Amazon Web Services said that Amazon GuardDuty Runtime Monitoring is now included in the AWS Security Hub Threat Analytics plan, in an announcement posted on October 2, 2026. The company said the change consolidates how the runtime threat detection coverage is billed.
What changed
AWS said customers who have Security Hub enabled in an account and region will no longer receive separate Amazon GuardDuty charges for Runtime Monitoring in that account and region.
According to the company, that usage now appears on the bill under AWS Security Hub, which meters it as a single usage type spanning Amazon EC2, Amazon EKS and Amazon ECS on AWS Fargate, rather than as separate charges for each resource type.
What Runtime Monitoring covers
AWS said Runtime Monitoring inspects operating system, network and file activity to surface threats such as container escapes, privilege escalation and cryptomining.
The company said that coverage applies to Amazon EC2 instances, Amazon EKS clusters and Amazon ECS tasks on AWS Fargate.
What customers need to do
AWS said detection coverage, finding types and GuardDuty security agents all remain the same, and that customers do not need to reconfigure anything.
The company noted that the free trial for the Threat Analytics plan remains separate from the free trial for the Security Hub Essentials plan, and that the change does not add a new free trial for Runtime Monitoring. AWS said customers can use AWS Cost Explorer or the Security Hub usage page to see how the change affects their bill.
What to do
- Check AWS Cost Explorer or the Security Hub usage page to see how the billing change affects your invoice.
- Expect no configuration work: AWS says detection coverage, finding types and GuardDuty security agents stay the same.
- Note that the Threat Analytics plan free trial is separate from the Security Hub Essentials free trial, and no new Runtime Monitoring trial is added.
- Consult the AWS Region table for where Security Hub is available and the Security Hub pricing page for cost details.
Key facts and where they come from
- GuardDuty Runtime Monitoring is now part of the Security Hub Threat Analytics plan, according to AWS.
Today, AWS announces that Amazon GuardDuty Runtime Monitoring is now included in the AWS Security Hub Threat Analytics plan.
- Runtime Monitoring inspects OS, network and file activity for threats including container escapes, privilege escalation and cryptomining.
Runtime Monitoring inspects operating system, network, and file activity to surface threats such as container escapes, privilege escalation, and cryptomining
- Separate GuardDuty charges for Runtime Monitoring no longer apply where Security Hub is enabled.
If you have Security Hub enabled in an account and region, you no longer receive separate Amazon GuardDuty charges for Runtime Monitoring for that account and region.
- Billing is metered as one usage type across EC2, EKS and ECS on Fargate.
Security Hub meters it as a single usage type that spans Amazon EC2, Amazon EKS, and Amazon ECS on AWS Fargate rather than as separate charges for each resource type
- No reconfiguration is required and detections are unchanged, AWS said.
Your detection coverage, your finding types, and your GuardDuty security agents all remain the same, and you do not need to reconfigure anything.
- The change does not create a new free trial for Runtime Monitoring.
this change does not add a new free trial for Runtime Monitoring