What is Amazon GuardDuty? A plain-English explainer

What threat detection actually means

Threat detection is the practice of watching activity in a system and identifying signs that something malicious or abnormal is happening — an unusual pattern of access, communication with a known-bad source, or behaviour that does not match how a resource normally operates. It is distinct from prevention: a firewall or access policy tries to stop bad activity before it happens, while detection assumes some things will still get through and focuses on noticing them quickly.

Both matter. Even a well-configured account can be compromised through a leaked credential or a misused permission, which is exactly the kind of activity that preventative controls alone will not catch, but ongoing monitoring can.

What GuardDuty does

GuardDuty analyses activity and logs across your AWS accounts — the kind of underlying signal that already exists as a normal by-product of running infrastructure — and looks for patterns consistent with known attack techniques or genuinely anomalous behaviour. When it finds something worth flagging, it produces a finding: a description of what was detected, how severe it appears to be, and enough detail to investigate further.

It works without requiring you to deploy or manage detection infrastructure yourself, and without needing you to write your own detection rules from scratch — the specific mechanics of what it inspects and how are AWS’s to run, which is exactly what a managed service means in practice.

Why continuous detection is the customer’s job

Under the AWS shared-responsibility model, AWS secures the underlying infrastructure, but detecting misuse of your own account — a compromised credential, an unusual API call pattern, traffic to a suspicious destination — is squarely on the customer side of that line. AWS cannot know, on its own, whether a given action in your account is legitimate or a sign of compromise; it can only surface the signal, which is what GuardDuty does.

That is why continuous detection is treated as a baseline security practice rather than an optional extra: threats do not announce themselves on a schedule, and a service that only gets checked occasionally leaves a wide gap between something going wrong and someone noticing.

How GuardDuty fits with other AWS security services

GuardDuty is often discussed alongside AWS CloudTrail, but the two do different jobs. CloudTrail, covered in our what-is-aws-cloudtrail explainer, is the audit trail — a record of who did what and when, across your AWS account. GuardDuty analyses activity, which draws on signal like that audit trail among other sources, and actively looks for signs of malicious or anomalous behaviour within it. Put simply: CloudTrail records; GuardDuty watches and flags.

Used together, they give a fuller picture — GuardDuty tells you something looks wrong, and the underlying activity records let you investigate exactly what happened.

Common uses

Typical reasons teams enable GuardDuty include catching compromised credentials being used in unusual ways, spotting resources communicating with known malicious infrastructure, detecting reconnaissance-style behaviour against an account, and adding a baseline layer of automated threat monitoring without building a detection pipeline from scratch.

Where GuardDuty appears in certification study

GuardDuty is core content on Security Specialty, where detection and monitoring services are tested in depth alongside preventative controls. It also appears at a lighter, conceptual level in operations-focused study, where knowing that a managed threat-detection option exists matters more than its internal detail.

This article covers what GuardDuty is and why it exists — the syllabus depth on findings, severity and integration with other services belongs in the exam guide itself, which our /revision study library covers lesson by lesson.