Tagged
On Jul 27, 2026, AWS launched the Security Hub MCP App preview—8 read-only tools that bring exposure findings, attack paths, and remediation guidance into Claude Desktop at no additional cost for Security Hub customers.
On June 15, 2026 AWS made Console Private Access work without internet — VPC endpoints route 100% of browser traffic. First-party benchmark: 161 interface endpoints and ~$263/mo for a 12-service 3-AZ pilot in us-east-1.
Two 2025 shifts rewrite the IR playbook: GuardDuty Extended Threat Detection now emits a single critical attack-sequence finding instead of a pile of high findings, and AWS Security Incident Response moved to metered pricing (free first 10,000 findings/month, then $0.000676 each) on November 21, 2025. The lesson is to page humans on the top 1% of correlated criticals, isolate instead of terminate, and let auto-triage absorb the rest. Here are the runbooks.
After Security Hub Essentials consolidated Inspector and CSPM into per-resource pricing (example: 500 units ≈ $1,875/mo), most AWS-only estates should run native first. This guide scores when Wiz/Orca-class tools earn a line item—and when paying twice for the same CVE is the real failure mode.
July 2026 placement guide for AWS Security Agent full-repository code review (announced May 12, 2026): trust-boundary and data-flow analysis beside Inspector, CI SAST, and a reproducible pilot checklist — still preview terms; confirm console pricing.
GitHub Actions OIDC role sessions are short-lived by design—teams still paste static access keys into workflow logs until scanners or audits catch the diff; supply-chain writeups keep repeating the pattern into 2026.
July 2026: nine migration mistakes that still show up after Migration Hub closed to new customers on November 7, 2025 — Application Migration Service (MGN), DMS, AWS Transform, Org/SCPs, FinOps dual-run costs, and Migration Lens.
How to build a vulnerability management program that scales beyond CVE-counting. Inspector v2 deployment, CVSS + CISA KEV + reachability for risk-based prioritization, container and IaC scanning in CI/CD, and remediation SLAs that survive audits.
Most AWS security breaches aren't caused by AWS failures — they're caused by misconfiguration. Here are 10 concrete best practices to harden your AWS environment in 2026.
A practical architecture guide for PCI DSS compliance on AWS — CDE scoping, the 12 requirements mapped to AWS services, network design, encryption, logging, and audit readiness for payment-processing applications.
An audit-prep checklist for Compliance Leads, Security Officers, and CISOs — BAA execution, documented Security Risk Assessments, workforce training, audit cadence, and the evidence packages OCR investigators expect when they show up.
IAM best practices, GuardDuty, Security Hub, and the layered approach to AWS security consulting that keeps your workloads protected.