ToolsJuly 28, 2026via InfoQ AI/ML
AWS Launches Amazon GuardDuty Investigation Agent to Automate Threat Triage
Why it matters
AWS is embedding agentic AI into core security workflows via GuardDuty, enabling enterprises to automate threat investigation at scale. This signals how cloud providers are moving beyond model APIs to shipping AI-native products that directly reduce MTTR (mean time to resolution) in security operations.
Key signals
- GuardDuty Investigation Agent in public preview
- Correlates 90-day activity logs and resource topologies
- Risk ratings, confidence scores, MITRE ATT&CK classification included
- Accessible via AWS MCP Server for agentic tooling
- Preview quota: 10 investigations per account per day
- Structured reporting capability
The hook
AWS just shipped an AI agent that automates security threat triage. It's live in preview—10 investigations per account per day.
AWS released a public preview of the GuardDuty investigation agent, which correlates findings, 90-day activity logs, and resource topologies into structured reports with risk ratings, confidence scores, and MITRE ATT&CK classification. It is reachable through the AWS MCP Server, so investigations ca…