From the AWS edition of November 5, 2026
AWS Security Hub Network Scanning now available in AWS GovCloud (US) to probe actual internet reachability of resources
Amazon Web Services · Cloud security / government cloud · United States (AWS GovCloud US Regions)
- Publisher
- AWS What's New
- Original publication
- 2026-11-05
- Source retrieved
- 2026-11-06
- Event date
- 2026-11-05
What happened
AWS says Security Hub Network Scanning is now supported in AWS GovCloud (US). The feature probes resources from the internet to detect actual reachability, not only what security groups and route tables suggest could be reachable. It discovers public IPs, VMs and load balancers, identifies reachable ports and services, and emits findings that Security Hub Exposures can correlate. Existing customers enable it per account/Region or via organization configuration policy; it is on by default for new Security Hub customers. AWS says it is included with Security Hub Essentials at no additional cost in commercial and GovCloud Regions that support Security Hub. No independent evaluation or SLED case study is provided.
Why it matters
Directly relevant to state, local and education teams running AI and other workloads in GovCloud who need continuous evidence of internet-exposed assets beyond static network-config analysis.
Evidence and measured results
Primary AWS product announcement; vendor claims only.
Limitations and uncertainty
Vendor announcement only; no measured false-positive rates, scan frequency details in this page, or customer outcomes.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-06; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- GovCloud security teams need evidence of what is actually reachable from the internet, not only what security groups allow.
- Stakeholders
- CISO
- Cloud security engineer
- SOC lead
- AWS Organizations admin
- Discovery questions
- Is Security Hub Essentials already entitled in GovCloud?
- Which accounts authorize active external scanning?
- Who owns remediation of newly confirmed open ports?
- Value hypothesis
- Native Network Scanning may replace or reduce a third-party external scanner for AWS assets; effectiveness unproven here.
- Potential engagement
- Pilot enablement in one GovCloud account plus a finding-triage and remediation runbook.
- Unsupported claims
- Breach reduction
- Audit certification outcomes
- False-positive rates
Pre-sales engineering
Role takeaway
- Fit
- Strong fit for GovCloud Security Hub customers with internet-facing AI or citizen workloads.
- Architecture and integration
- Enable Network Scanning; use Exposures correlation; remediate confirmed open ports on EC2/EIP/LB resources.
- Prerequisites
- Security Hub in GovCloud
- Org or account enablement rights
- Change authorization for active probing
- Constraints
- Ephemeral resources may be missed
- Probe originates from AWS-owned IPs
- Azure public IPs mentioned in broader docs are out of scope for this AWS-stream item
- Security
- Findings include evidence of reachable ports and services; treat scan metadata per agency logging policy.
- Proof of value
- Reconcile findings to known public inventory
- Compare against prior CSPM reachability findings
- Time-to-detect for a deliberately exposed test port
Delivery
Role takeaway
- Work
- Pilot enablement and SOC runbook for Network Scanning findings.
- Dependencies
- Security Hub Essentials
- Organizations configuration policy
- SOC tooling
- Ownership
- Cloud security / SOC with account-owner remediation.
- Skills and adoption
- Security Hub operations, network remediation, ticket triage.
- Governance checkpoints
- Change ticket approving active scans
- Pilot account sign-off
- Org-wide policy review
- Acceptance criteria
- Proposed: known public assets appear in findings within stated scan window
- Proposed: every high-severity open port has an assigned owner
- Proposed: undocumented public listeners remediated or accepted in writing
- Risks
- Alert fatigue
- Unauthorized scanning in sensitive accounts
- Assuming config-only tools are obsolete
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Active external probing complements control-plane reachability findings; organization-wide enablement via configuration policy.
Governance
Who approves, reviews and stays accountable for outcomes?
Enabling active scanning may require change control and authorization to probe production resources from AWS-owned IPs.
Security and privacy
What data, permissions and controls need testing?
Produces findings with evidence of reachable ports/services; reduces blind spots versus rule-based analysis alone, per vendor.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
None reported.
Procurement
What should contracts, pricing and exit terms secure?
Included with Security Hub Essentials at no additional cost per announcement; confirm Essentials entitlement in existing contracts.
Operating model
Which teams own the service once it runs?
Existing customers must opt in; new customers get it by default. Expect finding triage workflows.
Publication history
- 2026-11-05AWS · Issue 084 resources
Stable resource ID: aws-security-hub-network-scanning-govcloud-20261105