A unified cloud security operations platform that aggregates, correlates, and prioritizes findings from across your AWS environment. Recently restructured: the original Security Hub (compliance/posture checks) is now called Security Hub CSPM, and a new, enhanced Security Hub sits on top of it as the unified correlation layer — this rebrand is the single freshest, most-tested nuance in this whole service.
Security Hub questions increasingly test one thing above all else: can you distinguish Security Hub CSPM (configuration/compliance checks against standards) from the new unified Security Hub (cross-service correlation producing exposure findings and attack-path visibility). Older exam material and many third-party resources still use "Security Hub" to mean only the CSPM layer — be ready for both framings.
| Domain | Where Security Hub Shows Up |
|---|---|
| Threat Detection & Incident Response | Exposure findings, attack-path correlation, EventBridge custom actions for response |
| Security Logging & Monitoring | The centerpiece — ASFF/OCSF aggregation, Trends dashboard, multi-account/multi-region aggregation |
| Management & Security Governance | Compliance standards (CIS/PCI/NIST/FSBP), Security Coverage widget, Organizations integration |
| Infrastructure Security | CSPM configuration checks underlying many findings |
Findings scattered across GuardDuty, Inspector, Macie, and configuration checks, with no way to see which combinations represent real, prioritized risk; lack of a documented compliance posture against CIS/PCI/NIST
Single pane of glass for findings; automatic compliance scoring; correlated, prioritized exposure visibility instead of isolated alerts
AWS Security Hub
Enable via Organizations delegated administrator. Designate an aggregation region for cross-region visibility. Enable relevant compliance standards per regulatory need.
Use exposure findings and the Trends/Security Coverage dashboard to prioritize, rather than raw finding counts.
EventBridge custom actions → Lambda/Step Functions, or the dedicated Automated Response and Remediation solution, for high-priority exposure/CSPM findings.
Exam appearance probability: HIGH
This is the single most important structural distinction in the entire service right now.
Requirement → Keywords → Expected Answer → why every distractor fails.
Security Hub CSPM
| Distractor | Why it's wrong |
|---|---|
AWS Config | Provides the underlying configuration evaluation engine, but doesn't package it as standardized, scored compliance frameworks the way Security Hub CSPM does |
Audit Manager | Collects evidence for audit reporting frameworks, distinct from real-time security finding aggregation against these specific standards |
Security Hub exposure findings
| Distractor | Why it's wrong |
|---|---|
| Manually cross-reference GuardDuty, Inspector, and Macie consoles | Works but doesn't scale and isn't automatic/near-real-time the way exposure findings are |
GuardDuty Extended Threat Detection | Correlates WITHIN GuardDuty's own findings into an attack sequence; doesn't incorporate Inspector vulnerability data or Macie sensitive-data signals the way Security Hub exposure findings do |
AWS Security Hub
| Distractor | Why it's wrong |
|---|---|
Amazon Detective | Optionally ingests Security Hub-aggregated findings for investigation, but isn't itself the primary aggregation point |
CloudWatch | Can now ingest Security Hub CSPM findings (March 2026), but it's a downstream consumer, not the aggregation/correlation engine itself |
Security Hub Security Coverage widget
| Distractor | Why it's wrong |
|---|---|
| Count total findings per service | Tells you about existing findings, not about resources with NO coverage at all — a fundamentally different and important gap to see |
Security Hub custom actions via EventBridge, or the Automated Response and Remediation solution
| Distractor | Why it's wrong |
|---|---|
| Security Hub remediates findings automatically by default | It doesn't — remediation requires explicit configuration of a custom action/EventBridge rule/Lambda, or deploying the dedicated remediation solution |
Core identity — ingests, correlates, and prioritizes findings from GuardDuty, Inspector, Macie, and Security Hub CSPM into exposure findings
Security Hub CSPM's standards (CIS, PCI DSS, NIST 800-53, FSBP) enforce and continuously score organizational compliance posture
EventBridge custom actions, or the Automated Response and Remediation solution, trigger Lambda/Step Functions workflows off high-priority findings
It aggregates and correlates their output — it has no native detection engine of its own beyond Security Hub CSPM's configuration checks. Disabling GuardDuty/Inspector/Macie removes those signal types from exposure findings entirely.
If a resource has no exposure traits, or insufficient traits, Security Hub does NOT generate an exposure finding for it — absence of an exposure finding does not necessarily mean the resource is risk-free, it may simply lack correlated signal from the contributing services.
| Misconception | Reality |
|---|---|
| "Security Hub and Security Hub CSPM are two separate, unrelated services" | Security Hub CSPM is the renamed original Security Hub; the new Security Hub is built on top of it as a correlation layer — not a separate, disconnected product |
| "Security Hub detects threats itself" | It has no independent threat-detection engine — threat signal comes from GuardDuty; Security Hub correlates it with other signals |
| "An exposure finding means three completely separate problems" | It represents ONE correlated risk derived from multiple contributing signals on the SAME resource — the point is consolidation, not just listing three findings together |
| "Security Hub automatically fixes flagged misconfigurations" | It requires explicit EventBridge custom actions or the separate Automated Response and Remediation solution — nothing is auto-remediated by default |
| "A resource can appear as the primary resource in multiple exposure findings simultaneously" | A resource can be the primary resource in at most ONE exposure finding at a time |
| Service | What it actually answers |
|---|---|
| vs AWS Config | Config evaluates individual resource configuration against custom/managed rules generally. Security Hub CSPM packages this concept into standardized, scored compliance frameworks (CIS/PCI/NIST/FSBP) specifically |
| vs Amazon Detective | Security Hub aggregates and correlates findings org-wide to tell you WHAT to prioritize (exposure findings). Detective performs deep, graph-based investigation to tell you WHY/HOW once you've decided what to investigate. Used together in sequence, not interchangeably |
| vs GuardDuty Extended Threat Detection | ETD correlates findings WITHIN GuardDuty itself (behavioral signals only) into an Attack Sequence finding. Security Hub's exposure findings correlate ACROSS services (GuardDuty + Inspector + Macie + CSPM) — broader scope, different services involved |
| vs AWS Audit Manager | Audit Manager collects and organizes evidence to support a specific audit/compliance framework reporting process. Security Hub CSPM continuously evaluates and scores compliance in near real-time as part of day-to-day security operations — different purposes, sometimes used together |
Click card to flip. Mark right or wrong to track score.
SCS-C02 scenario style, Easy → Specialty. Select an answer to reveal the explanation.