Threat detection, posture & security operations
AWS Security Hub CSPM / AWS Security Hub vs Defender for Cloud CSPM (Foundational and Defender CSPM)
AWS Security Hub CSPM (the control checks formerly called Security Hub) maps to Defender for Cloud's free Foundational CSPM and the paid Defender CSPM plan.
The newer AWS Security Hub, which correlates findings into exposures, maps to Defender CSPM's attack path analysis and risk prioritization.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | AWS Security Hub CSPM AWS Security Hub | Defender for Cloud CSPM (Foundational and Defender CSPM) |
| Lifecycle | Generally available Generally available | Generally available |
| What it is | Cloud security posture management with automated control checks against standards such as AWS Foundational Security Best Practices, CIS, PCI DSS, and NIST (formerly just called Security Hub). Unified cloud security service that correlates findings from Security Hub CSPM, GuardDuty, Inspector, and Macie into prioritized exposures, with OCSF findings and response automation. | Posture management. Free Foundational CSPM gives secure score and Microsoft Cloud Security Benchmark recommendations, and paid Defender CSPM adds attack paths, the security explorer, agentless scanning, and regulatory compliance standards. |
| Pricing model | Security Hub CSPM is billed per security check and finding ingestion. The new Security Hub has its own resource-based pricing. | Foundational CSPM is free. Defender CSPM is billed per billable resource per month. |
| Docs | AWS Security Hub CSPM docs AWS Security Hub docs | Defender for Cloud CSPM (Foundational and Defender CSPM) docs |
| Pricing page | AWS Security Hub CSPM pricing AWS Security Hub pricing | Defender for Cloud CSPM (Foundational and Defender CSPM) pricing |
| Exams | SCS-C03 SOA-C03 | SC-500 SC-100 |
Key differences
- Standards. Security Hub CSPM runs checks for AWS Foundational Security Best Practices, CIS, PCI DSS, and NIST. Foundational CSPM uses the Microsoft Cloud Security Benchmark and secure score, and Defender CSPM adds regulatory standards, attack paths, the cloud security explorer, and agentless scanning.
- Naming. AWS renamed the original service Security Hub CSPM when it launched the new unified Security Hub. Older study material uses "Security Hub" for the control checks.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Security Hub CSPM is billed per security check and finding ingestion. The new Security Hub has its own resource-based pricing. AWS Security Hub CSPM pricing → AWS Security Hub pricing →
- Azure
- Foundational CSPM is free. Defender CSPM is billed per billable resource per month. Defender for Cloud CSPM (Foundational and Defender CSPM) pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| AWS Certified CloudOps Engineer – Associate SOA-C03 | AWS | Associate | current Replaces AWS Certified SysOps Administrator – Associate (SOA-C02), whose last exam day was Sep 29, 2025. Simplified Chinese and Korean versions retire after Nov 19, 2026. |
| Microsoft Certified – Cloud and AI Security Engineer Associate SC-500 | Azure | Associate | current New certification. A practice assessment isn't available yet, which the page says usually means the exam recently left (or is in) beta. |
| Microsoft Certified – Cybersecurity Architect Expert SC-100 | Azure | Expert | current English version updated Oct 21, 2026. |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
Verification notes
- AWS split Security Hub into Security Hub (unified exposure management) and Security Hub CSPM (control checks). Check which one a study source means.
FAQ
What is the Azure equivalent of AWS Security Hub CSPM and AWS Security Hub?
AWS Security Hub CSPM (the control checks formerly called Security Hub) maps to Defender for Cloud's free Foundational CSPM and the paid Defender CSPM plan. The newer AWS Security Hub, which correlates findings into exposures, maps to Defender CSPM's attack path analysis and risk prioritization.
How does pricing compare between AWS Security Hub CSPM and AWS Security Hub and Defender for Cloud CSPM (Foundational and Defender CSPM)?
AWS: Security Hub CSPM is billed per security check and finding ingestion. The new Security Hub has its own resource-based pricing. Azure: Foundational CSPM is free. Defender CSPM is billed per billable resource per month. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Security – Specialty (SCS-C03); AWS Certified CloudOps Engineer – Associate (SOA-C03); Microsoft Certified – Cloud and AI Security Engineer Associate (SC-500); Microsoft Certified – Cybersecurity Architect Expert (SC-100).