An Introduction to AWS Security Hub

This article is based on original reporting by Brien Posey, first published on virtualizationreview.com. Attribution is preserved below.

What Is AWS Security Hub?

Amazon Web Services (AWS) operates on a shared security responsibility model: AWS secures the underlying cloud infrastructure, while subscribers are responsible for securing everything they deploy inside that infrastructure. In practice, fulfilling that subscriber responsibility is complex—AWS spans hundreds of individual services, each with its own security controls, configuration options, and threat surface.

AWS Security Hub addresses this complexity by aggregating and normalizing security findings from across AWS services into a single, unified console. Instead of juggling separate dashboards for Amazon GuardDuty, AWS Config, Amazon Inspector, and others, Security Hub collects their outputs, correlates them, and presents a coherent picture of your security posture.

Key Capabilities

• Centralized findings: Ingests security alerts from native AWS services (GuardDuty, Inspector, Macie, Firewall Manager) and supported third-party tools into a standardized format.
• Compliance scoring: Automatically runs checks against recognized security standards and gives each standard a percentage score showing how well your environment meets its controls.
• Severity classification: Findings are categorized as Informational, Low, Medium, High, or Critical, so teams can prioritize remediation effort.
• Remediation guidance: Each finding links to step-by-step remediation instructions, reducing the time between detection and resolution.
• Continuous monitoring: Checks run on an ongoing basis, so your compliance scores update as you make changes to your environment.
• Multi-account support: Security Hub can be configured to aggregate findings across all accounts in an AWS Organization.

Enabling AWS Security Hub

Security Hub is available in the AWS Management Console under Security, Identity, and Compliance. When you launch it for the first time, the setup wizard asks you to select the security standards you want to evaluate your environment against.

Supported Security Standards

At the time of the original article, the standards available included:

• AWS Foundational Security Best Practices (FSBP) – AWS-curated controls covering common misconfigurations across core services.
• CIS AWS Foundations Benchmark – The Center for Internet Security benchmark for AWS accounts.
• PCI DSS – Controls relevant to environments that handle payment card data.

Note: AWS periodically adds new standards. Check the current AWS Security Hub documentation for the latest list.

An important caveat: Security Hub uses automated checks to evaluate compliance, but not every requirement of a given standard can be validated automatically. Human review and additional audit procedures remain necessary for full compliance attestation.

After selecting your standards, click Enable Security Hub. The service activates immediately and begins running its automated checks.

Navigating the Security Hub Dashboard

Summary Screen

The default view after enabling Security Hub is a summary screen that provides a high-level overview of detected security issues across your AWS environment. In a production account with active resources, this screen will display aggregated finding counts broken down by severity and by integrated service.

Security Standards Tab

The Security Standards tab is one of Security Hub’s most actionable views. It lists each enabled standard alongside a security score—a percentage reflecting how many of the standard’s automated controls your environment currently passes. A score close to 100% indicates strong alignment; a low score (such as the 6% example from a nearly empty lab environment noted in the original article) flags significant gaps that need attention in a production context.

Drilling into a standard reveals individual controls organized by severity:

• Critical – Immediate action required; exploitation risk is high.
• High – Significant vulnerability that should be remediated promptly.
• Medium – Notable misconfiguration with moderate risk.
• Low / Informational – Best-practice recommendations with lower immediate risk.

You can filter the findings list by severity or status (Failed, Passed, Unknown, Not Available) to focus remediation work.

Remediation Instructions

Clicking any individual finding opens a detail pane that lists the specific AWS resources where the issue was detected. A Remediation Instructions link navigates directly to the AWS documentation for that control, providing step-by-step guidance for fixing the problem. Because Security Hub re-evaluates controls continuously, a resolved finding will eventually move to a Passed state and contribute positively to your compliance score.

Understanding Security Hub Costs

AWS charges for Security Hub based on the number of security checks performed per month and the number of finding ingestion events processed. While the per-unit cost is low, the volume of checks in a large, active AWS environment can accumulate meaningful charges.

To monitor your spend:

1. Open Settings inside Security Hub.
2. Select the Usage tab.
3. Review your current-month usage, the estimated monthly cost, and the applicable pricing tier.

Security Hub also offers a 30-day free trial for new accounts (verify current trial terms in the AWS pricing page, as these may change). It is possible to disable Security Hub from the General tab in Settings, though doing so is rarely advisable in production environments where continuous monitoring is essential.

Integration with the Broader AWS Security Ecosystem

Security Hub does not perform its own threat detection—it is an aggregation and normalization layer. Its value scales with the number of integrated services and partner tools feeding into it. Common integrations include:

• Amazon GuardDuty – Threat detection based on CloudTrail, VPC Flow Logs, and DNS logs.
• Amazon Inspector – Automated vulnerability assessments for EC2 instances and container images.
• Amazon Macie – Sensitive data discovery and protection for S3.
• AWS Config – Resource configuration history and compliance rules.
• AWS Firewall Manager – Centralized firewall policy management.
• Third-party SIEM and security tools – Many vendors support the AWS Security Finding Format (ASFF) for direct ingestion into Security Hub.

Getting the Most from Security Hub

• Enable all relevant integrations before reviewing your initial score. A partially integrated Security Hub will underreport findings and give a misleadingly high score.
• Prioritize Critical and High findings first. Use severity filters to create a structured remediation backlog.
• Set up EventBridge rules to route critical findings to a ticketing system or PagerDuty for automated alerting.
• Use AWS Organizations integration to aggregate findings from all member accounts into a designated administrator account for centralized visibility.
• Track score trends over time. Security Hub scores should improve as you remediate issues; a declining score signals new misconfigurations or newly enabled checks.

Video: AWS Security Hub Overview

About the Original Author

The original article was written by Brien Posey, a 16-time Microsoft MVP with decades of IT experience. Posey has written thousands of articles and contributed to dozens of books on IT topics. He previously served as CIO for a national chain of hospitals and as a network administrator for major insurance companies and for the Department of Defense. He has also pursued training as a commercial scientist-astronaut candidate. The original article appeared on virtualizationreview.com.