AWS Security Hub Threat Analytics now bills GuardDuty Runtime Monitoring itself: no separate GuardDuty charge where Security Hub is enabled

AWS Security Hub Threat Analytics now bills GuardDuty Runtime Monitoring itself: no separate GuardDuty charge where Security Hub is enabled

2 October 2026 — On 2 October 2026 AWS announced that Amazon GuardDuty Runtime Monitoring is now included in the AWS Security Hub Threat Analytics plan. The practical effect is on invoices: if Security Hub is enabled in an account and a region, that account and region no longer receive separate GuardDuty charges for Runtime Monitoring. The usage appears under AWS Security Hub instead.

Not yet independently verified. Single source (AWS What's New). The post gives no rates and no effective date other than its posting date; the price effect was not independently checked. We will update this when it can be confirmed, and remove this note.

What changed

Runtime Monitoring watches operating-system, network and file activity to find threats such as container escapes, privilege escalation and cryptomining. It covers Amazon EC2 instances, Amazon EKS clusters and Amazon ECS tasks on AWS Fargate.

AWS says Security Hub now meters this coverage under what it calls streamlined pricing. Where GuardDuty previously charged per resource type, Security Hub meters it as a single usage type that spans EC2, EKS and ECS on Fargate. AWS states that detection coverage, finding types and the GuardDuty security agents are unchanged and that no reconfiguration is needed.

One detail on trials: the free trial for the Threat Analytics plan remains separate from the trial for the Security Hub Essentials plan, and this change does not create a new free trial for Runtime Monitoring.

The announcement does not publish rates. AWS points readers to the Security Hub pricing page, Cost Explorer and the Security Hub usage page to see the effect on a particular bill.

Who is affected

Teams that run Runtime Monitoring and also have Security Hub enabled in the same account and region. For them, line items move from GuardDuty to Security Hub. Whether the total goes up or down depends on workload mix, which AWS does not quantify. Teams without Security Hub in that account and region are not described as affected.

Finance and cloud-cost teams are affected as well. Cost allocation tags, budgets, showback reports and anomaly alerts that key on GuardDuty line items will stop matching the Runtime Monitoring spend.

What to do

1. Open Cost Explorer for the last full billing month and list your Runtime Monitoring spend by account and region.
2. Compare it with the Security Hub pricing page for the Threat Analytics plan to estimate the new charge for the same workload.
3. Update budgets, alerts and chargeback reports so that Runtime Monitoring cost is tracked under Security Hub.
4. Tell the security and finance owners of each account which line the spend now appears on, to avoid a false anomaly alert on the first bill.
5. If you have been holding back Security Hub in some regions, re-run the cost comparison with this change included before deciding.
6. Ask your AWS account team to confirm in writing how the change applies to any private pricing agreement or enterprise discount you hold.

Sources

• AWS What's New: GuardDuty Runtime Monitoring is now included in the AWS Security Hub Threat Analytics plan — 2 October 2026