AWS Security Hub now offers Network Scanning to identify publicly reachable resources

AWS Security Hub introduces Network Scanning, a capability that identifies resources reachable from the public internet by probing from the internet rather than just analyzing configurations.

• Detects actual reachability of public IP addresses, virtual machines, and load balancers across AWS and Azure
• Identifies reachable ports and determines services running behind them
• Generates Security Hub findings with evidence for each reachable port discovered
• Complements existing network reachability findings that identify potential configuration-based exposure
• Correlates findings with other data to determine broader risk through Security Hub Exposures
• Available at no additional cost with Security Hub Essentials in all supported AWS commercial regions
• Enabled by default for new customers; existing customers can enable per account, region, or organization-wide

Network Scanning provides active verification of internet-facing resources, enhancing visibility into actual security exposure beyond configuration analysis.