Loading story…
AWS has released a reference architecture to automate the validation and documentation of security exceptions in AWS Security Hub. The solution enforces governance by separating duties between security and development teams and supports 13 validation types for compensating controls. It maintains audit trails, enforces expiration of exceptions, and integrates with existing governance systems for scalable compliance management.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcehelpnetsecurity.com
Open sourceaws.amazon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AWS expanded **Security Hub** beyond its own cloud to add native visibility into **Microsoft Azure**, marking the service’s first direct monitoring of infrastructure outside AWS. The update lets Security Hub discover Azure virtual machines, container images, Function Apps, and identities, then evaluate them for misconfigurations, internet exposure, and vulnerable software. AWS said the Azure assessments align with the **CIS Microsoft Azure Foundations Benchmark**, giving organizations a standardized baseline for multicloud posture management. AWS also introduced new AI-focused security capabilities, including **GuardDuty AI Protection** for Amazon Bedrock and SageMaker and AI-powered investigations in Security Hub. The AI protections are designed to detect threats such as anomalous model use, prompt injection attempts, and cost-harvesting abuse tied to stolen credentials, while the investigations feature uses up to 90 days of related activity to generate confidence-scored findings, **MITRE ATT&CK** mappings, and remediation guidance. AWS said the expansion is aimed at unifying security operations across multicloud environments while improving visibility into both cloud infrastructure and AI assets.
Jul 14, 2026
AWS is rolling out a simplified sign-up experience that lets customers use Google, GitHub, or Apple identities to create a preconfigured project with Free Tier credits and configurable monthly spending limits. The environment is implemented as a restricted three-account AWS Organization sandbox—comprising a user-facing member account plus hidden management and identity accounts—and can pause projects or apply controls that prevent new workload creation after a budget threshold is reached. AWS also automates service permissions through console workflows, coding agents, and IAM Role Manager, reducing the need to create IAM users, trust policies, or service permissions manually. Security researchers found the sandbox is designed for onboarding and cost control rather than a complete security baseline. It does not enable CloudTrail and blocks GuardDuty, Security Hub, Detective, Inspector, Macie, and IAM Access Analyzer; it can also allow IAM access keys, public S3 buckets after protections are disabled, and EC2 instances using IMDSv1. Generated roles remain visible and modifiable, but may receive broad permissions such as `PowerUserAccess` where AWS cannot infer required access, requiring review and least-privilege refinement. Organizations needing centralized governance, multiple Regions, or full security-service coverage must enable advanced features and review inherited automated access rules and restrictive sandbox policies.
Sep 17, 2026
Organizations are facing increasing challenges in detecting and responding to security incidents in cloud environments due to the dynamic and ephemeral nature of cloud workloads. AWS has introduced Security Incident Response, a native solution that integrates with GuardDuty and Security Hub to provide automated triage, expert analysis, and rapid threat containment, helping organizations improve their security posture and recovery times. Meanwhile, industry reports highlight that most organizations experience delays in detecting and remediating cloud-related breaches, with traditional on-premises investigation methods proving inadequate for the cloud's complexity. Security teams are urged to adopt cloud-native incident response and forensic investigation practices to keep pace with evolving threats and reduce the risk of undetected breaches.
Jun 29, 2026