New featureMedium

AWS Security Hub now offers Network Scanning to identify publicly reachable resources

AWS Security Hub introduces Network Scanning to identify resources actually reachable from the public internet, detecting public IPs, VMs, load balancers, open ports, and services behind them.

AWS Security Hub now introduces Network Scanning, a capability that identifies resources in your environment that are reachable from the public internet. Network Scanning probes your resources from the internet to detect actual reachability, not just what could be reachable based on security group rules and route tables. It discovers public IP addresses, virtual machines, and load balancers across your AWS and Azure environments, identifies reachable ports, and determines what services are running behind them. This complements Security Hub’s existing network reachability findings, which identify configurations that could make a resource reachable from the internet. Network Scanning confirms actual reachability from the internet. Each reachable port generates a Security Hub finding with evidence of the port and service discovered. Security Hub Exposures then automatically correlates these findings with other findings and resource configurations to determine broader risk.

Read the original AWS announcement

Related articles and terms

VPC Reachability AnalyzerA troubleshooting tool that statically analyzes network reachability between two resources within a VPC, identifying the cause of connectivity failuresVPC Network Access AnalyzerA security analysis tool that automatically analyzes network access paths across your entire VPC, detecting unintended internet exposure and excessive access permissionsSecurity Posture Management - Building a Unified Security Monitoring Foundation with AWS Security HubLearn about unified security monitoring with AWS Security Hub and automated threat detection through GuardDuty integration. This guide covers visualizing compliance with security best practices and security governance for multi-account environments.AWS Security HubA service that provides centralized visibility into the security posture of your entire AWS environment, performing automated assessments against industry-standard security benchmarks and aggregating findings.Automated Vulnerability Scanning with Amazon Inspector - Continuous Security Assessment for EC2, Lambda, and ECRAutomatically scan EC2 instances, ECR container images, and Lambda functions for vulnerabilities and prioritize them with CVE-based risk scores. Learn how to achieve agentless scanning through Systems Manager integration.