AWS GuardDuty vs Microsoft Defender for Cloud comparison

Amazon Web Services (AWS) and Microsoft are both solutions in the Cloud Workload Protection Platforms (CWPP) category. Amazon Web Services (AWS) is ranked #5 with an average rating of 8.4, while Microsoft is ranked #3 with an average rating of 7.9. Additionally, 91% of Amazon Web Services (AWS) users are willing to recommend the solution, compared to 94% of Microsoft users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jun 6, 2024

AWS GuardDuty and Microsoft Defender for Cloud both offer strong threat detection and automated responses, yet differ in setup time and integration. AWS GuardDuty features quick deployment and seamless integration with AWS services. Microsoft Defender for Cloud offers continuous monitoring and superior integration with Microsoft tools, albeit having variable setup times.

Features: AWS GuardDuty excels in accurate threat detection, seamless integration with AWS, automated responses, and a user-friendly interface. Microsoft Defender for Cloud offers comprehensive threat protection, automatic remediation, continuous monitoring, and strong integration with Microsoft tools.
Pricing and ROI: AWS GuardDuty setup cost is straightforward, dependent on data analyzed, and simple to initiate. Microsoft Defender for Cloud has competitive pricing, diverse licensing options, and flexible payment plans. AWS focuses on ease of onboarding, while Microsoft emphasizes budget accommodation and variety in licensing. AWS GuardDuty offers enhanced security through seamless AWS integration. Microsoft Defender for Cloud provides improved threat detection and visibility across cloud environments. GuardDuty reduces potential losses; Defender for Cloud saves on breach costs.
Room for Improvement: AWS GuardDuty requires better alert accuracy and streamlined integration, along with advanced customization options and improved documentation. Microsoft Defender for Cloud needs better third-party tool integration, advanced customization, enhanced user interface, and comprehensive reporting features.
Deployment and customer support: Establishing AWS GuardDuty is notably quicker, often completed in mere hours, whereas Microsoft Defender for Cloud varies considerably, with setup times ranging from one week to three months, reflecting a less predictable and more complex deployment process. AWS GuardDuty users praise the knowledge and responsiveness of the support team, emphasizing problem-solving efficiency. Microsoft Defender for Cloud is commended for top-notch professionalism and consistent expertise, with users highlighting efficient issue resolution and high satisfaction.

The summary above is based on 78 interviews we conducted recently with AWS GuardDuty and Microsoft Defender for Cloud users. To access the review's full transcripts, download our report.

To learn more, read our detailed AWS GuardDuty vs. Microsoft Defender for Cloud Report (Updated: December 2024).

Buyer's Guide

AWS GuardDuty vs. Microsoft Defender for Cloud

December 2024

Download the complete report

Helped 823,875 peers since 2012

Categories and Ranking

SentinelOne Singularity Clo...

Featured Reviews

Andrew W

VP - Information Technology at a financial services firm with 201-500 employees

Tells us about vulnerabilities as well as their impact and helps to focus on real issues

Looking at all the different pieces, it has got everything we need. Some of the pieces we do not even use. For example, we do not have Kubernetes Security. We are not running any K8 clusters, so it is good for us. Overall, we find the solution to be fantastic. There can be additional education components. This may not be truly fair to them because of what the product is going for, but it would be great to see additional education for compliance. It is not a criticism of the tool per se, but anything to help non-development resources understand some of the complexities of the cloud is always appreciated. Any additional educational resources are always helpful for security teams, especially those without a development background.

Read full review

Terence Dube

AWS Cloud Engineer at Standard Telephones and Cables

Comprehensive threat detection simplifies security management

GuardDuty is limited to AWS environments. While incorporating Amazon Detective for detailed investigation can be useful, including more granular details in findings, such as specific user actions or historical comparisons, would be beneficial. Furthermore, managing global AWS environments requires setting up additional tools for viewing GuardDuty findings across multiple regions. A unified dashboard that aggregates findings across all regions without requiring manual aggregation could enhance convenience for users.

Read full review

Javier_Rodriguez

Cloud Consultant at i-Community AG

Unified security management enhances threat detection and streamlines user experience

At the moment, we work with Sophos, SentinelOne, or Microsoft Defender. Most of our customers have Microsoft infrastructure, and they are cloud-only customers with Microsoft business licensing. I primarily recommend Microsoft Defender for customers who already have Microsoft infrastructure The…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"We're monitoring several cloud accounts with Singularity. It is convenient to identify issues or security failures in any account. It's nice to have all the details we need to solve these issues."

"The most valuable aspects of PingSafe are its alerting system and the remediation guidance it provides."

"PingSafe offers an intuitive user interface that lets us navigate quickly and easily."

"Cloud Native Security has helped us with our risk posture and securing our agenda. It has been tremendous in terms of supporting growth."

"The user-friendly dashboard offers both convenience and security by providing quick access to solutions and keeping us informed of potential threats."

"It has a user-friendly dashboard that I can access without any difficulty."

"Cloud Security has provided a single view to observe all workloads, prioritization for handling cloud assets, and reduced noise by distinguishing false positives effectively."

"It's positively affected the communication between cloud security, application developers, and AppSec teams."

More SentinelOne Singularity Cloud Security pros

"With anomaly detection, active threat monitoring, and set correlation, GuardDuty alerts me to any unusual user behavior or traffic patterns right away, which is great for staying on top of potential security risks."

"The most valuable features are the single system for data collection and the alert mechanisms."

"AWS GuardDuty helps by providing continuous threat detection and signaling potential threats. Its most valuable feature is continuous monitoring. The tool's integration with other AWS services has improved security. It provides continuous monitoring and intelligent threat detection, quickly signaling any issues. I would rate this improvement a seven out of ten."

"We use the tool for threat detection. AWS includes AI features as well. AWS GuardDuty gives us reports."

"Since our environment is cloud based and accessible from the internet, we like the ability to check where the user has logged in from and what kind of API calls that user is doing."

"The product has automated protection powered by AI/ML, which is now far more powerful than before. It uses AI/ML in its detection algorithm, providing fast and quick results."

"The solution provides AWS GuardDuty S3 protection, EKS runtime protection, and malware protection."

"It kinda just gives us another layer of security. So it does provide some sort of comfort that we do have something that is monitoring for abnormal behavior."

More AWS GuardDuty pros

"The product has given us more insight into potential avenues for attack paths."

"The solution is quite good and addresses many security gaps."

"Scalability is great, and I would rate it a ten out of ten."

"The valuable features include the ability to manage devices and the fact that Defender can replace other security tools like SCCM."

"The solution's robust security posture is the most valuable feature."

"We can create alerts that trigger if there is any malicious activity happening in the workflow and these alerts can be retrieved using the query language."

"The integration with Logic Apps allows for automated responses to incidents."

"Everything is built into Azure, and if we go for cross-cloud development with Azure Arc, we can use most of the features. While it's possible to deploy and convert third-party applications, it is difficult to maintain, whereas Azure deployments to the cloud are always easier. Also, Microsoft is a big company, so they always provide enough support, and we trust the Microsoft brand."

More Microsoft Defender for Cloud pros

Cons

"For vulnerabilities, they are showing CVE ID. The naming convention should be better so that it indicates the container where a vulnerability is present. Currently, they are only showing CVE ID, but the same CVE ID might be present in multiple containers. We would like to have the container name so that we can easily fix the issue."

"The alerting system of the product is an area that I look at and sometimes get confused about. I feel the alerting feature needs improvement."

"We don't get any notifications from PingSafe when the clusters are down."

"I believe the UI/UX updates for SentinelOne Singularity Cloud Security have room for improvement."

"The integration with Oracle has room for improvement."

"It took us a while to configure the software to work well in this type of environment, as the support documents were not always clear."

"The categorization of the results from the vulnerability assessment could be improved."

"One potential drawback is the cost of SentinelOne Singularity Cloud Security, which may be prohibitive for smaller businesses or startups, particularly those in regions with lower average incomes, such as India."

More SentinelOne Singularity Cloud Security cons

"AWS GuardDuty needs to be more customer-oriented."

"GuardDuty is limited to AWS environments."

"Amazon GuardDuty could be better enriched in threat intelligence data."

"An improvement would be to have a mobile version where remote workers can log in and monitor and fix issues."

"GuardDuty is limited to AWS environments."

"While sending the alerts to the email, they are not being patched. we have to do the patching and mapping manually. If GuardDuty could include a feature to do this automatically, it will make our job easier. That is something I believe can be improved."

"We currently find Lacework to be much better at detecting vulnerabilities than AWS GuardDuty. The engines of AWS GuardDuty have to be improved."

"AWS GuardDuty sometimes shows false positives and should have better detection accuracy."

More AWS GuardDuty cons

"Integration into other third-party products, particularly those from tier three vendors like ManageEngine and Hexcode, has proven difficult."

"The product must improve its UI."

"I've heard there might be issues with scalability for larger enterprises."

"It's hard to reach someone who understands my problems. I haven't had many issues, so I haven't called them."

"Azure Security Center takes a long time to update, compared to the on-premises version of Microsoft Defender."

"The initial setup is not actually so complex but it feels complex because there are many add-ons. There are many options and my team needs to be aware of all of these changes happening on the backend which is a distraction."

"Sometimes it's very difficult to determine when I need Microsoft Defender for Cloud for a special resource group or a special kind of product."

"Agent features need to be improved. They support agents through Azure Arc or Workbench. Sometimes, we are not able to get correct signals from the machines on which we have installed these agents. We are not able to see how many are currently reporting to Azure Security Center, and how many are currently not reporting. For example, we have 1,000 machines, and we have enrolled 1,000 OMS agents on these machines to collect the log. When I look at the status, even though at some places, it shows that it is connected, but when I actually go and check, I'm not getting any alerts from those. There are some discrepancies on the agent, and the agent features are not up to the mark."

More Microsoft Defender for Cloud cons

Pricing and Cost Advice

"PingSafe is affordable."

"The pricing for PingSafe in India was more reasonable than other competitors."

"Its pricing is constant. It has been constant over the previous year, so I am happy with it. However, price distribution can be better explained. That is the only area I am worried about. Otherwise, the pricing is very reasonable."

"It is not that expensive. There are some tools that are double the cost of PingSafe. It is good on the pricing side."

"Its pricing was a little less than other providers."

"PingSafe is not very expensive compared to Prisma Cloud, but it's also not that cheap. However, because of its features, it makes sense to us as a company. It's fairly priced."

"PingSafe is less expensive than other options."

"I am not involved in the pricing, but it is cost-effective."

More SentinelOne Singularity Cloud Security pricing and cost advice

"The platform is inexpensive."

"We use a pay-as-you-use license, which is competitively priced in the market."

"I have heard that the solution's price is quite high."

"GuardDuty only enables accounts in regions where you have an active workload. If there are places where you don't have an active workload, you wouldn't even enable them. That's one area where they could allow you to cut down your cost."

"Pricing is determined by the number of events sent."

"In terms of the costs associated with Amazon GuardDuty, it was $1 per GB from what I recall. Pricing was based on per gigabyte. For example, for the first five hundred gigabytes per month, it'll be $1 per GB, so it'll be $500. If your usage was greater, there's another bracket, for example, the next two thousand GB, then there's an add-on cost of 50 cents per GB. That's how Amazon GuardDuty pricing slowly goes up. I can't remember if there was any kind of additional cost apart from standard licensing for the solution. Nothing else that at least comes to mind. What the service was charging was worth it. That was one good thing when using Amazon GuardDuty because my company could be in a certain tier for a certain period. My company wasn't under a licensing model where it could overestimate its usage and under-utilize its usage and pay much more. This was what made the pricing model for Amazon GuardDuty better."

"The price of the solution is exactly right."

"The pricing model is pay as you go and is based on the number of events per month."

More AWS GuardDuty pricing and cost advice

"Azure Defender is a bit pricey. The price could be lower."

"Currently, Microsoft offers only one plan at the enterprise level which is $15 per machine."

"They have a free version, but the license for this one isn't too high. It's free to start with, and you're charged for using it beyond 30 days. Some other pieces of Defender are charged based on usage, so you will be charged more for a high volume of transactions. I believe Defender for Cloud is a daily charge based on Azure's App Service Pricing."

"While we pay for any additional features, the pricing seems competitive, though I am not involved in the specific cost details."

"There are two different plans. We're using the secure basic plan, but we have used the end security plan as well. There are additional costs, but it gives us more functionalities compared to the basic plan."

"Pricing depends on your workload size, but it is very cheap. If you're talking about virtual machines, it is $5 or something for each machine, which is minimal. If you go for some agent-based solution for every virtual machine, then you need to pay the same thing or more than that. For an on-premises solution like this, we were paying around $30 to $50 based on size. With Defender, Microsoft doesn't bother about the size. You pay based on the number of machines. So, if you have 10 virtual machines, and 10 virtual machines are being monitored, you are paying based on that rather than the size of the virtual machine. Thus, you are paying for the number of units rather than paying for the size of your units."

"Microsoft's licensing and pricing are sometimes complicated. If someone is new to Microsoft's licensing, they might have difficulty with it."

"The pricing model for most plans is generally good, but the cost of the new Defender for Storage plan is high and should be revisited, as it could lead to disabling desirable security features due to cost."

More Microsoft Defender for Cloud pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Cloud Workload Protection Platforms (CWPP) solutions are best for your needs.

See recommendations

823,875 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

19%

Financial Services Firm

15%

Manufacturing Company

Government

Financial Services Firm

17%

Computer Software Company

15%

Manufacturing Company

Government

Computer Software Company

15%

Financial Services Firm

13%

Manufacturing Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about PingSafe?

The dashboard gives me an overview of all the things happening in the product, making it one of the tool's best featu...

See all answers

What is your experience regarding pricing and costs for PingSafe?

SentinelOne provided competitive pricing compared to other vendors, and we are satisfied with the deal.

See all answers

What needs improvement with PingSafe?

To enhance the notification system's efficiency, resolved issues should be promptly removed from the portal. Currentl...

See all answers

What do you like most about Amazon GuardDuty?

With anomaly detection, active threat monitoring, and set correlation, GuardDuty alerts me to any unusual user behavi...

See all answers

What is your experience regarding pricing and costs for Amazon GuardDuty?

GuardDuty is very cheap and operates on a pay-as-you-go basis. It's priced around a dollar per million requests, maki...

See all answers

What needs improvement with Amazon GuardDuty?

GuardDuty is limited to AWS environments. While incorporating Amazon Detective for detailed investigation can be usef...

See all answers

How is Prisma Cloud vs Azure Security Center for security?

Azure Security Center is very easy to use, integrates well, and gives very good visibility on what is happening acros...

See all answers

What do you like most about Microsoft Defender for Cloud?

The entire Defender Suite is tightly coupled, integrated, and collaborative.

See all answers

What is your experience regarding pricing and costs for Microsoft Defender for Cloud?

I don't have visibility into the specific costs, but it seems to be a significant concern for our organization. Every...

See all answers

Comparisons

Wiz vs SentinelOne Singularity Cloud Security

Compared 31% of the time

Prisma Cloud by Palo Alto Networks vs SentinelOne Singularity Cloud Security

Compared 23% of the time

Orca Security vs SentinelOne Singularity Cloud Security

Compared 6% of the time

Check Point CloudGuard CNAPP vs SentinelOne Singularity Cloud Security

Compared 3% of the time

Aqua Cloud Security Platform vs SentinelOne Singularity Cloud Security

Compared 3% of the time

More SentinelOne Singularity Cloud Security Competitors

CrowdStrike Falcon Cloud Security vs AWS GuardDuty

Compared 12% of the time

Wiz vs AWS GuardDuty

Compared 11% of the time

Prisma Cloud by Palo Alto Networks vs AWS GuardDuty

Compared 8% of the time

Trend Vision One - Cloud Security vs AWS GuardDuty

Compared 3% of the time

Akamai Guardicore Segmentation vs AWS GuardDuty

Compared 2% of the time

More AWS GuardDuty Competitors

Prisma Cloud by Palo Alto Networks vs Microsoft Defender for Cloud

Compared 13% of the time

Wiz vs Microsoft Defender for Cloud

Compared 11% of the time

Microsoft Defender XDR vs Microsoft Defender for Cloud

Compared 4% of the time

Azure Firewall vs Microsoft Defender for Cloud

Compared 4% of the time

Microsoft Defender for Endpoint vs Microsoft Defender for Cloud

Compared 3% of the time

More Microsoft Defender for Cloud Competitors

Product Reports

Buyer's Guide

SentinelOne Singularity Cloud Security

October 2024

SentinelOne Singularity Cloud Security report

Download SentinelOne Singularity Cloud Security product report

Buyer's Guide

AWS GuardDuty

December 2024

Download AWS GuardDuty product report

Buyer's Guide

Microsoft Defender for Cloud

November 2024

Download Microsoft Defender for Cloud product report

Also Known As

PingSafe

No data available

Microsoft Azure Security Center, Azure Security Center, Microsoft ASC, Azure Defender

Learn More

SentinelOne

Amazon Web Services (AWS)

Microsoft

Interactive Demo

Demo not available

SentinelOne

Demo not available

Amazon Web Services (AWS)

Microsoft

Overview

SentinelOne Singularity Cloud Security protects cloud workloads, offering advanced threat detection and automated response. It integrates seamlessly with cloud environments and secures containerized applications and virtual machines against vulnerabilities.

SentinelOne Singularity Cloud Security is renowned for its efficiency in mitigating threats in real-time. The platform integrates effortlessly with existing cloud environments, ensuring robust cloud security management with minimal manual intervention. Securing containerized applications and virtual machines, it excels in threat intelligence and endpoint protection. However, improvements are needed in performance during high workload periods, and more integrations with third-party tools and better documentation would be beneficial. Users often find the installation process complex, support response times slow, and the dashboard's navigation unintuitive.

What are the key features of SentinelOne Singularity Cloud Security?

Real-time Threat Detection: Identifies and mitigates threats as they occur.
Automated Response: Automatically responds to threats to minimize impact.
Ease of Deployment: Simple setup process with scalable options.
Machine Learning Insights: AI-driven insights enhance threat prevention.
Seamless Integration: Integrates with cloud environments for unified security management.

What are the primary benefits or ROI to expect from SentinelOne Singularity Cloud Security?

Enhanced Threat Mitigation: Improved security against real-time threats.
Reduced Manual Intervention: Automated processes save time and resources.
Scalability: Easily adapts to growing security requirements.
Centralized Management: Manage security across platforms from a single console.
Advanced Threat Intelligence: Provides in-depth analysis and protection.

In specific industries, SentinelOne Singularity Cloud Security is implemented to safeguard critical data and infrastructure. Organizations in finance, healthcare, and technology depend on its real-time threat detection and automated response to protect sensitive information. Its ability to secure containerized applications and virtual machines is particularly valuable in dynamic environments where rapid scaling is necessary.

Amazon Guard Duty is a continuous cloud security monitoring service that consistently monitors and administers several data sources. These include AWS CloudTrail data events for EKS (Elastic Kubernetes Service) audit logs, VPC (Virtual Private Cloud) flow logs, DNS (Domain Name System) logs, S3 (Simple Cloud Storage), and AWS CloudTrail event logs.

Amazon GuardDuty intuitively uses threat intelligence data - such as lists of malicious domains and IP addresses - and ML (machine learning) to quickly discover suspicious and problematic activity in a user's AWS ecosystem. Activities may include concerns such as interactions with malicious IP addresses or domains, exposed credentials usage, or changes and/or escalation of privileges.

GuardDuty is able to easily determine problematic AWS EC2 (Elastic Compute Cloud) instances delivering malware or mining bitcoin. It is also able to trace AWS account access history for evidence of destabilization. such as suspicious API calls resulting in changing password policies to minimize password strength or anomalous infrastructure deployments in new or different never-used regions.

GuardDuty will continually alert users regarding their AWS environment status and will send the security discoveries to the GuardDuty dashboard or Amazon CloudWatch events for users to view.

Users can access GuardDuty via:

AWS SDKs: Amazon provides users with several software development kits (SDKs) that are made up of libraries and sample code of numerous popular programming languages and platforms, such as Android, iOS, Java, .Net, Python, and Ruby. The SDKs make it easier to develop programmatic access to GuardDuty.
GuardDuty HTTPS API: This allows users to issue HTTPS requests directly to the service.
GuardDuty Console: This is a browser-based intuitive dashboard interface where users can access and use GuardDuty.

Amazon Elastic Kubernetes Service (Amazon EKS)

Kubernetes protection is an optional add-on in Amazon GuardDuty. This tool is able to discover malicious behavior and possible destabilization of an organization's Kubernetes clusters inside of Amazon Elastic Kubernetes Service (Amazon EKS).

When Amazon EKS is activated, GuardDuty will actively use various data sources to discover potential risks against Kubernetes API. When Kubernetes protection is enabled, GuardDuty uses optional data sources to detect threats against Kubernetes API.

Kubernetes audit logs are a Kubernetes feature that captures historical API activity from applications, the control plane, users, and endpoints. GuardDuty collates these logs from Amazon EKS to create Kubernetes discoveries for the organization's Amazon EKS assets; there is no need to store or turn on the logs.

As long as Kubernetes protection remains activated, GuardDuty will continuously dissect Kubernetes data sources from the Amazon EKS clusters to ensure no suspicious or anomalous behavior is taking place.

Amazon Simple Cloud Storage (S3) Protection

Amazon S3 allows Amazon GuardDuty to actively audit object-level API processes to discover possible security threats to data inside an organization's S3 buckets. GuardDuty continually audits risk to the organization’s S3 assets by carefully dissecting AWS CloudTrail management events and AWS CloudTrail S3 data events. These tools are continually auditing various CloudTrail management events for potential suspicious activities that affect S3 buckets, such as PutBucketReplication, DeleteBucket, ListBucket, and data events for S3 object-level API processes, such as PutObject, GetObject, ListObject, and DeleteObject.

Reviews from Real Users

“The most valuable features are the single system for data collection and the alert mechanisms. Prior to using GuardDuty, we had multiple systems to collect data and put it in a centralized location so we could look into it. Now we don't need to do that anymore as GuardDuty does it for us.” - Arunkumar A., Information Security Manager at Tata Consultancy Services

Microsoft Defender for Cloud is a comprehensive security solution that provides advanced threat protection for cloud workloads. It offers real-time visibility into the security posture of cloud environments, enabling organizations to quickly identify and respond to potential threats. With its advanced machine learning capabilities, Microsoft Defender for Cloud can detect and block sophisticated attacks, including zero-day exploits and fileless malware.

The solution also provides automated remediation capabilities, allowing security teams to quickly and easily respond to security incidents. With Microsoft Defender for Cloud, organizations can ensure the security and compliance of their cloud workloads, while reducing the burden on their security teams.

Sample Customers

Information Not Available

autodesk, mapbox, fico, webroot

Microsoft Defender for Cloud is trusted by companies such as ASOS, Vatenfall, SWC Technology Partners, and more.

Buyer's Guide

AWS GuardDuty vs. Microsoft Defender for Cloud

December 2024

Free Report: AWS GuardDuty vs. Microsoft Defender for Cloud

Find out what your peers are saying about AWS GuardDuty vs. Microsoft Defender for Cloud and other solutions. Updated: December 2024.

DOWNLOAD NOW

823,875 professionals have used our research since 2012.

See our AWS GuardDuty vs. Microsoft Defender for Cloud report.

See our list of best Cloud Workload Protection Platforms (CWPP) vendors.

We monitor all Cloud Workload Protection Platforms (CWPP) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.