AI Trace
Data AnalysisAugments Human LaborVerified

Reviewed and published by trentmaziarz, March 18, 2026. Discovered and drafted by our automated research pipeline.

Amazon GuardDuty is an AWS security service that uses AI and machine learning to automatically monitor customer cloud environments for hacking attempts, credential theft, malware, and multi-step cyberattacks. An enhanced Extended Threat Detection capability using AI/ML to correlate sequences of security signals launched in general availability in December 2024 and is automatically enabled for all GuardDuty customers at no additional cost.

Details

GuardDuty Extended Threat Detection uses AI and machine learning algorithms trained at AWS scale to correlate security signals from across AWS services and identify complex, multi-stage attack sequences — such as credential compromise followed by data exfiltration — representing them as a single critical-severity finding with a natural language summary, event timeline, MITRE ATT&CK mapping, and remediation recommendations. It is automatically enabled for all new and existing GuardDuty customers. In June 2025, AWS expanded Extended Threat Detection coverage to Amazon EKS (Kubernetes) clusters. In March 2025, coverage was extended to AWS GovCloud and China Regions.

Products affected

Amazon GuardDutyAWS Security HubAmazon EventBridge

Sources & Evidence

Company Disclosure

Company DisclosureVerified
Amazon GuardDuty features
AWS·Jan 2026
https://aws.amazon.com/guardduty/features/
Company DisclosureVerified
Introducing Amazon GuardDuty Extended Threat Detection: AI/ML attack sequence identification for enhanced cloud security
AWS News Blog·Dec 2024
https://aws.amazon.com/blogs/aws/introducing-amazon-guardduty-extended-threat-detection-aiml-attack-sequence-identification-for-enhanced-cloud-security/
Company DisclosureVerified
Amazon GuardDuty introduces GuardDuty Extended Threat Detection
AWS·Dec 2024
https://aws.amazon.com/about-aws/whats-new/2024/12/amazon-guardduty-extended-threat-detection/

Cite this record

Trace Foundation. (2026). AWS (Amazon Web Services): Amazon GuardDuty is an AWS security service that uses AI and machine learning to automatically monitor customer cloud environments for hacking attempts, credential theft, malware, and multi-step cyberattacks. An enhanced Extended Threat Detection capability using AI/ML to correlate sequences of security signals launched in general availability in December 2024 and is automatically enabled for all GuardDuty customers at no additional cost (data as of 2026-09-02) [Data set record]. AI Trace. https://www.aitrace.org/r/practice/fd57147f-f495-40d2-9048-9c502403dcb0. Accessed October 10, 2026.

Stable link
https://www.aitrace.org/r/practice/fd57147f-f495-40d2-9048-9c502403dcb0
Data as of
September 2, 2026
Last verified
Not recorded

How to cite AI Trace

Other practices by AWS (Amazon Web Services)

ProductivityAmazon Q Business is an AI assistant AWS offers to enterprise employees, allowing them to ask questions in plain language and get answers drawn from their company's own internal documents, databases, and software systems. It became generally available in April 2024.RecommendationAmazon Personalize is an AWS service that offers businesses a fully managed machine learning engine to build custom recommendation systems for their own websites, apps, emails, and marketing campaigns. It has been generally available since June 2019 and is based on the same recommendation technology used internally by Amazon.com.OtherAWS deployed AWS Security Agent, an AI agent that automatically reviews application code and architecture for vulnerabilities and runs penetration tests on demand throughout the software development process. It launched in preview in December 2025 and the penetration testing capability reached general availability in six regions on March 31, 2026.

Have evidence about AWS (Amazon Web Services)'s AI practices? Submit a report.

Report a Sighting →