I've been running security posture for a multi-account AWS setup for three years. We started with Security Hub, then did a POC with InsightCloudSec (formerly DivvyCloud). The sales pitch is always "unified view, more controls, better automation." The reality is more nuanced.
Security Hub gives you the CIS benchmarks, some compliance standards, and findings from other AWS services like GuardDuty. It's decent for a baseline, and the integration is seamless because it's native. But its automation is weak—mostly just sending findings to EventBridge. Custom actions require you to build everything yourself.
InsightCloudSec's main advantage is the breadth. It covers AWS, Azure, GCP, and even Kubernetes. The real question is if you need that. For my team, the killer feature was the automated remediation bots. Instead of just alerting on an S3 bucket being public, it can fix it based on a policy you define. The cost is significant, and you're adding another data pipeline and another query language to learn.
Here’s the trade-off, boiled down:
* If you're 90%+ on AWS and your team can build lightweight automations with Lambda and EventBridge, Security Hub with a well-tuned set of standards is probably sufficient. Your bottleneck will be operationalizing the findings, not getting more of them.
* If you're multi-cloud, or if your security team is understaffed and needs out-of-the-box automated remediation, InsightCloudSec can justify its cost. But be prepared for the overhead. You'll need to tune their hundreds of policies aggressively to avoid alert fatigue.
Don't underestimate the metric and finding overload. Both tools will drown you in noise if you just enable everything. Start with a focused goal: "Ensure no public S3 buckets" or "Enforce IAM password policy." Implement that goal completely in one tool before even looking at the other.
-- SRE Steve
latency is not a feature
Oh, the automated remediation part is super interesting. That's exactly the kind of thing my tiny team needs, we just don't have the bandwidth to build those Lambdas.
But that cost... yeah. Rough. Is the pricing per account or per resource? I'm trying to map that against our burn rate.
Yeah, the pricing is usually per cloud account. It gets steep fast if you've got dozens of AWS accounts, even if they're small.
The remediation is great, but double-check what's actually "out of the box" for your use cases. Some of those automated fixes require you to approve the underlying policies, which can get political if it touches IAM or networking.
Have you looked at how many recurring findings you actually get? If it's low, building a couple of Lambdas might still be cheaper than another SaaS subscription.
Attribution is my middle name
Agreed on the trade-off breakdown, especially on the 90% AWS threshold. Your point about "another data pipeline and another query language" is the hidden cost people miss.
Even if you're multi-cloud, I've seen teams buy a tool like InsightCloudSec but then only operationalize it for one provider because the learning curve and pipeline maintenance for the others isn't justified. You end up paying for breadth you don't actively use.
The cost calculation changes if you factor in engineer hours. If your team is already at capacity, the SaaS subscription can be cheaper than building and, more importantly, maintaining those Lambda automations for every new finding type. But you're right, it's political: automated remediation requires policy approvals that often stall in larger orgs. Security Hub's passivity is sometimes a feature, not a bug.
Right-size or die
Your point about bandwidth is spot on. That's the exact calculation a lot of teams miss.
The pricing is typically per cloud account, but watch the fine print on what constitutes an "active" account. For a small team, the real question becomes whether the recurring findings you'd automate justify the annual cost. Sometimes you're only dealing with a handful of repeat offenders.
If you haven't already, pull a report from Security Hub on your top 10 recurring findings by volume over the last quarter. That list is your starting point for calculating if building a few Lambdas would actually eat more hours than you think.
- GG