If you open the AWS console today and search for Security Hub, you may notice something slightly confusing:

• AWS Security Hub
• AWS Security Hub CSPM

At first glance, they sound like the same product.

That is partly because they used to be.

The Security Hub that many AWS engineers were familiar with — security standards, compliance checks, security scores, and aggregated findings — is now called AWS Security Hub CSPM.

Meanwhile, AWS has expanded AWS Security Hub into a broader security operations service that correlates signals from multiple security capabilities and helps security teams identify which risks actually matter.

AWS describes the newer Security Hub as a unified security operations solution that brings together security capabilities such as GuardDuty, Inspector, Security Hub CSPM, and Macie.

You can read more about this change in the AWS Security Hub announcement.

So the distinction is roughly:

Security Hub CSPM asks: "Is my AWS environment configured securely?"

while:

Security Hub asks: "Across all the security signals I have, what should I investigate first?"

Understanding that difference makes the new naming much easier to follow.

Why Are There Two Security Hub Services?

Historically, AWS Security Hub was primarily a Cloud Security Posture Management (CSPM) service.

It could continuously evaluate AWS resources against security standards such as:

• AWS Foundational Security Best Practices
• CIS benchmarks
• PCI DSS
• NIST frameworks

AWS documents these capabilities in the Security Hub CSPM User Guide.

It could also ingest findings from supported AWS services and third-party security products.

That original functionality did not disappear.

AWS renamed and positioned it as:

AWS Security Hub CSPM

AWS then expanded AWS Security Hub into a broader security operations layer.

The newer Security Hub can correlate different security signals — including vulnerabilities, misconfigurations, threats, and resource relationships — to help security teams identify higher-risk situations.

In other words, AWS separated two different security problems:

Security posture
      ↓
"Are my resources configured according to security best practices?"
      ↓
Security Hub CSPM
 
 
Security operations
      ↓
"Which combination of security signals creates the biggest risk?"
      ↓
Security Hub

These products therefore complement each other rather than compete with each other.

What Is AWS Security Hub CSPM?

AWS Security Hub CSPM, or Cloud Security Posture Management, continuously evaluates the security posture of your AWS environment.

According to the AWS Security Hub CSPM documentation, it provides a comprehensive view of your AWS security state and helps assess your environment against industry standards and AWS security best practices.

Its main job is finding things that are configured incorrectly or do not follow a security baseline.

Consider an S3 bucket.

Security Hub CSPM might evaluate questions such as:

Is public access blocked?
Is server-side encryption enabled?
Is access logging configured?
Are appropriate security controls passing?

For an EC2 environment, it might evaluate controls related to networking, encryption, IAM, logging, and other security best practices.

Most Security Hub CSPM controls use AWS Config rules to perform security checks. AWS explains this relationship in its documentation on configuring AWS Config for Security Hub CSPM.

A simplified flow looks like this:

AWS Resources
     │
     ▼
AWS Config
     │
     ▼
Security Hub CSPM Controls
     │
     ├── AWS Foundational Security Best Practices
     ├── CIS
     ├── PCI DSS
     └── NIST
     │
     ▼
Control Findings

Security Hub CSPM generates findings when security checks run. It can also consume findings from integrated AWS services and third-party products.

These findings are normalized using the AWS Security Finding Format (ASFF).

More details about the format are available in the AWS Security Finding Format documentation.

Example: What Security Hub CSPM Finds

Imagine you have an EC2 instance deployed in a production account.

Security Hub CSPM might identify:

EC2 instance
│
├── Security group allows unrestricted inbound traffic
├── EBS volume encryption is disabled
├── Instance does not use IMDSv2
└── Required security configuration is missing

Each issue can appear as a control finding.

AWS maintains a complete Security Hub CSPM control reference, which is useful when you want to understand exactly what a particular control evaluates.

From a security engineer's perspective, CSPM essentially helps answer:

"Where does my infrastructure deviate from the security baseline?"

This makes Security Hub CSPM particularly useful for:

• security posture reviews
• compliance assessments
• configuration monitoring
• cloud governance
• security audits
• multi-account security baselines

What Is AWS Security Hub?

The newer AWS Security Hub operates at a higher level.

Instead of looking mainly at individual configuration controls, Security Hub tries to understand the relationship between multiple security signals.

AWS describes the service as a unified security operations solution that combines signals across AWS security services and applies risk analytics to help prioritize security issues.

Source: How to develop an AWS Security Hub POC

For example, imagine the following signals exist:

Amazon Inspector
    │
    └── Critical vulnerability detected
              │
              ▼
EC2 Instance
              ▲
              │
Security Hub CSPM
    │
    └── Security misconfiguration
              ▲
              │
Network analysis
    │
    └── Instance is reachable from the Internet

Looking at those findings independently gives you several security signals.

But together they describe something much more important:

An Internet-reachable EC2 instance has a security misconfiguration and a serious software vulnerability.

That combination can represent substantially more risk than any individual signal viewed in isolation.

This is where Security Hub's exposure findings become useful.

AWS documents exposure findings in detail here:

Exposure findings in AWS Security Hub

Exposure Findings: One of the Biggest Differences

An exposure finding represents the correlation of multiple security signals that identify a potential security risk.

For example:

                 EC2 Instance
                      │
          ┌───────────┼───────────┐
          │           │           │
     Reachability Vulnerability Misconfiguration
          │           │           │
          └───────────┼───────────┘
                      │
                      ▼
               Exposure Finding

According to AWS, exposure findings can analyze combinations of:

• vulnerabilities
• configurations
• threats
• resource relationships

Signals can originate from Security Hub CSPM, Amazon Inspector, GuardDuty, Macie, and other AWS services.

This changes the security workflow significantly.

Instead of simply asking:

How many CRITICAL findings do I have?

you can start asking:

Which resources represent the most meaningful security risk?

This is one of the clearest differences between traditional CSPM and the newer Security Hub model.

Security Hub CSPM vs. Security Hub

The easiest way to understand the difference is to compare their responsibilities.

The important thing is that Security Hub is not simply "Security Hub CSPM version 2."

They operate at different layers.

A Useful Mental Model

I like to think of the AWS security stack this way:

                    Security Hub
            ┌─────────────────────────┐
            │ Correlation             │
            │ Risk prioritization     │
            │ Exposure analysis       │
            │ Security operations     │
            └────────────┬────────────┘
                         │
      ┌──────────────────┼───────────────────┐
      │                  │                   │
      ▼                  ▼                   ▼
Security Hub CSPM    Inspector           GuardDuty
      │                  │                   │
Misconfiguration    Vulnerability        Threats
Compliance          CVEs                 Suspicious
Controls            Packages             activity

Other security capabilities, including Amazon Macie, can also contribute signals depending on the resource and configuration.

Each service answers a different question.

Security Hub CSPM

Is this resource configured securely?

Amazon Inspector

Does this workload contain known vulnerabilities?

Amazon GuardDuty

Is suspicious or malicious activity occurring?

Amazon Macie

Is sensitive data exposed or at risk?

Security Hub

What do all these signals mean when considered together?

That last question becomes increasingly important as AWS environments grow.

Why Correlation Matters

Consider two EC2 instances.

Instance A

Critical CVE
Private subnet
No Internet route
Strong IAM restrictions

Instance B

High severity CVE
Publicly reachable
Overly permissive security group
High-privilege IAM role

If you simply sorted vulnerability findings by CVSS score, Instance A might appear first.

However, vulnerability severity alone does not represent the complete security context.

Instance B could require significant attention because multiple risk factors intersect around the same resource.

That is the problem Security Hub's exposure analysis is designed to help address.

Security Hub can analyze signals describing factors such as:

Vulnerability
      +
Network reachability
      +
Misconfiguration
      +
Resource relationships
      +
Threat signals

and use the combined context to help security teams prioritize investigations.

For more detail on how AWS builds these correlations, see How exposure findings work.

When Should You Use Security Hub CSPM?

Security Hub CSPM makes sense when the primary goal is configuration security and compliance.

A cloud security team may want to continuously check whether:

S3 buckets block public access
RDS databases use encryption
CloudTrail is configured
IAM security controls are followed
EC2 security groups are restricted
AWS Config is enabled

The team may also want to assess its environment against standards such as AWS Foundational Security Best Practices or CIS benchmarks.

That is a classic CSPM problem.

Security Hub CSPM is designed for this purpose.

AWS also provides an overall security score based on enabled controls and their associated security checks. More information is available in Understanding security controls in Security Hub CSPM.

When Should You Use Security Hub?

Security Hub becomes more useful when the question changes from:

"What security controls are failing?"

to:

"What security risks should my team investigate?"

An AWS environment can produce findings and security signals from multiple sources:

Security Hub CSPM
Amazon Inspector
Amazon GuardDuty
Amazon Macie
other security integrations

Reviewing each finding independently becomes increasingly difficult as the environment grows.

Security Hub provides the correlation and risk-analysis layer that helps identify cases where multiple security factors intersect around the same resources.

This is particularly useful for:

• security operations
• incident investigation
• cloud security operations
• vulnerability prioritization
• exposure management
• multi-account AWS environments

Should You Enable Both?

In many production environments, using Security Hub together with Security Hub CSPM provides significantly more context than using CSPM alone.

The relationship can be simplified as:

Security Hub CSPM
      │
      │ posture signals
      ▼
Security Hub
      │
      ├── correlate
      ├── enrich
      ├── prioritize
      └── generate exposures

Security Hub CSPM contributes information about security posture and misconfigurations.

Security Hub can combine that information with signals from services such as Inspector, GuardDuty, and Macie to build a broader view of security risk.

AWS describes this unified approach in AWS Security Hub is expanding to unify security operations across multicloud environments.

What About Pricing?

Pricing is another important consideration.

Security Hub now offers a unified pricing model through its Security Hub plans, while individual services such as Security Hub CSPM, Inspector, and GuardDuty can also have their own service pricing considerations.

The Security Hub Essentials plan provides capabilities around areas such as:

• security posture management
• vulnerability management
• threat detection
• identity analysis
• risk analytics

AWS also provides a Security Hub Cost Estimator, which can compare individual service pricing with Security Hub's unified pricing model.

Because AWS pricing can change and varies based on resource counts, workloads, Regions, and enabled capabilities, it is better not to hard-code pricing numbers into an article like this.

Instead, check the current sources:

• AWS Security Hub Pricing
• AWS Security Hub Cost Estimator

Which One Should You Choose?

A simple decision tree is:

What problem are you trying to solve?
                │
        ┌───────┴────────┐
        │                │
        ▼                ▼
Configuration        Security risk
& compliance         prioritization
        │                │
        ▼                ▼
Security Hub        Security Hub
CSPM                + CSPM

Choose Security Hub CSPM when:

Your main goal is:

• checking AWS configurations
• enforcing security baselines
• monitoring compliance
• running AWS FSBP / CIS / PCI / NIST controls
• identifying cloud misconfigurations
• measuring security posture

Use Security Hub with CSPM when:

Your environment has multiple security signal sources and you need:

• centralized security operations
• exposure management
• finding correlation
• vulnerability prioritization
• risk-based prioritization
• security response workflows

For environments where both posture management and broader security risk analysis matter, Security Hub and Security Hub CSPM are designed to work together.

Security Hub CSPM Finds Problems. Security Hub Connects the Dots.

The easiest way to remember the distinction is:

Security Hub CSPM
        ↓
Find insecure configurations
 
 
Security Hub
        ↓
Understand which combinations
of security signals create risk

Security Hub CSPM remains an important source of security posture information.

The newer Security Hub adds another layer above those signals: correlation, contextualization, exposure analysis, prioritization, and security operations.

So rather than thinking:

Security Hub
vs.
Security Hub CSPM

it is often better to think:

Security Hub CSPM
        +
Inspector
        +
GuardDuty
        +
Macie
        +
Other security signals
        ↓
Security Hub
        ↓
Prioritized security risk

Finding individual problems is relatively easy.

The harder problem is understanding how those problems relate to each other and deciding what deserves investigation first.

And that is the gap the newer AWS Security Hub is designed to address.

References

If you want to explore the services in more detail, these are the AWS resources I found most useful while writing this article:

• Introduction to AWS Security Hub CSPM
• AWS Security Hub CSPM Control Reference
• Understanding Security Controls in Security Hub CSPM
• Configuring AWS Config for Security Hub CSPM
• AWS Security Finding Format (ASFF)
• Exposure Findings in AWS Security Hub
• AWS Security Hub: Unified Security Operations
• AWS Security Hub Pricing
• AWS Security Hub Cost Estimator