aggregates findings across all regions without requiring manual aggregation could enhance convenience for users.

Read full review

Skyler Cain

Software Development Manager at Rent Dynamics

SecOps program for us, as a smaller company, is amazing; they know what to look for

They could give a few more insights into security groups and recommendations on how to be more effective. That's getting more into the AWS environment, specifically. I'm not sure if that's Threat Stack's plan or not, but I would like them to help us be efficient about how we're setting up security groups. They could recommend separation of VPCs and the like - really dig into our architecture. I haven't seen a whole lot of that and I think that's something that, right off the bat, could have made us smarter. Even as part of the SecOps Program, that could be helpful; a quick analysis. They're analyzing our whole infrastructure and saying, "You have one VPC and that doesn't make a lot of sense, that should be multiple VPCs and here's why." The architecture of the servers in whatever cloud-hosting provider you're on could be helpful. Other than that, they should continue to expand on their notifications and on what's a vulnerability. They do a great job of that and we want them to continue to do that. It would be cool, since the agent is already deployed and they know about the server, they know the IP address, and they know what vulnerability is there, for them to test the vulnerability and see if they can actually exploit it. Or, once we patch it, they could double-check that it can't be. I don't know how hard that would be to build. Thinking on it off the top off my head, it could be a little challenging but it could also be highly interesting. It would also be great if we could test a couple of other features like hammering a server with 100 login attempts and see what happens. Real test scenarios could be really helpful. That is probably more something close to what they do with the SOC 2 audit or the report. But more visualization of that, being able to test things out on our infrastructure to make sure we can or can't hit this box could be interesting.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Singularity Cloud's ability to create custom correlation searches and reduce noise is highly valuable."

"The offensive security where they do a fix is valuable. They go to a misconfiguration and provide detailed alerts on what could be there. They also provide a remediation feature where if we give the permission, they can also go and fix the issue."

"We like the platform and its response time. We also like that its console is user-friendly as well as modern and sleek."

"It has a user-friendly dashboard that I can access without any difficulty."

"The cooperative nature of SentinelOne has influenced our decision not to shift."

"The remediation process is good."

"The Offensive Security Engine, powered by impressive AI/ML capabilities, seamlessly integrates with cloud infrastructure to analyze data and provide optimal security solutions."

"The solution helped free other staff to work on other projects or other tasks. We basically just had to do a bunch of upfront configuring. With it, we do not have to spend as much time in the console."

More SentinelOne Singularity Cloud Security pros

"GuardDuty is extensive in terms of configuration and security compliance."

"We have over 1,000 employees, and we monitor their activity through AWS GuardDuty."

"Since our environment is cloud based and accessible from the internet, we like the ability to check where the user has logged in from and what kind of API calls that user is doing."

"The correlation back end is the solution's most valuable feature."

"AWS GuardDuty helps by providing continuous threat detection and signaling potential threats. Its most valuable feature is continuous monitoring. The tool's integration with other AWS services has improved security. It provides continuous monitoring and intelligent threat detection, quickly signaling any issues. I would rate this improvement a seven out of ten."

"It helps us detect brute-force attacks based on machine learning."

"What we found most valuable in Amazon GuardDuty is its threat detection feature, especially because we were monitoring a huge number of AWS accounts, so we needed a solution that would monitor for any kind of malicious activity. The monitoring aspect of the solution was great because it gave us timely notifications if and when anything happened, and Amazon GuardDuty helped keep us on our toes to make sure we took action right away."

More AWS GuardDuty pros

"An important feature of this solution is monitoring. Specifically, container monitoring."

"The rules are really great. They give us more visibility and control over what's being triggered. There's a large set of rules that come out-of-the-box. We can customize them and we can create our own rules based on the traffic patterns that we see."

"The number-one feature is the monitoring of interactive sessions on our Linux machines. We run an immutable environment, so that nothing is allowed to be changed in production... We're constantly monitoring to make sure that no one is violating that. Threat Stack is what allows us to do that."

"It has been quite helpful to have the daily alerts coming to my email, as well as the Sev 1 Alerts... We just went through a SOX audit and those were pivotal."

"We like the ability of the host security module to monitor the processes running on our servers to help us monitor activity."

"There has been a measurable decrease in the meantime to remediation... because we have so many different tech verticals already collated in one place, our ability to respond is drastically different than it used to be."

"With Threat Stack, we quickly identified some AWS accounts which had services that would potentially be exposed and were able to remediate them prior to release of products."

"Threat Stack has connectivity."

More Threat Stack Cloud Security Platform [EOL] pros

Cons

"When you find a vulnerability and resolve it, the same issue will not occur again. I want PingSafe to block the same vulnerability from appearing again. I want something like a playbook where the steps that we take to resolve an issue are repeated when that issue happens again."

"A two-month grace period for extended searches would be a valuable improvement."

"I used to work on AWS. At times, I would generate a normal bug in my system, and then I would check PingSafe. The alert used to come after about three and a half hours. It used to take that long to generate the alert about the vulnerability in my system. If a hacker attacks a system and PingSafe takes three to four hours to generate an alert, it will not be beneficial for the company. It would be helpful if we get the alert in five to ten minutes."

"I would like additional integrations."

"Customized queries should be made easier to improve PingSafe."

"In version 2, a lot of rules have been deployed for Kubernetes security and CDR, which makes a lot of issues of critical severity, whereas they are not critical or of high severity. There is a mismatch of severities."

"The could improve their mean time to detect."

"Whenever I view the processes and the process aspect, it takes a long time to load."

More SentinelOne Singularity Cloud Security cons

"Some of the pain points in Amazon GuardDuty was the cost. When compared to some of the other services, depending on how many we had to monitor, if we had a huge range of accounts, as our accounts increased, we had a cost factor that came into play. Sometimes there were issues, for example, with findings that came up, we wanted to add notes and there were issues back then where notes couldn't be entered properly. If we wanted to leave a note such as "Okay, we have assessed this and this is how we feel", or "This is a false positive", Amazon GuardDuty wasn't allowing us to do that. Even with the suppression of certain findings, there was some issue that we had faced at one time. Those were some of the pain points of the solution."

"For me, I would say just the presentation of findings, like the dashboards and other stuff, could be improved a bit."

"AWS GuardDuty needs to be more customer-oriented."

"Amazon GuardDuty could be better enriched in threat intelligence data."

"It would be great if the solution had some automation capabilities."

"The product needs to improve its cost-efficiency since it is expensive."

"Because it's a threat detection service, they need to keep up with the various threat factors because new threat factors and attack factors come up all the time."

"I work in a bank, and it would be good if AWS GuardDuty could be integrated with other monitoring and detection tools we use."

More AWS GuardDuty cons

"The one thing that we know they're working on, but we don't have through the tool, is the application layer. As we move to a serverless environment, with AWS Fargate or direct Lambda, that's where Threat Stack does not have the capacity to provide feed. Those are areas that it's blind to now..."

"I would like further support of Windows endpoint agents or the introduction of support for Windows endpoint agents."

"It shoots back a lot of alerts."

"The API - which has grown quite a bit, so we're still learning it and I can't say whether it still needs improvement - was an area that had been needing it."

"The reports aren't very good. We've automated the report generation via the API and replaced almost all the reports that they generate for us using API calls instead."

"The user interface can be a little bit clunky at times... There's a lot of information that needs to be waded through, and the UI just isn't great."

"The compliance and governance need improvement."

"The solution’s ability to consume alerts and data in third-party tools (via APIs and export into S3 buckets) is moderate. They have some work to do in that area... The API does not mimic the features of the UI as far as reporting and pulling data out go. There's a big discrepancy there."

More Threat Stack Cloud Security Platform [EOL] cons

Pricing and Cost Advice

"We have an enterprise license. It is affordable. I'm not sure, but I think we pay 150,000 rupees per month."

"The tool is cost-effective."

"It is cheap."

"The pricing is fair. It is not inexpensive, and it is also not expensive. When managing a large organization, it is going to be costly, but it meets the business needs. In terms of what is out there on the market, it is fair and comparable to what I have seen, so I do not have any complaints about the cost"

"SentinelOne offers excellent pricing and licensing options."

"As a partner, we receive a discount on the licenses."

"It is not that expensive. There are some tools that are double the cost of PingSafe. It is good on the pricing side."

"I wasn't sure what to expect from the pricing, but I was pleasantly surprised to find that it was a little less than I thought."

More SentinelOne Singularity Cloud Security pricing and cost advice

"The tool's licensing model is pay-as-you-go."

"Pricing is determined by the number of events sent."

"I prefer to have something on demand for myself. That's why I haven't been paying for GuardDuty specifically. AWS provides a wide range of offerings, especially in the security area."

"The platform is inexpensive."

"The tool has no subscription charges."

"We use a pay-as-you-use license, which is competitively priced in the market."

"It can get very expensive. If you turn on every feature, it can turn into hundreds of thousands of dollars."

"I don't have all the details in terms of licensing for Amazon GuardDuty, but my organization does have a license set up for it."

More AWS GuardDuty pricing and cost advice

"It is very expensive compared to some other products. The pricing is definitely high."

"Pricing seems to be in line with the market structure. It's fine."

"We find the licensing and pricing very easy to understand and a good value for the services provided."

"I'm happy with the amount that we spend for the product that we get and the overall service that we get. It's not cheap, but I'm still happy with the spend."

"What we're paying now is somewhere around $15 to $20 per agent per month, if I recall correctly. The other cost we have is SecOps."

"It is a cost-effective choice versus other solutions on the market."

"It came in cheaper than Trend Micro when we purchased it a few years ago."

See which vendors are best for you

Use our free recommendation engine to learn which Cloud Workload Protection Platforms (CWPP) solutions are best for your needs.

See recommendations

839,422 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

18%

Financial Services Firm

15%

Manufacturing Company

Government

Financial Services Firm

16%

Computer Software Company

15%

Manufacturing Company

Government

Computer Software Company

22%

Manufacturing Company

10%

Real Estate/Law Firm

10%

Financial Services Firm

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about PingSafe?

The dashboard gives me an overview of all the things happening in the product, making it one of the tool's best featu...

See all answers

What is your experience regarding pricing and costs for PingSafe?

SentinelOne is relatively cheap. If ten is the most expensive, I would rate it a seven.

See all answers

What needs improvement with PingSafe?

From my personal experience, the alerting system needs to be faster. If something happens in our infrastructure, the ...

See all answers

What do you like most about Amazon GuardDuty?

With anomaly detection, active threat monitoring, and set correlation, GuardDuty alerts me to any unusual user behavi...

See all answers

What is your experience regarding pricing and costs for Amazon GuardDuty?

GuardDuty is very cheap and operates on a pay-as-you-go basis. It's priced around a dollar per million requests, maki...

See all answers

What needs improvement with Amazon GuardDuty?

GuardDuty is limited to AWS environments. While incorporating Amazon Detective for detailed investigation can be usef...

See all answers

Ask a question

Earn 20 points

Comparisons

Wiz vs SentinelOne Singularity Cloud Security

Compared 24% of the time

Cortex Cloud by Palo Alto Networks vs SentinelOne Singularity Cloud Security

Compared 21% of the time

Microsoft Defender for Cloud vs SentinelOne Singularity Cloud Security

Compared 7% of the time

Orca Security vs SentinelOne Singularity Cloud Security

Compared 6% of the time

Check Point CloudGuard CNAPP vs SentinelOne Singularity Cloud Security

Compared 5% of the time

More SentinelOne Singularity Cloud Security Competitors

Microsoft Defender for Cloud vs AWS GuardDuty

Compared 48% of the time

CrowdStrike Falcon Cloud Security vs AWS GuardDuty

Compared 13% of the time

Wiz vs AWS GuardDuty

Compared 11% of the time

Cortex Cloud by Palo Alto Networks vs AWS GuardDuty

Compared 7% of the time

Lacework FortiCNAPP vs AWS GuardDuty

Compared 2% of the time

More AWS GuardDuty Competitors

Microsoft Defender for Cloud Apps vs Threat Stack Cloud Security Platform [EOL]

Compared 31% of the time

BMC Helix Cloud Security vs Threat Stack Cloud Security Platform [EOL]

Compared 25% of the time

Netskope vs Threat Stack Cloud Security Platform [EOL]

Compared 24% of the time

Cisco IOS Security vs Threat Stack Cloud Security Platform [EOL]

Compared 20% of the time

More Threat Stack Cloud Security Platform [EOL] Competitors

Product Reports

Buyer's Guide

SentinelOne Singularity Cloud Security

February 2025

SentinelOne Singularity Cloud Security report

Download SentinelOne Singularity Cloud Security product report

Buyer's Guide

AWS GuardDuty

March 2025

Download AWS GuardDuty product report

Buyer's Guide

Threat Stack Cloud Security Platform [EOL]

February 2025

Threat Stack Cloud Security Platform [EOL] report

Download Threat Stack Cloud Security Platform [EOL] product report

Also Known As

PingSafe

No data available

Threat Stack, CSP,

Overview

SentinelOne Singularity Cloud Security protects cloud workloads, offering advanced threat detection and automated response. It integrates seamlessly with cloud environments and secures containerized applications and virtual machines against vulnerabilities.

SentinelOne Singularity Cloud Security is renowned for its efficiency in mitigating threats in real-time. The platform integrates effortlessly with existing cloud environments, ensuring robust cloud security management with minimal manual intervention. Securing containerized applications and virtual machines, it excels in threat intelligence and endpoint protection. However, improvements are needed in performance during high workload periods, and more integrations with third-party tools and better documentation would be beneficial. Users often find the installation process complex, support response times slow, and the dashboard's navigation unintuitive.

What are the key features of SentinelOne Singularity Cloud Security?

Real-time Threat Detection: Identifies and mitigates threats as they occur.
Automated Response: Automatically responds to threats to minimize impact.
Ease of Deployment: Simple setup process with scalable options.
Machine Learning Insights: AI-driven insights enhance threat prevention.
Seamless Integration: Integrates with cloud environments for unified security management.

What are the primary benefits or ROI to expect from SentinelOne Singularity Cloud Security?

Enhanced Threat Mitigation: Improved security against real-time threats.
Reduced Manual Intervention: Automated processes save time and resources.
Scalability: Easily adapts to growing security requirements.
Centralized Management: Manage security across platforms from a single console.
Advanced Threat Intelligence: Provides in-depth analysis and protection.

In specific industries, SentinelOne Singularity Cloud Security is implemented to safeguard critical data and infrastructure. Organizations in finance, healthcare, and technology depend on its real-time threat detection and automated response to protect sensitive information. Its ability to secure containerized applications and virtual machines is particularly valuable in dynamic environments where rapid scaling is necessary.

SentinelOne

Amazon Guard Duty is a continuous cloud security monitoring service that consistently monitors and administers several data sources. These include AWS CloudTrail data events for EKS (Elastic Kubernetes Service) audit logs, VPC (Virtual Private Cloud) flow logs, DNS (Domain Name System) logs, S3 (Simple Cloud Storage), and AWS CloudTrail event logs.

Amazon GuardDuty intuitively uses threat intelligence data - such as lists of malicious domains and IP addresses - and ML (machine learning) to quickly discover suspicious and problematic activity in a user's AWS ecosystem. Activities may include concerns such as interactions with malicious IP addresses or domains, exposed credentials usage, or changes and/or escalation of privileges.

GuardDuty is able to easily determine problematic AWS EC2 (Elastic Compute Cloud) instances delivering malware or mining bitcoin. It is also able to trace AWS account access history for evidence of destabilization. such as suspicious API calls resulting in changing password policies to minimize password strength or anomalous infrastructure deployments in new or different never-used regions.

GuardDuty will continually alert users regarding their AWS environment status and will send the security discoveries to the GuardDuty dashboard or Amazon CloudWatch events for users to view.

Users can access GuardDuty via:

AWS SDKs: Amazon provides users with several software development kits (SDKs) that are made up of libraries and sample code of numerous popular programming languages and platforms, such as Android, iOS, Java, .Net, Python, and Ruby. The SDKs make it easier to develop programmatic access to GuardDuty.
GuardDuty HTTPS API: This allows users to issue HTTPS requests directly to the service.
GuardDuty Console: This is a browser-based intuitive dashboard interface where users can access and use GuardDuty.

Amazon Elastic Kubernetes Service (Amazon EKS)

Kubernetes protection is an optional add-on in Amazon GuardDuty. This tool is able to discover malicious behavior and possible destabilization of an organization's Kubernetes clusters inside of Amazon Elastic Kubernetes Service (Amazon EKS).

When Amazon EKS is activated, GuardDuty will actively use various data sources to discover potential risks against Kubernetes API. When Kubernetes protection is enabled, GuardDuty uses optional data sources to detect threats against Kubernetes API.

Kubernetes audit logs are a Kubernetes feature that captures historical API activity from applications, the control plane, users, and endpoints. GuardDuty collates these logs from Amazon EKS to create Kubernetes discoveries for the organization's Amazon EKS assets; there is no need to store or turn on the logs.

As long as Kubernetes protection remains activated, GuardDuty will continuously dissect Kubernetes data sources from the Amazon EKS clusters to ensure no suspicious or anomalous behavior is taking place.

Amazon Simple Cloud Storage (S3) Protection

Amazon S3 allows Amazon GuardDuty to actively audit object-level API processes to discover possible security threats to data inside an organization's S3 buckets. GuardDuty continually audits risk to the organization’s S3 assets by carefully dissecting AWS CloudTrail management events and AWS CloudTrail S3 data events. These tools are continually auditing various CloudTrail management events for potential suspicious activities that affect S3 buckets, such as PutBucketReplication, DeleteBucket, ListBucket, and data events for S3 object-level API processes, such as PutObject, GetObject, ListObject, and DeleteObject.

Reviews from Real Users

“The most valuable features are the single system for data collection and the alert mechanisms. Prior to using GuardDuty, we had multiple systems to collect data and put it in a centralized location so we could look into it. Now we don't need to do that anymore as GuardDuty does it for us.” - Arunkumar A., Information Security Manager at Tata Consultancy Services

Amazon Web Services (AWS)

Threat Stack Cloud Security Platform [EOL] offers robust security features including endpoint monitoring, rule customization, and integration capabilities, with easy connectivity to cloud services like Docker and AWS.

Threat Stack Cloud Security Platform [EOL] provides tools for enhancing security visibility across cloud infrastructure. It supports AWS and Docker integration, facilitating efficient threat detection and management. Users appreciate its capability to configure customizable alerts and monitor endpoints, sessions, API interactions, and cloud services. However, there are areas needing improvement, such as better serverless environment support and reduced alert frequency. The platform services smaller organizations by compensating for limited security resources with its comprehensive monitoring and auditing tools.

What are the key features?

Easy Cloud Service Integration: Streamlined connectivity with Docker and AWS for efficient monitoring.
Customizable Rule Sets: Tailor security rules to meet specific organizational needs.
Email Alerts: Receive timely notifications about security events and threats.
Interactive Session Monitoring: Track live sessions for suspicious activities.
API Integration: Connect effortlessly with third-party tools for an enhanced security posture.
SecOps Support: Assistance for organizations lacking dedicated security teams.

What are the benefits and ROI features?

Streamlined Threat Detection: Effective process monitoring to identify potential threats.
Cost Efficiency: Serves companies with limited resources by providing essential security functions.
Comprehensive Audits: Helps in regular examinations of cloud infrastructure, enhancing compliance.
Visibility into Cloud Operations: Offers a detailed dashboard for threat visibility and monthly vulnerability assessments.

In specific industries, Threat Stack Cloud Security Platform [EOL] is utilized for its strength in monitoring cloud infrastructure and preventing unauthorized access. Organizations in fields where cloud operations are critical use it for regular audits and monitoring. Its capabilities in threat management are leveraged to maintain secure operations and compliance, especially where there is no dedicated security team.

Sample Customers

Information Not Available

autodesk, mapbox, fico, webroot

StatusPage.io, Walkbase, Spanning, DNAnexus, Jobcase, Nextcapital, Smartling, Veracode, 6sense

Buyer's Guide

Cloud Workload Protection Platforms (CWPP)

February 2025

Download Free Report

Find out what your peers are saying about Palo Alto Networks, Wiz, Microsoft and others in Cloud Workload Protection Platforms (CWPP). Updated: February 2025.

DOWNLOAD NOW

839,422 professionals have used our research since 2012.

See our list of best Cloud Workload Protection Platforms (CWPP) vendors.

We monitor all Cloud Workload Protection Platforms (CWPP) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.