Latest / The Cloud Business Podcast with Fexingo: AWS, Azure, GCP, and Enterprise Infrastructure / Why Cloud Contracts Now Charge for Security Finding Ingestion
Transcript
- Lucas: Let's talk about a cloud cost that's quietly growing for a lot of organizations: ingesting security findings. If you've run a compliance scan in AWS in the past 18 months, you might have noticed a new line item on your bill called 'Finding Ingestion Charges'. Luna: That's from AWS Security Hub, right? I've seen clients get surprised by it because it's not a service they explicitly turned on—it's often enabled by default with Security Hub. Lucas: Exactly. Security Hub became a requirement for many compliance frameworks, like SOC 2 and PCI DSS. But what's less obvious is that it charges per finding, per account, per region. And when you have hundreds of accounts and dozens of regions, those cents add up fast. Luna: So break down the pricing for us. What's the per-finding cost? Lucas: The current baseline is $0.0003 per finding for the first 100,000 findings per month, then it drops to about $0.0001 per finding after that. That sounds tiny until you do the math. Let's say you run 100 accounts across 3 regions, and each account generates about 5,000 findings per day from GuardDuty, Inspector, and Config rules combined. Luna: That's 1.5 million findings per day, just on that calculation. Right, 100 accounts times 3 regions times 5,000 findings is 1.5 million daily. Lucas: Exactly. Over a 30-day month, that's 45 million findings. At $0.0003 each for the first 100,000, and then $0.0001 for the rest, you're looking at about $4,500 per month just for ingestion. And that's not counting the storage or API call costs. Luna: And that's only Security Hub. Most organizations run multiple security tools that feed into it, so volumes can be much higher. Lucas: Which is exactly why this episode matters. We've covered a lot of cloud billing shocks on this show—from Terraform plan caching to inter az data transfer—and finding ingestion is another one that can fly under the radar until the bill arrives. Luna: And speaking of why we dig into these details—this is exactly the kind of insight we want to keep sharing without any ads or sponsors. If you find these conversations useful for what you're building or running, supporting the show at buy me a coffee dot com slash fexingo helps us stay independent. Lucas: No pressure at all. We're committed to keeping this free and ad-free, so even a small contribution makes a difference. Appreciate anyone who chips in. Luna: Okay, back to those costs. So what can teams do to reduce their Security Hub spend without compromising security? Lucas: The first step is to use suppression rules. You can filter out low-severity findings, like informational or low-level ones from services that generate noise. For example, many Config rules generate findings for non-critical resources that you don't need in Security Hub. Luna: But you have to be careful not to miss something important. There's a trade-off between cost and coverage. Lucas: Absolutely. Another approach is to consolidate findings using custom insights. Instead of ingesting every raw finding, you can aggregate similar ones into a single insight. That reduces the count without losing alerting capability. Luna: Or you could target only critical accounts and regions. Not every account needs to feed into Security Hub if it's a dev sandbox with no sensitive data. Lucas: Right. And then there's the consolidation option: cross-region aggregation. Security Hub allows you to designate one region as the aggregator. That way, you only pay for ingestion in that central region, but you still get a global view. Luna: What about alternatives? Azure Defender and Google Security Command Center have different pricing models. Lucas: Azure Defender charges per resource per month—like per server or per database. It's more predictable if your resource count is stable. Google SCC charges per asset per month, with a $5 per asset per month for the premium tier. But both also have additional fees for finding ingestion, though they are less granular than AWS. Luna: So for a multi-cloud shop, the cost drivers can be very different. AWS is volume-based, Azure is resource-based, Google is asset-based. Lucas: Exactly. And that's why you need to model your environment. A scenario with lots of short-lived containers generating findings will hit AWS harder, while a stable set of VMs might be cheaper under Azure. Luna: Are there any industry benchmarks for what's typical? Like, what percentage of cloud spend goes to Security Hub? Lucas: I've seen estimates that for heavily regulated industries, Security Hub costs can account for 1 to 3 percent of total cloud spend. That might not sound like much, but for a million-dollar cloud bill, that's $10,000 to $30,000 a year just on finding ingestion. Luna: And that's before you add the cost of the security tools themselves. GuardDuty and Inspector have their own pricing. Lucas: Right. So the key takeaway is: monitor your finding volume, set up budget alerts for Security Hub, and regularly clean up suppression rules. As compliance requirements keep expanding, these costs will only grow. Luna: It's one of those classic cloud cost surprises. But at least now we have a handle on the numbers. Lucas: Exactly. And if you want a deeper dive on any specific strategy, we can cover that in a future episode. For now, check your Security Hub dashboard—you might be paying for more than you think. Luna: And if you have a cost optimization story to share, let us know. We might feature it on the show.