Project
AWS managed threat-detection service that analyzes account, network, and workload activity to flag malicious or anomalous behavior.
Amazon GuardDuty Extended Threat Detection began attaching five new indicator types to attack sequences on May 20, 2026. Each indicator depends on a separate service being enabled, so what you get tracks what you already run.
Reality
AWS has published a pipeline that pulls Bedrock guardrail traces out of model invocation logs, rewrites them as OCSF Detection Findings, and lands them in the CloudWatch store where analysts already query CloudTrail and VPC Flow Logs.
Reality
Wiz's walkthrough of AWS's new sandboxed sign-up finds an Organization management account and an identity account the customer cannot see, a $20 monthly budget tied to a deny policy, and six AWS security services blocked outright.
Reality
Brain Cipher paralysed more than 230 Indonesian government services in June 2024 with under 2 percent of the data backed up. The AWS reference rebuild published on dev.to depends on two locks you cannot switch off later.
Reality
In HackerOne report #3022516 the trail was multi-region, the metric filter for unauthorised API calls existed and the alarm published to an SNS topic, while threat_detection.enabled read false. Turning it on costs one CLI call.
Reality
A new AWS guide draws its coverage line at patterns common to every account, and hands the account-specific half back to the customer as CloudWatch queries.
Reality
A Yamato Security engineer maps CloudTrail events to seven ATT&CK tactics and drops techniques nobody has observed. The pruning is the useful part, and it will date fast.
Reality
A time-based deny on aws:TokenIssueTime invalidates every credential the role already handed out while the running fleet refreshes through it. The stolen session outlives the patch window by 90 minutes.
Reality