How AWS Security Hub and Security Hub CSPM Manage Your Security State

Two products with one name

If you used AWS Security Hub before 2025, the product you know is now called AWS Security Hub CSPM (Cloud Security Posture Management). It still does what it always did: runs security checks against standards and collects findings from other services into one place.

The name AWS Security Hub now belongs to a newer service that AWS made generally available in December 2025. It sits on top of the detection services and correlates their signals to show which risks matter most. The two work together: Security Hub receives findings from Security Hub CSPM, Amazon GuardDuty, Amazon Inspector, Amazon Macie and IAM Access Analyzer.

One clarification that older articles get wrong: neither product has an agent to install. Both are managed services that you enable per account and Region, and they read data from other AWS services through their APIs.

Security Hub CSPM: standards, controls and findings

Security Hub CSPM answers the question “is my environment configured the way it should be?”

Standards and controls

A standard is a set of requirements, and each requirement maps to one or more controls. A control is an automated check, such as “S3 general purpose buckets should block public access”. The supported standards are:

• AWS Foundational Security Best Practices (FSBP)
• AI Security Best Practices
• AWS Resource Tagging
• CIS AWS Foundations Benchmark
• NIST SP 800-53 Revision 5
• NIST SP 800-171 Revision 2
• PCI DSS
• CRI Profile v2.2
• Service-managed standard: AWS Control Tower

FSBP is the sensible starting point for most accounts. Add the framework standards your auditors care about. Passing these checks does not by itself make you compliant with a regulation; they are a way to monitor configuration, not an audit.

Most controls rely on AWS Config service-linked rules, so you must enable AWS Config and record the relevant resource types for Security Hub CSPM to evaluate them. AWS Config recording has its own cost. If you enable several standards, turn on consolidated control findings so each control produces one finding instead of one per standard.

Security Hub CSPM turns control results into a security score per standard, which is a useful trend line for leadership, as long as everyone understands it measures configuration checks and not threats.

Findings and the ASFF format

Besides its own control findings, Security Hub CSPM ingests findings from AWS services such as GuardDuty, Amazon Inspector, Amazon Macie and IAM Access Analyzer, and from supported AWS Partner products. All of them are normalized into the AWS Security Finding Format (ASFF), a JSON schema with common fields for severity, resource, workflow status and remediation. That common shape is what lets you filter, group and automate across sources.

It only processes findings generated after you enable it, and only in the Region where it is enabled.

The new AWS Security Hub: exposures and prioritization

The new AWS Security Hub answers a different question: “of everything my tools report, what is actually exploitable?”

• Exposure findings. Security Hub correlates Security Hub CSPM control results, Amazon Inspector vulnerabilities, GuardDuty threats and Macie sensitive data findings for the same resource. An EC2 instance with a critical vulnerability is one thing; the same instance reachable from the internet with an over-permissive role is an exposure, and it is ranked accordingly.
• Attack path graph. For an exposure, the console shows how a potential attacker could move from the entry point to the affected resources.
• Unused access analysis. It creates a service-linked IAM Access Analyzer to flag roles, users, access keys and permissions not used in the last 90 days, with suggested least-privilege policies.
• OCSF findings. The new Security Hub uses the Open Cybersecurity Schema Framework (OCSF) rather than ASFF. This matters if you have automation or SIEM parsers built on ASFF: they will need changes, and AWS has published guidance on migrating automation rules.
• Ticketing. Integrations with Jira Cloud and ServiceNow ITSM create tickets from findings.

To get full value from exposures, you need the underlying services enabled, particularly Amazon Inspector and GuardDuty. Pricing differs from Security Hub CSPM, so check the Security Hub pricing page and the console’s cost estimator before rolling out.

Integrations and automation

Both products support several ways to act on findings:

• Automation rules update or suppress findings automatically based on criteria you define, for example raising severity for production accounts or suppressing a control you have formally accepted.
• Amazon EventBridge receives findings as events, so you can route them to AWS Lambda, AWS Step Functions, an SNS topic, or a chat channel through Amazon Q Developer in chat applications.
• Custom actions in Security Hub CSPM let an analyst send a selected finding to EventBridge, for example to open a ticket or start a remediation workflow.
• Partner integrations send findings in from third-party tools and out to SIEM and SOAR platforms.

Multi-account and cross-Region setup

Security Hub is designed to be run centrally:

1. Delegated administrator. From the AWS Organizations management account, designate a security account as the Security Hub delegated administrator. It sees findings from all member accounts. Use a dedicated security account: the management account cannot be the delegated administrator for the new Security Hub, and if you already have a Security Hub CSPM delegated administrator, the same account is used for both.
2. Central configuration. In Security Hub CSPM, central configuration lets the delegated administrator define configuration policies (whether Security Hub CSPM is on, and which standards and controls are enabled) and apply them to accounts, organizational units or the whole organization, across Regions, from one place. Centrally managed accounts cannot change those settings themselves, which prevents drift.
3. Cross-Region aggregation. Choose a home Region (previously called the aggregation Region) and link other Regions to it. In Security Hub CSPM, findings, insights, control statuses and security scores replicate to the home Region, and updates replicate both ways. AWS does not charge extra for the replication. Security Hub CSPM must still be enabled in each linked Region; aggregation does not enable it for you.

For full CIS AWS Foundations Benchmark coverage, AWS notes that Security Hub CSPM must be enabled in all supported Regions, not only the ones you deploy to.

Getting started

• Start a 30-day free trial of Security Hub CSPM with FSBP enabled, using central configuration and a home Region from day one.
• Make sure AWS Config is recording in every account and Region you enable.
• Enable GuardDuty and Amazon Inspector, then turn on the new Security Hub to see exposures.
• Fix failed controls in batches by control, not by account, and use automation rules to suppress what you have formally accepted.

Getting help

9Acts is an AWS Advanced Tier Services Partner and AWS MSP Partner with the AWS Level 1 MSSP Competency. If you want help setting up Security Hub across your organization or working through failed controls, see our security and compliance services.