AWS moves GuardDuty runtime monitoring billing into Security Hub

AWS says GuardDuty Runtime Monitoring is now included in the Security Hub Threat Analytics plan. For accounts and regions with Security Hub enabled, runtime monitoring usage moves from separate GuardDuty charges to one Security Hub usage type covering EC2 instances, EKS clusters and ECS tasks on AWS Fargate. The service inspects operating system, network and file activity for threats including container escapes, privilege escalation and cryptomining. Detection coverage, finding types and security agents remain unchanged, with no reconfiguration required. The billing change adds no new runtime monitoring free trial; the Threat Analytics and Security Hub Essentials trials remain separate.