AWS Security Hub Now Extends Threat Monitoring to Microsoft Azure

Amazon Web Services has broadened its Security Hub platform to monitor Microsoft Azure workloads, making it the first time the service has offered native visibility into infrastructure outside the AWS ecosystem. The update arrives alongside new AI-focused security capabilities designed to protect machine learning workloads from emerging threats.

The expansion represents a significant competitive move in multicloud security—a market where Microsoft's Defender for Cloud already monitors AWS and Google Cloud, and where Google recently acquired Wiz, a cross-cloud security platform.

Azure Monitoring Comes to Security Hub#

Security Hub can now automatically discover Azure virtual machines, container images, serverless Function Apps, and identity services. Once found, it evaluates these resources against the CIS Azure Foundations Benchmark for misconfigurations, internet exposure, and software vulnerabilities.

The key advantage for teams managing both clouds: all findings appear together in a single ranked queue within the same console, and can trigger existing automation workflows without requiring separate tools or platforms. AWS prices Azure monitoring at the same rate as equivalent AWS resources, with no additional multicloud fees and a 30-day free trial available.

As AWS's director of security services noted in the announcement, "Your workloads move to new clouds. Your security should already be there." This unified approach aims to reduce operational friction for organizations spreading infrastructure across multiple platforms.

AI Security Gets New Protections#

AWS also shipped three capabilities focused on securing artificial intelligence workloads:

• GuardDuty AI Protection: Detects threats specific to Amazon Bedrock and SageMaker, including unusual model invocations, prompt injection attacks (via Bedrock Guardrails integration), and what AWS terms "cost harvesting"—when attackers with compromised credentials repeatedly invoke models to rack up charges on a victim's account.

• AI-Powered Investigations: Now in preview, this feature automatically triages GuardDuty alerts using machine learning. Each investigation includes a confidence score, MITRE ATT&CK classification, and remediation steps, completing analysis in minutes rather than hours.

• AI Inventory: Included at no extra cost in Security Hub's Essentials plan, this tool catalogs AI assets across an organization—managed services like Bedrock and SageMaker, self-hosted models on EC2/ECS/EKS, and external model APIs. It links each asset to underlying infrastructure and related security findings.