{"resourceId":"aws-security-hub-network-scanning-govcloud-20261105","versions":[{"version":"external-bee3ffef4eb60012e810b6063a7550678b61d74eba6646612cf919fbb72ef236","resource":{"id":"aws-security-hub-network-scanning-govcloud-20261105","title":"AWS Security Hub Network Scanning now available in AWS GovCloud (US) to probe actual internet reachability of resources","organization":"Amazon Web Services","sector":"Cloud security / government cloud","geography":"United States (AWS GovCloud US Regions)","publishedAt":"2026-11-05","publicationDate":"2026-11-05","eventDate":"2026-11-05","sourceName":"AWS What's New","sourceLabel":"AWS Security Hub Network Scanning now available in AWS GovCloud (US)","sourceUrl":"https://aws.amazon.com/about-aws/whats-new/2026/11/security-hub-network-scanning-govcloud/","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["data-security","infrastructure","governance-procurement"],"finding":"AWS says Security Hub Network Scanning is now supported in AWS GovCloud (US). The feature probes resources from the internet to detect actual reachability, not only what security groups and route tables suggest could be reachable. It discovers public IPs, VMs and load balancers, identifies reachable ports and services, and emits findings that Security Hub Exposures can correlate. Existing customers enable it per account/Region or via organization configuration policy; it is on by default for new Security Hub customers. AWS says it is included with Security Hub Essentials at no additional cost in commercial and GovCloud Regions that support Security Hub. No independent evaluation or SLED case study is provided.","sledRelevance":"Directly relevant to state, local and education teams running AI and other workloads in GovCloud who need continuous evidence of internet-exposed assets beyond static network-config analysis.","evidence":"Primary AWS product announcement; vendor claims only.","architectureImplications":"Active external probing complements control-plane reachability findings; organization-wide enablement via configuration policy.","governanceImplications":"Enabling active scanning may require change control and authorization to probe production resources from AWS-owned IPs.","securityPrivacyImplications":"Produces findings with evidence of reachable ports/services; reduces blind spots versus rule-based analysis alone, per vendor.","caveats":"Vendor announcement only; no measured false-positive rates, scan frequency details in this page, or customer outcomes.","streamIds":["aws"],"roles":{"sales":"For GovCloud customers already on Security Hub, Network Scanning is a concrete capability gap-fill: actual internet reachability evidence without a separate scanner SKU, per AWS. Discovery should confirm Essentials entitlement and change-control appetite for active probing. Do not promise fewer breaches or audit pass rates. A bounded engagement is enablement in a non-prod GovCloud account with a finding-triage runbook. Confirm whether the customer already pays for Essentials before pitching net-new spend.","engineering":"Fits agencies with Security Hub in GovCloud that need confirmation of publicly reachable EC2/EIP/LB resources. Integrate by enabling Network Scanning per account/Region or org configuration policy; correlate via Exposures. Prerequisites: Security Hub enabled, authorization for active scans. Constraints: AWS-owned probe IPs; ephemeral resources may be missed. Security value is evidence-backed reachability findings. Proof of value: compare findings to known public assets and prior CSPM results.","delivery":"Roll out in a pilot GovCloud account, then org policy. Dependencies: Security Hub Essentials, IAM/org admin, SOC triage. Ownership: cloud security team. Skills: finding prioritization and remediation playbooks. Governance: change ticket for active scanning, data-handling of banners/headers. Acceptance proposals: all known public IPs appear in findings within 24 hours; high-severity open ports have owners. Risks: alert fatigue and unauthorized enablement in sensitive accounts."},"roleDetails":{"sales":{"customerProblem":"GovCloud security teams need evidence of what is actually reachable from the internet, not only what security groups allow.","stakeholders":["CISO","Cloud security engineer","SOC lead","AWS Organizations admin"],"discoveryQuestions":["Is Security Hub Essentials already entitled in GovCloud?","Which accounts authorize active external scanning?","Who owns remediation of newly confirmed open ports?"],"valueHypothesis":"Native Network Scanning may replace or reduce a third-party external scanner for AWS assets; effectiveness unproven here.","potentialEngagement":"Pilot enablement in one GovCloud account plus a finding-triage and remediation runbook.","unsupportedClaims":["Breach reduction","Audit certification outcomes","False-positive rates"]},"engineering":{"fit":"Strong fit for GovCloud Security Hub customers with internet-facing AI or citizen workloads.","architectureIntegration":"Enable Network Scanning; use Exposures correlation; remediate confirmed open ports on EC2/EIP/LB resources.","prerequisites":["Security Hub in GovCloud","Org or account enablement rights","Change authorization for active probing"],"constraints":["Ephemeral resources may be missed","Probe originates from AWS-owned IPs","Azure public IPs mentioned in broader docs are out of scope for this AWS-stream item"],"security":"Findings include evidence of reachable ports and services; treat scan metadata per agency logging policy.","proofOfValue":["Reconcile findings to known public inventory","Compare against prior CSPM reachability findings","Time-to-detect for a deliberately exposed test port"]},"delivery":{"work":"Pilot enablement and SOC runbook for Network Scanning findings.","dependencies":["Security Hub Essentials","Organizations configuration policy","SOC tooling"],"ownership":"Cloud security / SOC with account-owner remediation.","skillsAdoption":"Security Hub operations, network remediation, ticket triage.","governanceCheckpoints":["Change ticket approving active scans","Pilot account sign-off","Org-wide policy review"],"acceptanceCriteria":["Proposed: known public assets appear in findings within stated scan window","Proposed: every high-severity open port has an assigned owner","Proposed: undocumented public listeners remediated or accepted in writing"],"risks":["Alert fatigue","Unauthorized scanning in sensitive accounts","Assuming config-only tools are obsolete"]}},"retrievedAt":"2026-11-06T04:07:25Z","enrichedAt":"2026-11-06T04:11:32Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"None reported.","procurementImplications":"Included with Security Hub Essentials at no additional cost per announcement; confirm Essentials entitlement in existing contracts.","operatingModelImplications":"Existing customers must opt in; new customers get it by default. Expect finding triage workflows.","sourceVerification":{"openedUrl":"https://aws.amazon.com/about-aws/whats-new/2026/11/security-hub-network-scanning-govcloud/","referenceExcerpt":"AWS Security Hub Network Scanning feature is now supported in AWS GovCloud (US).","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}