GuardDuty Runtime Monitoring is now included in the AWS Security Hub Threat Analytics plan

This article announces that Amazon GuardDuty Runtime Monitoring is now included in the AWS Security Hub Threat Analytics plan with consolidated billing.

• Runtime Monitoring detects threats like container escapes, privilege escalation, and cryptomining on EC2, EKS, and ECS Fargate
• Security Hub now bills Runtime Monitoring as a single usage type instead of separate charges per resource
• No reconfiguration needed; detection coverage and security agents remain unchanged
• Free trial for Threat Analytics plan remains separate from Security Hub Essentials plan
• Customers can track billing impact using AWS Cost Explorer or Security Hub usage page

This change simplifies billing for Runtime Monitoring while maintaining existing detection capabilities and coverage.