AWS Security Hub vs a Code Scanner: What Each One Sees

AWS Security Hub checks your running AWS accounts: it scores resources against standards like the AWS Foundational Security Best Practices and CIS benchmarks and pulls in findings from GuardDuty, Inspector and Macie. A code scanner checks what you are about to deploy: application code, dependencies, secrets and infrastructure-as-code in the pull request. They see different things, and most teams on AWS need both.

Last updated 2 November 2026.

The question usually comes up as "we already have GuardDuty and Security Hub, isn't that enough?" It is a fair question, because Security Hub is a strong product for what it does. The useful answer is to be precise about where each tool looks. Security Hub looks at live cloud resources after they exist. A code scanner looks at source and configuration before it ships. A missing authorization check in your API handler is invisible to the first; a publicly readable S3 bucket that someone created by hand in the console is invisible to the second. For the wider picture of what a startup owns on AWS, see the CTO guide to securing a startup codebase.

What does AWS Security Hub actually do?

AWS Security Hub is AWS's cloud security posture and findings service. According to the AWS Security Hub CSPM documentation, it runs automated checks against security controls from standards including the AWS Foundational Security Best Practices (FSBP), the CIS AWS Foundations Benchmark, PCI DSS and NIST, and generates a finding when a resource fails a control. It also aggregates findings from other AWS services, including Amazon GuardDuty (threat detection), Amazon Inspector (vulnerability management) and Amazon Macie (sensitive data), into one view, and can trigger automated responses through Amazon EventBridge.

AWS has since launched a unified AWS Security Hub that correlates those posture, vulnerability, sensitive-data and threat signals to prioritize active risks, with the original posture service continuing as Security Hub CSPM. Either way, the vantage point is the same: your deployed AWS environment.

Does AWS Security Hub cost money?

Yes, after a trial. The AWS Security Hub pricing page lists a 30-day free trial, then pay-as-you-go pricing with an Essentials plan billed per resource unit per month, optional add-ons such as GuardDuty-powered threat analytics, and an Extended plan for partner solutions. Security Hub CSPM customers moving to the new model trade usage-based charges per check and finding for resource-based pricing. Costs scale with how many resources you run, so check the pricing calculator against your own account size.

What can a code scanner see that Security Hub cannot?

A code scanner reads the repository, so it finds problems that never show up as a misconfigured cloud resource:

• Application logic flaws, such as a missing ownership check, SQL injection or an unsafe deserialization in your own code.

• Vulnerable and malicious dependencies in your lockfiles, ideally ranked by whether your code actually reaches the vulnerable function. See reachability analysis.

• Secrets committed to code, including keys that were deleted from the branch but still sit in history. See how to find hardcoded secrets.

• Infrastructure-as-code misconfigurations in Terraform, CloudFormation, Kubernetes manifests or Dockerfiles, caught in the pull request before the resource exists. See IaC security.

Timing is the other difference. A Security Hub finding arrives after a resource is deployed; a code finding arrives while the author still has the change open, when it is cheapest to fix.

AWS Security Hub vs a code scanner: side by side

Doesn't Amazon Inspector already scan code?

Partly, and it is worth knowing. Amazon Inspector Code Security can scan first-party source code, third-party dependencies and infrastructure-as-code in connected repositories, and Inspector also scans container images and Lambda functions. If you are all-in on AWS tooling, it is a reasonable place to start. When comparing it with a dedicated code scanner, look at whether findings arrive as pull-request reviews or fixes, whether dependency findings are ranked by reachability, how secrets in git history are handled, and whether the tool understands your API surface well enough to show which endpoints reach sensitive data.

So which one do you need?

If you run production on AWS, turn on Security Hub (or at least its foundational standard) so you know when the live account drifts from a safe baseline, including changes nobody made through code. Add a code scanner on every pull request so application, dependency, secret and IaC problems are caught before they deploy. The two overlap only at the edges, mainly IaC, where the code scanner catches a misconfiguration before it exists and Security Hub catches it if it slips through or was created by hand.

Where ARGUS fits

ARGUS is the code side of this pair. One scan covers static analysis, dependency scanning, secrets, IaC (Terraform, CloudFormation, Azure ARM, Dockerfile, Kubernetes and Helm) and container base-image CVEs. Its Atlas view maps each API entrypoint to its handler and the sensitive data behind it, and Attack Paths ranks exploit chains from entrypoint to data. ARGUS does not scan your live AWS account; for runtime cloud posture, keep Security Hub. See how an ARGUS scan works.

Frequently asked questions

Is AWS Security Hub a vulnerability scanner?

Not on its own. Security Hub checks resource configuration against security standards and aggregates findings from other services. Vulnerability scanning of instances, container images, Lambda functions and code comes from Amazon Inspector, whose findings Security Hub displays.

Is GuardDuty plus Security Hub enough security for a startup on AWS?

They cover threat detection and cloud configuration well, but not the code you write. Flaws in your application, vulnerable packages and secrets in your repository need a code scanner and, before major launches, a penetration test.

Does AWS Security Hub scan Terraform?

No. Security Hub evaluates resources after they are deployed. To check Terraform or CloudFormation before deployment, use an IaC scanner in your pull requests; Amazon Inspector Code Security also offers IaC scanning for connected repositories.

Can a code scanner replace Security Hub?

No. A code scanner cannot see resources created outside code, drift in the live account or active threats. Use both.

Our read

"We're on AWS and we have Security Hub" is a good answer to "is our cloud configured safely?" and a weak answer to "is our product secure?" The second question lives in the code, where the cheapest place to fix it is the pull request. Treat the two as layers with different jobs, not competitors for the same budget line.

Related reading: SBOM for startups · How to secure a CI/CD pipeline on GitHub Actions · What is infrastructure-as-code security?