# AWS moves GuardDuty runtime monitoring billing into Security Hub

_Published Friday, October 2, 2026 at 12:17 AM EDT · Security · Latest · Tier 2 — Notable_

AWS says GuardDuty Runtime Monitoring is now included in the Security Hub Threat Analytics plan. For accounts and regions with Security Hub enabled, runtime monitoring usage moves from separate GuardDuty charges to one Security Hub usage type covering EC2 instances, EKS clusters and ECS tasks on AWS Fargate.

The service inspects operating system, network and file activity for threats including container escapes, privilege escalation and cryptomining. Detection coverage, finding types and security agents remain unchanged, with no reconfiguration required. The billing change adds no new runtime monitoring free trial; the Threat Analytics and Security Hub Essentials trials remain separate.

## Sources

- [Recent Announcements](https://aws.amazon.com/about-aws/whats-new/2026/10/aws-security-hub-runtime-monitoring/)

---
Canonical: https://techandbusiness.org/newswire/9U5gpHkOWbH9wWljakeYd1
Published: 2026-10-02T04:17:19.390Z
Story chronology: 2026-10-02T03:35:00.000Z
Retrieved: 2026-10-02T08:25:13.970Z
Publisher: Tech & Business (techandbusiness.org)