Enable threat detection and vulnerability scanning

Unlike most compliance controls, the detection services in this group have genuine, recurring costs. GuardDuty is billed by the volume of events and logs it analyses, typically low hundreds to low thousands of dollars a month per account. Inspector is a flat per-resource fee, roughly a dollar per EC2 instance per month plus per-image and per-function rates. Macie's bucket inventory is effectively free, but its sensitive-data discovery is metered at roughly a dollar per GB scanned. ECR scanning on the basic tier is included; enhanced scanning via Inspector is billed per image. Always re-check the current rates before a fleet-wide rollout.

The framing that matters is that each of these is an insurance premium, small and predictable, against a loss that is large and unpredictable. A compromised account running mining instances can burn tens of thousands of dollars in compute over a weekend; an unpatched CVE leading to a breach runs into six and seven figures. The detection bill is the cost of finding out early instead of finding out on the invoice or in a regulator's inbox.

The cost is also self-sizing. Busy production accounts, which carry the most risk, cost the most to monitor; quiet accounts and idle Regions cost almost nothing. That means the all-accounts, all-Regions posture is far cheaper than people assume. The finance role is to make detection a named, expected line in the security budget rather than mystery spend that gets proposed for cutting, and to scope the metered parts (Macie discovery especially) by risk rather than scanning everything blindly.

Devin brings the detection plan to his finance partner because, unlike most compliance work, this group carries a real recurring bill. The partner does not flinch at the line; she reframes it. GuardDuty is billed by the volume of events and logs it analyses, Inspector is a flat per-resource fee of roughly a dollar per EC2 instance per month plus per-image and per-function rates, and Macie's bucket inventory is effectively free while its sensitive-data discovery is metered at roughly a dollar per GB scanned. Each of these is an insurance premium, small and predictable, against a loss that is large and unpredictable: a hijacked account mining crypto can burn the entire annual detection budget in a single weekend.

What persuades the partner to fund the all-accounts, all-Regions posture is that the cost is self-sizing. Busy production accounts, which carry the most risk, cost the most to monitor; quiet accounts and idle Regions cost almost nothing, which is exactly why attackers prefer to hide there. So blanket coverage is far cheaper than people assume. Her conditions are two: make detection a named, expected line in the security budget rather than mystery spend that gets proposed for cutting, and scope the one genuinely large meter, Macie sensitive-data discovery, by risk rather than scanning everything blindly. The base detectors and per-resource scanners go everywhere; the metered discovery is a deliberate, tiered decision.

These are among the few security controls with a genuine recurring price tag, which makes them tempting to treat like any other line to optimise. The right frame is the opposite: the premium is small relative to the loss it covers. A typical organisation spends low thousands of dollars a month across detection per busy account, while a single hijacked account mining crypto can burn that entire annual budget in a weekend, before any breach-response cost.

Because pricing is usage-based and per-resource, the cost is self-sizing in a useful way. Production accounts cost the most to monitor and carry the most risk; idle Regions and quiet accounts cost almost nothing. That makes the all-accounts, all-Regions recommendation far cheaper than people assume, and the per-account free trials and published per-resource rates let you forecast before committing.

The budgeting move is to make detection a named, expected line rather than mystery spend, and to scope the one genuinely large meter, Macie sensitive-data discovery, by risk: scan the operational buckets where shadow PII hides, sample the petabyte data lakes, and do not scan everything blindly. The base detectors and per-resource scanners stay everywhere; the metered discovery is a deliberate, tiered decision.

Detection is the layer that turns a breach from something you discover weeks later, by accident, into something an automated alert tells you about in minutes. GuardDuty watches for signs of compromise, Inspector scans servers and images for known vulnerabilities, and Macie finds sensitive data you did not know you held. The report shows each as a separate finding, but the question is one: are these services on, everywhere?

The leadership question is not just "are we compliant today?" It is "if an account is compromised tomorrow, will we learn about it from an alert or from the bill?" The defensible end state is that detection is enabled across every account and Region, stays on automatically for new accounts, and feeds findings to an owner with a response SLA.

This is the rare security category with a real, defensible price tag. It should be funded deliberately as insurance, not minimised reflexively. The number to track is coverage, not cost: are we at 100% of accounts and Regions, and does coverage survive growth?

The detection controls reached the executive table because they are rated High and because the cost question, this is the rare security category with a real price tag, makes them tempting to minimise reflexively. Leadership reframed the trade. The cost of getting this wrong is large and well documented: an account compromised and discovered weeks later, by accident, on the bill or in a regulator's inbox. The cost of getting it right is a modest, predictable, usage-based bill plus the discipline to act on what the services find. That is the class of control leadership should be quickest to approve and slowest to reverse.

The end state the executives set was about coverage, not cost: detection enabled across every account and Region, staying on automatically for new accounts via auto-enable, with findings feeding an owner who has a response SLA. The number they chose to track was the coverage rate, are we at 100% of accounts and Regions, and does that survive growth, rather than the monthly spend. The honest nuance they accepted is that this is genuine security spend that should be funded deliberately as insurance, because a scanner that is off in the Region that matters is worth nothing the moment it counts.

Detection being off means the organisation has no automated way to learn it has been breached until the damage is visible, on the bill, in the data, or in a regulator's inbox. That is why these controls are rated High and why coverage, not cost, is the number to track. The honest nuance is that this is real security spend with a defensible, usage-based price that should be funded deliberately.

The cost of getting this wrong is large and well documented; the cost of getting it right is a modest, predictable bill plus the discipline to act on what the services find. This is the class of control where the risk of inaction is severe and the cost of action is bounded and forecastable, which is exactly the trade leadership should be quickest to approve and slowest to reverse.