Keel
Start the demosBook a call

Is Amazon GuardDuty worth turning on for a small startup?

By the Keel team · Last checked · 4 min read

Short answer

Amazon GuardDuty is usually worth turning on for a small startup that holds customer data on AWS, because it watches your account activity, network flow logs and DNS logs for signs of compromise with almost no setup, and the first 30 days are free. Its price rises with how much data it analyses, so switch it on, check the cost during the trial, and set a budget alert.

  • 30 days

    Free trial for each new account in each Region

    Source: AWS GuardDuty pricing, Oct 2026

  • 3

    Foundational data sources: CloudTrail events, VPC Flow Logs and DNS logs

    Source: AWS GuardDuty pricing, Oct 2026

What does Amazon GuardDuty do?

Amazon GuardDuty is a threat detection service that analyses data from your AWS account and raises findings when something looks malicious or unusual.

Its foundational sources are AWS CloudTrail management events, Amazon VPC Flow Logs and DNS query logs, and it can be extended to other data such as storage and workloads.

It is not antivirus or a firewall. It does not block anything by itself. It tells you that something suspicious happened, such as credentials being used from an unusual place, so a person or an automated process can respond.

What does Amazon GuardDuty cost?

Amazon GuardDuty pricing is based on the volume of data it analyses: CloudTrail management events are charged per million events a month, and VPC Flow Logs and DNS query logs are charged per GB a month.

New accounts get a 30-day trial on the AWS Free Tier in each Region where GuardDuty has never been enabled.

Because the bill depends on your activity, the cost for a small startup is hard to state in advance. That is why the trial is useful: it shows your real usage before you pay anything. Check current prices on the GuardDuty pricing page rather than relying on anyone's quoted figure.

When is GuardDuty worth it for a small startup?

GuardDuty is worth it for a small startup when a compromised AWS account would be costly: you hold customer data, you have enterprise customers asking about security, or you have no one watching account activity day to day.

For these teams the extra visibility is cheap compared with the cost of missing an intrusion.

Turn it on when

  • You store customer or payment-related data on AWS.
  • Enterprise customers ask about threat detection.
  • Nobody reviews CloudTrail or account activity regularly.
  • You use long-lived access keys that could leak.

It can wait when

  • The account is a throwaway sandbox with no real data.
  • You have not yet fixed the basics, such as MFA and least-privilege access.
  • Nobody will read or act on the findings.

What does GuardDuty not do?

GuardDuty does not fix misconfigurations, patch software, stop an attack or replace a security programme.

It detects suspicious behaviour in the data it can see, and findings only help if someone reads and acts on them.

Under the AWS shared responsibility model, you remain responsible for security in the cloud: access control, configuration, patching and your own application. GuardDuty is one control that supports that work. The guide to an AWS infrastructure audit for a small SaaS covers the settings it will not check for you.

How do you turn on GuardDuty without a surprise bill?

Turn on GuardDuty without a surprise bill by enabling it during the free trial, reading the usage and estimated cost AWS shows during those 30 days, and setting a budget alert for the service before the trial ends.

Then decide whether to keep it, and which extra protections to enable.

  1. Enable GuardDuty in the Regions where you actually run workloads.
  2. Send findings to a channel or email that more than one person reads.
  3. Check the cost shown in the console after a week and again before day 30.
  4. Add a budget for GuardDuty, as in how to stop a surprise AWS bill.
  5. Agree which severity of finding needs action the same day.

Who should respond to GuardDuty findings in a small team?

A named person should respond to GuardDuty findings, with a deputy, and the team should agree in advance what to do for each severity.

A finding nobody owns is the same as no GuardDuty at all.

For high-severity findings, such as credentials used from an unexpected place, the first steps are usually to disable the access, rotate the keys and check CloudTrail for what else happened. Write those steps down before you need them, and keep them with your other runbooks. The monthly AWS cost review checklist is a good place to add a monthly look at open findings.

Are you ready to get value from GuardDuty?

Tick each item that is true today.

  • MFA is on for the root user and every person with console access.
  • No long-lived access keys sit in CI or on laptops.
  • A named person and a deputy will read the findings.
  • Findings go to a shared channel, not one inbox.
  • A budget alert exists for GuardDuty spend.
  • A written first-response plan exists for a high-severity finding.

Decision point: Five or six ticks: turn it on and use it. Three or fewer: fix access basics first, then enable it so the findings mean something.

Sources

  1. AWS, Amazon GuardDuty pricing (checked October 2026)
  2. AWS, Shared Responsibility Model (checked October 2026)
  3. AWS docs, Detecting unusual spend with AWS Cost Anomaly Detection (checked October 2026)
  4. AWS docs, Managing your costs with AWS Budgets (checked October 2026)

Keep reading

Keel is an AWS release and recovery operations service for SaaS teams of 3 to 15 developers, provided by Bargainn Services Ltd, a UK company registered at Companies House (16497746). Registered office: 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom.