Introducing AI-powered investigations, Amazon GuardDuty aims to accelerate security incident handling by automatically evaluating alerts and associated activities over the preceding 90 days. Leveraging knowledge graphs and threat intelligence, the feature classifies findings by MITRE ATT&CK techniques, estimates confidence levels, and provides evidence-backed recommendations for remedial actions.
This automation addresses alert fatigue by helping security operations distinguish genuine threats from benign activity, across single or multiple AWS accounts. While currently in preview across selected AWS regions, this capability represents a significant step toward AI-assisted cloud security workflows, though effectiveness depends on ongoing validation in operational environments.
Source & further reading
Amazon GuardDuty AI-powered investigations accelerate threat response (Preview) ↗Source published 2026-06-23. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.