AWS Security Hub vs Microsoft Defender XDR comparison

The compared Amazon Web Services (AWS) and Microsoft solutions aren't in the same category. Amazon Web Services (AWS) is ranked #12 in CSPM , with an average rating of 7.8, and holds a 2.8% mindshare in the category. Microsoft is ranked #4 in XDR , with an average rating of 8.3, and holds a 4.5% mindshare. Additionally, 89% of Amazon Web Services (AWS) users are willing to recommend the solution, compared to 98% of Microsoft users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between AWS Security Hub and Microsoft Defender XDR based on real PeerSpot user reviews.

Find out in this report how the two Cloud Security Posture Management (CSPM) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed AWS Security Hub vs. Microsoft Defender XDR Report (Updated: May 2023).

Buyer's Guide

AWS Security Hub vs. Microsoft Defender XDR

May 2023

Download the complete report

Helped 896,099 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Qualys TotalCloud

Mindshare comparison

Cloud Security Posture Management (CSPM) Mindshare Distribution
Product	Mindshare (%)
AWS Security Hub	2.8%
Wiz	11.4%
Prisma Cloud by Palo Alto Networks	8.3%
Other	77.5%

Cloud Security Posture Management (CSPM)

Extended Detection and Response (XDR) Mindshare Distribution
Product	Mindshare (%)
Microsoft Defender XDR	4.5%
CrowdStrike Falcon	9.4%
SentinelOne Singularity Endpoint	5.9%
Other	80.2%

Extended Detection and Response (XDR)

Featured Reviews

Robert Orłowski

IT Security Expert at Alior Bank S.A.

Unified risk scoring has improved our cloud visibility and simplifies remediation priorities

Qualys TotalCloud provides unified vulnerability and threat assessment across both IAS and SaaS. This solution provides a single prioritized view of risk, which helps reduce the work I would have to do. We are no longer based on CVSS; we are based on Qualys risk scoring, which is based on CVSS plus internal findings made by Qualys, and then assigns its own score. The TruRisk insight feature has found a small number of assets with high vulnerability scores, though I am cautious since some information is classified. Qualys TotalCloud has positively impacted our bank's performance, and we have definitely seen benefits after implementing this solution.

Read full review

Karthik Ekambaram

Director at Scybers

Has helped identify misconfigurations and prioritize risks but lacks multi-cloud support and deeper integration features

AWS Security Hub cannot scale up to multiple different cloud environments; it only works for AWS. There are other products in the market for CSPM that can give you multi-cloud environment misconfigurations, even Microsoft for that matter. Regarding the integration of AWS Security Hub with third-party tools, I am not certain whether we can integrate them, but there is no need to do so. However, AWS Security Hub cannot integrate with other cloud providers, so it only supports the AWS environment. The compliance checks within AWS Security Hub are good, but we don't use them much. We utilize compliance frameworks such as CIS compliance frameworks and ISO 27017 framework, which are beneficial, but it can improve in other areas too, such as including NIST and other frameworks beyond just ISO and CIS. Improvements can be applicable for scalability, particularly on integration with multi-cloud environments, and compliance frameworks can be added for more variety as well. The unified dashboard in AWS Security Hub is adequate; I cannot say it is exceptional, but the content available in the dashboards is satisfactory for now.

Read full review

reviewer2812758

Infosec at a government with 10,001+ employees

Integrated defenses have unified threat hunting, phishing simulations, and identity investigations

I appreciate Microsoft Defender XDR's MDE, Microsoft Defender tool, which has Attack Simulator. Instead of doing a phishing campaign and getting a separate tool, Microsoft Defender XDR does it all. These features of Microsoft Defender XDR have helped us conduct a phishing campaign quarterly, which has been beneficial. I also appreciate the fact that it has Defender for Office integrated, Defender for Identity, and everything integrated together. I would describe the process of using Microsoft Defender XDR to prioritize incidents in my security operations as quite decent. I appreciate the automatic alerting system where any incidents or alerts we receive come directly to our email. From there, we can open the email, go directly to Microsoft Defender XDR, and start our investigations and remediations. I perceive the integration of security and identity access management in Microsoft Defender XDR as affecting my identity protection strategies very well because it is well integrated with Purview, integrated well with Entra ID, and integrated well with Exchange. I especially appreciate MDO, the Office product. If anything happens and I want to conduct an investigation, it takes me directly to Exchange, where I can also investigate any emails or phishing incidents. Instead of going to different portals, everything can be done from Microsoft Defender XDR. If necessary for further investigation, Microsoft Defender XDR then directs me to that environment. I would assess the integration of AI in guiding security actions within Microsoft Defender XDR as quite positive. Recently, Security Copilot went big, and it is beneficial that I can use that, especially to write KQL. I can do threat hunting features and intelligence all within using Microsoft's Security Copilot. It also has a nice AI feature for threat hunting. I know that all the Defender logs go to Sentinel, and I can pull it up from Microsoft Defender XDR or from Sentinel. The fact that I can actually do all that within Microsoft Defender XDR is a nice feature. In the top module, I can do threat lookups, and I can actually type KQLs in Microsoft Defender XDR and look up incidents. Predictive shielding has had a nice impact on my proactive security measures. It is beneficial that it has, similar to Entra ID, a secure score. For me to improve the product, the secure score helps me out. If I rate it from highest to lowest, I can see what things I can improve. Secure score helps me see what areas I can improve in Microsoft Defender XDR to increase my score and bring it to 80 or more. Knowing Microsoft Defender XDR from using it since 2019, before COVID days, I know that they have improved significantly. It is much more user-friendly and has a very nice vulnerability feature that I find handy and useful. The fact that this feature integrates into Intune is also very decent.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"In my opinion, this is the best tool."

"CSPM is currently the most used feature, and we are enjoying the new feature, FlexScan, which is valuable for Internet-facing VMs."

"TotalCloud provides the easiest and the best approach for cloud infrastructure management."

"I like the web API security and IoT scanning features the most. The user-friendly design of TotalCloud's interface enables customers to navigate it and use its full potential easily"

"I would definitely recommend Qualys TotalCloud to other customers."

"I appreciate TotalCloud's real-time protection and remediation features. The remediation options include automated one-click remedies and custom changes that help manage vulnerabilities efficiently."

"Qualys TotalCloud's most valuable feature is its agent versatility."

"Qualys TotalCloud has positively impacted our bank's performance, and we have definitely seen benefits after implementing this solution."

More Qualys TotalCloud pros

"Easily integrates with third-party tools"

"Security Hub provides insightful information about what is running and where there might be weaknesses."

"The advantage is that it is cloud-native, and we do not need to install agents or sensors to find findings."

"Very good at detection and providing real-time alerts."

"This solution is for security posture management for the cloud, showing the security posture of your cloud infrastructure and giving you good insight into whether your infrastructure is secure or not."

"The solution is very good at detection and providing real-time alerts."

"I find all of the features to be highly valuable."

"Finding out if your infrastructure is secure is a valuable feature."

More AWS Security Hub pros

"The best feature is probably the alert generation. When I do a security reset, the other session triggers instantly from the Defender console, and I can work on it. The policies are three times, but they are also ready to install it."

"The integration between all the Defender products is the most valuable feature."

"The product is very easy to use."

"Microsoft Defender is very stable, and you can see that there is a 99.9% success rate when they give us good service."

"The threat intelligence is excellent."

"What I like most about the product is its all-in-one solution. With Microsoft Defender XDR, we get coverage for various aspects like endpoint security, cloud security, and image-related cases, all within a single platform. This eliminates the need for multiple products or technical controls to address incidents. The main benefit became evident immediately after deployment, especially in its ability to analyze files and phishing emails quickly. By submitting suspicious files or emails, we receive quick results on whether they are legitimate, suspicious, or malicious, saving time."

"The integration with other Microsoft solutions is the most valuable feature."

"It provides a single pane of glass within the 365 admin interface, streamlining our experience by consolidating information in one place and eliminating the need to navigate through multiple interfaces."

More Microsoft Defender XDR pros

Cons

"The cloud licensing unit system is unclear, especially since "units" aren't well-defined."

"From a downside perspective, the UI is not user-friendly and feels dated compared to other tools like Prisma Cloud."

"It has been working very well, but it would be helpful if the dashboard could generate reports tailored to specific compliance needs. For example, in India, we have to comply with RBI and SEBI guidelines. It w"

"The patching process with Qualys Patch Management, which is part of TotalCloud, does not cover installing certain prerequisites on the servers or workstations."

"The system is not 100% secure yet, so proactive threat hunting could be enhanced to be more proactive than the current system."

"An area for improvement would be to focus on risks related to AI, such as large language models and potential data leakage."

"Their support could be improved."

"Qualys's ticketing system can be confusing when assigning tasks to individuals, and support could be improved by offering instant call solutions with engineers in addition to ticket replies."

More Qualys TotalCloud cons

"AWS Security Hub should improve the time it takes to update. It takes a long period of time when updating. It can take 24 hours sometimes to update. Additionally, when integrating this solution with more security tools, takes time."

"Security Hub is currently not worth investing in, as it requires more configurations and integration with other services to work effectively."

"I would like a more fine-grained capability for creating custom rules and a more user-friendly experience programmatically in writing queries and configuring custom security rules, making it quicker and easier."

"Many findings are too generic or irrelevant to the environment, which can lead to false positives."

"One aspect that could be improved in the solution is its adaptability to different markets and geopolitical restrictions. In certain regions like Thailand, specific services from certain countries or providers, such as AWS or Azure, might be limited or blocked. It also needs improvement in would require configuring the solution more adaptable to AWS infrastructure and function."

"Security needs to be measured based on their own criteria. We can't add custom criteria specific to our organization. For example, having an S3 bucket publicly available might be flagged as a critical alert, but it might not be critical in a sandbox environment. So, it gets flagged as critical, which becomes a false positive. So, customization options and creating custom dashboards would be areas for improvement."

"AWS Security Hub cannot scale up to multiple different cloud environments; it only works for AWS."

"The solution is not wholly self-sufficient."

More AWS Security Hub cons

"The capability to not only thwart attacks but also to adapt to evolving threats is crucial."

"Microsoft Defender is slow to adapt to evolving threats."

"Sometimes, configurations take much longer than expected."

"Microsoft tends to provide too many features, which makes the solution prone to bugs."

"I would like more of the features in Defender for 365 to be included in the smaller licenses. Even if I buy a small license and don't need everything, security shouldn't be a question. Security is one of the main aspects of all projects from our side, so it would be nice to have more features in the smaller licenses."

"Support is hit or miss. Microsoft wants you to buy premium support contracts. Though they call themselves professional support, it's almost like throwing questions into a black hole. You get an answer, but it's never helpful."

"For some scenarios, it provides good visibility into threats, and for some scenarios, it doesn't. For example, sometimes the URLs within the emails have destinations, and you do get a screenshot and all further details, but it's not always the case. It would be good if they did a better job of enabling that for all the emails that they identified as malicious. When you get an email threat, you can go into the email and see more details, but the URL destination feature doesn't always show you a screenshot of the URL in that email. It also doesn't always give you the characteristics relating to that URL. It would be quite good if the information is complete where it says that we identified this URL, and this is what it looks like. There should be some threat intel about it. It should give you more details."

"There is no common area where we can manage all the policies for the EDR, third-party solutions, devices, servers, Windows, Mac, etc., but it's on the road map, and we ware waiting for that feature."

More Microsoft Defender XDR cons

Pricing and Cost Advice

"Qualys TotalCloud offers competitive pricing given its comprehensive suite of features, including integration, assessment, remediation, and detection capabilities, all within a single platform."

"It isn't cheap, but it's reasonable. It helps us to manage things with very few resources."

"I am not sure about the pricing. From what I understand, it is a bit on the higher side, but I do not have the exact numbers."

"The pricing for TotalCloud is attractive and competitive in the market. Given the features, especially the dashboard, I have no concerns regarding pricing."

"Qualys TotalCloud offers cost-effective licensing flexibility."

"Its price seems higher compared to other tools, but it is worth it. If they could adjust the pricing and make it comparable with other tools, that would be great."

"Qualys TotalCloud is expensive, but it offers a premier solution with no headaches."

"As a middle management member, I do not have direct pricing knowledge, but based on the knowledge from our meetings, its pricing is competitive."

More Qualys TotalCloud pricing and cost advice

"AWS Security Hub is not an expensive tool. I would consider it to be a cheap solution. AWS Security Hub follows the PAYG pricing model, meaning you will have to pay for whatever you use."

"The price of the solution is not very competitive but it is reasonable."

"The cost is based on the number of compliances, core checks, and services required, and for more than 10,000 recommendations, the charge is just one dollar."

"The price of AWS Security Hub is average compared to other solutions."

"The pricing is fine. It is not an expensive tool."

"Security Hub is not an expensive solution."

"There are multiple subscription models, like yearly, monthly, and packaged."

"AWS Security Hub's pricing is pretty reasonable."

"The license cost for a year is approximately forty-four thousand, and this annual saving is a significant factor in our decision to switch."

"Defender XDR is included in the E5 license, but it's a bit too expensive."

"The pricing of Microsoft 365 Defender is definitely on the costly side, but with the features and services that Microsoft provides, such as the seamless integration of all the Defender tools, while the price is on the higher side, there is no alternative."

"Sometimes 365 Defender is expensive, but it can be moderate, depending on the organization's size and the license type. We're satisfied with the cost because it gives us a product that protects our entire environment with DLP. To compromise some cost, of course, we are to complete the most secure environment."

"Purchasing Microsoft Defender XDR as part of a Microsoft 365 bundle can be cost-effective, but acquiring it as a standalone product may be more expensive."

"The licensing fee for Microsoft 365 Defender is fair."

"Microsoft Defender XDR is priced high."

"Microsoft purposely makes its license combinations complex and includes combinations like Microsoft 365 E3 and Microsoft 365 E5, Office 365 E3, Office 365 E5, and Office 365 E1, so you get confused. Microsoft tries to sell you a bundle of a lot of things together."

More Microsoft Defender XDR pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Cloud Security Posture Management (CSPM) solutions are best for your needs.

See recommendations

896,099 professionals have used our research since 2012.

Comparison Review

it_user186927

Director of Operations at a comms service provider with 10,001+ employees

Feb 16, 2015

Cybereason vs. Interset vs. SQRRL

Capture DB - they all use NoSQL db and hence solve the ad hoc query and 'go back in time' problem with current best of breed SIEM and DLP solutions that rely on real time analysis of incoming logs (and don't store them). This means deeper and quicker iterative threat analysis and assessment…

Read full review

Top Industries

By visitors reading reviews

Financial Services Firm

16%

Computer Software Company

Manufacturing Company

Government

Financial Services Firm

12%

Manufacturing Company

10%

Computer Software Company

Comms Service Provider

Computer Software Company

10%

Financial Services Firm

Manufacturing Company

Comms Service Provider

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	10
Midsize Enterprise	3
Large Enterprise	28

By reviewers
Company Size	Count
Small Business	9
Midsize Enterprise	5
Large Enterprise	14

By reviewers
Company Size	Count
Small Business	46
Midsize Enterprise	29
Large Enterprise	41

Questions from the Community

What is your experience regarding pricing and costs for Qualys TotalCloud?

The price is very expensive, actually.

See all answers

What needs improvement with Qualys TotalCloud?

Areas that need improvement in every solution include the remediation part. The remediation steps should be simple en...

See all answers

What is your primary use case for Qualys TotalCloud?

Our use case involves the assets that we have under cloud, the assets exposed to the internet, and the internal appli...

See all answers

Which is better - Azure Sentinel or AWS Security Hub?

We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel...

See all answers

What needs improvement with AWS Security Hub?

AWS Security Hub cannot scale up to multiple different cloud environments; it only works for AWS. There are other pro...

See all answers

What is your primary use case for AWS Security Hub?

The major use case for identifying misconfigurations within the AWS environment focuses on determining whether the ad...

See all answers

What is your experience regarding pricing and costs for Microsoft 365 Defender?

My experience with the pricing, setup costs, and licensing of Microsoft Defender XDR is that we are on an E5 license,...

See all answers

What needs improvement with Microsoft 365 Defender?

From my perspective, Microsoft Defender XDR can be improved with better visibility in certain areas where I can trigg...

See all answers

What is your primary use case for Microsoft 365 Defender?

My main use cases for Microsoft Defender XDR are telemetry, advanced hunting, and the ability to perform host isolati...

See all answers

Comparisons

Wiz vs Qualys TotalCloud

Compared 13% of the time

Microsoft Defender for Cloud vs Qualys TotalCloud

Compared 8% of the time

Prisma Cloud by Palo Alto Networks vs Qualys TotalCloud

Compared 6% of the time

Nucleus Security vs Qualys TotalCloud

Compared 5% of the time

Qualys VMDR vs Qualys TotalCloud

Compared 3% of the time

More Qualys TotalCloud Competitors

Microsoft Sentinel vs AWS Security Hub

Compared 33% of the time

Prisma Cloud by Palo Alto Networks vs AWS Security Hub

Compared 7% of the time

Wiz vs AWS Security Hub

Compared 4% of the time

Microsoft Defender for Cloud vs AWS Security Hub

Compared 4% of the time

JupiterOne vs AWS Security Hub

Compared 1% of the time

More AWS Security Hub Competitors

CrowdStrike Falcon vs Microsoft Defender XDR

Compared 10% of the time

Wazuh vs Microsoft Defender XDR

Compared 6% of the time

SentinelOne Singularity Endpoint vs Microsoft Defender XDR

Compared 4% of the time

Microsoft Defender for Cloud vs Microsoft Defender XDR

Compared 4% of the time

Microsoft Defender for Endpoint vs Microsoft Defender XDR

Compared 3% of the time

More Microsoft Defender XDR Competitors

Product Reports

Buyer's Guide

Qualys TotalCloud

May 2026

Download Qualys TotalCloud product report

Buyer's Guide

AWS Security Hub

May 2026

Download AWS Security Hub product report

Buyer's Guide

Microsoft Defender XDR

May 2026

Download Microsoft Defender XDR product report

Also Known As

Qualys TotalCloud with FlexScan

SQRRL

Microsoft 365 Defender, Microsoft Threat Protection, MS 365 Defender

Overview

Qualys TotalCloud enhances security posture across cloud environments with continuous monitoring, vulnerability management, and risk visualization, ensuring efficient threat assessment and automated remediation for improved cyber risk reduction.

Qualys TotalCloud offers a robust suite of security tools essential for organizations managing multi-cloud infrastructures. By integrating cloud accounts and automating workflows, it supports AWS, Azure, and GCP, offering comprehensive vulnerability management and zero-day detection. The platform's user-friendly design, combined with its extensive risk management and unified threat assessment capabilities, enables organizations to prioritize and remediate vulnerabilities effectively. TruRisk Insights provides clear insights on cyber risks, while the automation options streamline patch management and scanning processes. API integration across IaaS and SaaS environments further enhances resource allocation efficiency and saves time, addressing misconfigurations across cloud environments.

What are the most important features of Qualys TotalCloud?

Accurate Vulnerability Reports: Delivers precise and actionable insights for risk mitigation.
Zero-Day Detection: Identifies and addresses zero-day vulnerabilities proactively.
Unified Threat Assessment: Offers comprehensive evaluation of threats across the environment.
Extensive Risk Management: Manages risks effectively with advanced insights and prioritization.
Continuous Monitoring: Provides non-stop surveillance for vulnerabilities and threats.
Cloud-Native Automation: Streamlines processes and reduces manual efforts using automation.
FlexScan for Internet-Facing VMs: Scans external VMs efficiently to detect vulnerabilities.
Dashboard Risk Visualization: Clear visualization helps prioritize vulnerabilities.

What benefits and ROI should users look for?

Improved Security Posture: Enhances threat detection and response across clouds.
Time Savings: Automation reduces time spent on manual vulnerability management.
Resource Efficiency: Better allocation of resources through streamlined workflows.
Enhanced Risk Prioritization: Focus on critical vulnerabilities for effective mitigation.
Integrated Cloud Accounts: Facilitates seamless cloud management and security.

Qualys TotalCloud is deployed in sectors needing rigorous vulnerability management, such as finance and healthcare. Companies utilize it to secure multi-cloud environments like AWS, Azure, and GCP, focus on compliance, and integrate security into CI/CD pipelines to detect and remedy threats pre-deployment.

Qualys

AWS Security Hub provides multi-account management and compliance checks alongside integrations with AWS services and third-party tools. It centralizes vulnerability tracking and risk prioritization, delivering real-time alerts for proactive security management.

AWS Security Hub enhances cloud security management through a centralized dashboard that monitors infrastructure resources and compliance scores, ensuring adherence to AWS standards. With integrations for vulnerability detection and security posture management, users can streamline security operations. While the platform offers notable benefits, areas for improvement include customization options for findings suppression and integration with multi-cloud environments.

What are the key features of AWS Security Hub?

Multi-Account Management: Seamlessly manage security across numerous accounts.
Compliance Checks: Stay aligned with standards such as PCI through automated reviews.
AWS Integrations: Connect effortlessly with AWS and third-party services to enhance security posture.
Real-Time Alerts: Quickly respond to potential threats with immediate notifications.
Risk Prioritization: Focus on critical vulnerabilities to enhance resource allocation.

What benefits should users expect from using AWS Security Hub?

Proactive Security: Early threat detection enables quicker mitigation strategies.
Cloud-Native Functionality: Utilize tools tailored for cloud environments.
Compliance Insights: Simplified compliance management provides transparency.
Ease of Use: Streamlined interface facilitates efficient security management.

Industries implementing AWS Security Hub leverage its capabilities for comprehensive security across multiple accounts and regions. Health, finance, and retail sectors benefit by automating compliance checks and monitoring security infrastructures. This service aids in identifying misconfigurations, tracking alerts, and ensuring infrastructure integrity during cyber incidents.

Amazon Web Services (AWS)

Microsoft Defender XDR is a comprehensive security solution designed to protect against threats in the Microsoft 365 environment.

It offers robust security measures, comprehensive threat detection capabilities, and an efficient incident response system. With seamless integration with other Microsoft products and a user-friendly interface, it simplifies security management tasks.

Users have found it effective in detecting and preventing various types of attacks, such as phishing attempts, malware infections, and data breaches.

Watch the Microsoft demo video here: Microsoft Defender XDR demo video.

Microsoft

Sample Customers

Information Not Available

Edmunds, Frame.io, GoDaddy, Realtor.com

Accenture, Deloitte, ExxonMobil, General Electric, IBM, Johnson & Johnson and many others.

Buyer's Guide

AWS Security Hub vs. Microsoft Defender XDR

May 2023

Free Report: AWS Security Hub vs. Microsoft Defender XDR

Find out what your peers are saying about AWS Security Hub vs. Microsoft Defender XDR and other solutions. Updated: May 2023.

DOWNLOAD NOW

896,099 professionals have used our research since 2012.

See our AWS Security Hub vs. Microsoft Defender XDR report.

We monitor all Cloud Security Posture Management (CSPM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.