Runtime Monitoring inspects various system activities across Amazon EC2 instances, EKS clusters, and ECS tasks to detect runtime threats such as container escapes and privilege escalations. Previously, it was billed separately under GuardDuty but is now consolidated into Security Hub pricing for accounts with Security Hub enabled.
This integration does not alter detection quality or configuration and requires no reconfiguration by customers. The change streamlines cost management by aggregating charges under a single service, with usage visible through AWS billing and cost management tools. Free trials remain separate for the Threat Analytics and Security Hub Essentials plans.
Source & further reading
GuardDuty Runtime Monitoring is now included in the AWS Security Hub Threat Analytics plan ↗Source published 2026-10-02. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.