AWS Security Hub Now Monitors Azure VMs, Adds AI Posture Management for Bedrock

AWS extends Security Hub into multicloud and AI posture territory

Amazon Web Services has turned Security Hub into a direct competitor to third-party CSPM platforms with a July update that adds Azure resource monitoring and AI security posture management for Bedrock and SageMaker environments. The move forces enterprise buyers running primarily AWS workloads to recalculate whether standalone CSPM platforms from Wiz, Palo Alto Networks, or Microsoft still justify their cost.

Security Hub now discovers and monitors Azure Virtual Machines, Container Registry images, Function Apps, and Azure identities. The update bundles GuardDuty AI Protection for AWS AI workloads and an AI inventory that maps Bedrock models and SageMaker endpoints to their underlying compute, network, IAM, and data stores. AWS positions this as a unified control plane for cloud and AI security, directly competing with agentless CSPM vendors that built their business on being the multicloud alternative to fragmented cloud-native tools.

Budget pressure on CSPM renewals

For organizations already paying for Security Hub and GuardDuty, the Azure coverage and AI posture capabilities create immediate budget questions. If your Azure footprint consists of a few AKS clusters or Function Apps rather than a full second-cloud architecture, AWS now offers enough coverage to eliminate duplicative spend on third-party CSPM for those limited workloads. Security Hub and GuardDuty remain metered services billed per ingested finding or per account, so buyers should model incremental costs against current CSPM licensing during upcoming AWS renewals.

The AI inventory addresses a concrete gap in AI governance. Security teams piloting or scaling Bedrock or SageMaker workloads now get a dependency map showing which models connect to which endpoints, compute instances, IAM roles, and data stores—information that currently requires manual documentation or separate AI security tooling. This capability will be used to justify incremental GuardDuty spend in budget reviews instead of purchasing AI-focused platforms.

Multicloud strategy determines whether this matters

The Azure monitoring is meaningful but narrow. Specialist CSPM platforms from Wiz, Prisma Cloud, or Microsoft Defender for Cloud extend to GCP, Kubernetes distributions, and dozens more service types. Enterprises with true three-cloud deployments face a choice: run two or more cloud-native security stacks (AWS Security Hub plus Microsoft Defender for Cloud) with the overhead of duplicated policies and separate reporting, or consolidate into a third-party CSPM that provides unified policy enforcement and a single compliance dashboard.

AWS is betting that most enterprises claiming to be multicloud are actually AWS-primary with targeted Azure or GCP usage. For that profile, Security Hub's limited Azure coverage plus deep AWS integration may be sufficient, especially if AWS offers volume discounts on Security Hub and GuardDuty in contract negotiations. Buyers should compare the cost of incremental Security Hub findings ingestion against the per-resource or per-account pricing of their current CSPM vendor.

CSPM market consolidates around platform plays

PeerSpot's June 2026 user rankings list Wiz, Prisma Cloud, Microsoft Defender for Cloud, SentinelOne Singularity Cloud Security, and Datadog as the top five CSPM platforms. The ranking matters because it shapes RFP shortlists and gives top-tier vendors pricing leverage—platforms that know they will appear on every enterprise evaluation limit discounting, while challengers price more aggressively to displace incumbents.

Every top-ranked platform bundles CSPM into broader cloud security offerings (CNAPP, CWPP, CIEM, XDR) rather than selling it as a standalone tool. This reflects how buyers actually budget: it is easier to justify a consolidated Wiz or Prisma Cloud purchase than a CSPM-only SKU. Standalone CSPM tools must now demonstrate clearly superior coverage—such as cross-cloud compliance reporting or integration with existing SIEM and ticketing systems—to win budget that would otherwise flow to platform vendors.

What to watch

AWS has not published list pricing for the new Azure monitoring or AI posture capabilities, so buyers should ask for detailed cost modeling during Q4 budget planning. Request estimates for findings ingestion costs if you enable Azure monitoring at scale, and compare those against your current CSPM spend per Azure resource.

For AI workloads, the Security Hub AI inventory creates a compliance artifact that auditors and regulators will increasingly expect. Organizations scaling Bedrock or SageMaker should evaluate whether this native inventory satisfies AI risk assessment requirements or whether separate AI governance platforms are still necessary. The answer determines whether AWS captures incremental security budget or whether that spend flows to specialized AI security vendors.