Security Hub relaunched at the end of 2025 as one console over GuardDuty, Inspector, Macie and what is now called Security Hub CSPM, with exposure findings and per-resource pricing that includes Inspector scanning. How the bill works and a sensible order for turning things on.
The old Security Hub was a findings aggregator with compliance checks, billed per check and per finding. The new Security Hub, generally available since December 2025, correlates findings from GuardDuty, Inspector, Macie and Security Hub CSPM (the old product, renamed) into threats and exposures, and bills per protected resource.
Instead of 400 separate findings, Security Hub tells you that one EC2 instance is reachable from the internet, has a critical vulnerability and has an IAM role that can read customer data. Each exposure describes the potential impact and counts affected resources, with 90 days of trend. It is the feature that makes the product worth looking at daily.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
From the Security Hub pricing page. Other monitored resource types are included at no charge.
Essentials includes CSPM security checks, Inspector vulnerability scanning for EC2, ECR and Lambda (standard scanning), CIS benchmark assessments, unused access findings, network scanning and an AI resource inventory. Threat Analytics, priced on CloudTrail event volume, and Lambda code scanning are add-ons. There is a 30-day free trial per account and Region.
For an account with 50 EC2 instances, 900 container images, 240 Lambda functions and 2,500 roles, that is roughly $188 + $188 + $75 + $75 a month, about $525 before add-ons. Count container images carefully: every tag pushed to ECR is an image, and retention rules are now a cost control as well as hygiene.
Delegate Security Hub administration to the security account, not the management account, and enable it organization-wide.
Turn on Essentials in the Regions you use. Use a Region deny SCP for the rest rather than paying to monitor empty Regions.
Set ECR lifecycle rules so old images expire before they are counted.
Review exposure findings weekly and fix the top five. Ignore the long tail until the top is clean.
Add Threat Analytics where workloads hold sensitive data, once you have someone who will respond to its findings.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
SEC Cybersecurity Disclosure: Four Business Days After Materiality, and What Engineering Must Be Able to Answer
Public companies must disclose a material cybersecurity incident on Form 8-K Item 1.05 within four business days of determining it is material, and describe their risk management and governance each year in the 10-K. The legal team owns the disclosure; engineering owns the facts it needs, fast. What those facts are and how to have them ready.
Read
The EU Cyber Resilience Act and AI Act in 2027: What Software and Connected-Device Teams Need to Do
CRA vulnerability reporting has applied since September 11, 2026; its main obligations apply on December 11, 2027. AI Act high-risk obligations moved to December 2, 2027. A practical, engineering-side reading of what each means for software products and connected devices sold in the EU, and what to have in place a year early.
Read
As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.