AWS has released a public preview of the Amazon GuardDuty investigation agent, an AI-powered security tool designed to automate threat investigation workflows. The tool, which synthesizes security finding metadata, 90-day activity logs, and affected resource topologies, aims to reduce security investigation workflows from hours to minutes.
The announcement, first made in June 2026 as AI-powered investigations, was followed by a detailed walkthrough in July 2026 under the name "investigation agent." The tool is an add-on to the existing Amazon GuardDuty threat detection service, which continuously streams alerts about suspicious behavior. Security teams often struggle with alert fatigue and the manual overhead of correlating findings across fragmented accounts and logs. The agent is designed to address this by automating the correlation and analysis that security analysts currently perform manually, offering a way to cut through the noise of thousands of daily alerts.
The Investigation Problem
Clarke Rodgers, an employee in the Office of the CISO at AWS, framed the product's thesis on LinkedIn. "Security teams don't have a detection problem; they have an investigation problem," Rodgers said. The agent is designed to address this by automating the correlation and analysis that security analysts currently perform manually. This statement underscores a key shift in the industry, where detection tools have become prolific but the human effort required to investigate each alert remains a bottleneck.
The agent offers three scopes of analysis: Finding Analysis, which uses a 32-character finding ID; Account Analysis, which uses a 12-digit AWS account ID; and Organization Analysis, which can cover up to 100 member accounts. During the preview, Finding Analysis supports all Extended Threat Detection (XTD) findings and select foundational, S3, and Runtime findings. Extended Threat Detection connects related findings into attack sequences, while the investigation agent analyzes affected resources, IAM activity, and surrounding context. This means an analyst can start with a single suspicious finding and get a full picture of what happened, including which IAM roles were involved and what resources were touched.
Each analysis yields an overall risk rating ranging from Info to Critical, a confidence score, a MITRE ATT&CK classification, and CLI remediation steps. The tool is available in 10 commercial AWS regions, including US East (N. Virginia, Ohio), US West (Oregon), Canada (Central), Europe (Frankfurt, Ireland, London, Paris, Stockholm), and Asia Pacific (Tokyo). The MITRE ATT&CK classification is particularly useful for teams that map their security posture to industry-standard frameworks, as it allows them to quickly understand the tactics and techniques used in an attack.
Governance and Integration
The investigation agent can be triggered programmatically via AWS SDKs, the AWS CLI (using aws guardduty create-investigation), or EventBridge rules. EventBridge can also be used to automate downstream response pipelines from investigations. Additionally, the AWS MCP Server integration allows triggering investigations from Claude Desktop or a custom CLI agent runner using existing IAM credentials. This flexibility means that security teams can embed investigation capabilities directly into their existing workflows, whether they prefer scripting, infrastructure-as-code, or chat-based interfaces.
AWS states that investigation data and generated reports remain stored in the originating home region. However, compute inference may route to another region within the same geographic boundary via the Cross-Region Inference Service (CRIS), which powers Bedrock models for LLM inference. This regional routing is important for organizations with strict data residency requirements, as the data itself stays put but the processing may happen elsewhere within the same continent.
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
The MCP integration inherits governance questions, including which principal ran the investigation, context window retention, and transcript retention. AWS released the Loom reference platform in the same month to address these governance questions for agent deployments. Loom provides a framework for auditing and controlling agent behavior, which is critical as organizations begin to rely on AI-driven security tools that can make autonomous decisions.
Analyst Perspectives and Caveats
Sena Yakut, a cloud security architect and AWS Security Hero, provided analysis and caveats about the agent. "AI should assist the investigation, not replace it; human validation and decision-making essential before remediation," Yakut said. Yakut tested the agent against sample findings and noted that it returned low risk ratings on test resources as expected. This cautious approach reflects a broader industry sentiment that AI tools in security should augment human analysts, not replace them, especially when the stakes involve potential data breaches or system compromises.
Yakut identified the strongest fit for the tool in "organizations without a large security function." However, the preview limits constrain the tool to manual triage rather than automated response pipelines. The throttle limit is 10 investigations per account per day, with a cumulative maximum of 100 investigations per account during the preview phase. Failed investigations do not count toward these quotas. The article notes that these limits are described as a budget for manual triage, not automated response pipelines, and that the preview is scoped for analysts evaluating output, not systems acting on it.
The article also notes that what distinguishes the GuardDuty investigation agent is its scope rather than novelty, as it is bounded to GuardDuty's own finding corpus and AWS telemetry. Competitors in the space include Microsoft Security Copilot, which has shipped since 2024 for incident summarization across Defender and Sentinel, and Google Gemini-assisted investigation inside Security Operations. These competitors offer broader integration with multiple security tools, while the GuardDuty agent is deeply integrated with AWS's own ecosystem, which can be both a strength and a limitation depending on an organization's cloud strategy.
Pricing and Availability
Usage of the investigation agent is free during the preview period. The preview is currently available in 10 commercial AWS regions. The tool is designed for security analysts who need to triage findings quickly, but the current limits suggest it is not yet ready for large-scale automated response. The free pricing during preview allows organizations to test the tool without financial commitment, but the low investigation limits mean that only small teams or focused use cases can be evaluated.
The article notes that the preview limits sit awkwardly beside EventBridge integration, as the limits are a budget for manual triage, not automated pipelines. The preview is scoped for analysts evaluating output, not systems acting on it. This means that while the tool can generate insights, organizations must still manually review and act on those insights. For example, an EventBridge rule could trigger an investigation when a critical finding appears, but the resulting report would still need a human to read it and decide on remediation steps, rather than automatically executing a response.