GuardDuty Extended Threat Detection has added five new indicators to surface attack sequences

Amazon GuardDuty Extended Threat Detection correlates weak GuardDuty signals into a single, critical-severity attack sequence finding when their composition crosses a threshold of credibility. On May 20, 2026, the service started attaching five new indicator types to those sequences: MALICIOUS_PACKAGE , MISCONFIGURATION , REACHABILITY , SENSITIVE_DATA , and VULNERABILITY .

What happened

On May 20, 2026, the service started attaching five new indicator types to those sequences: MALICIOUS_PACKAGE , MISCONFIGURATION , REACHABILITY , SENSITIVE_DATA , and VULNERABILITY . For more information, see Document history for Amazon GuardDuty and Attack sequence finding details .

Where the sources line up

These indicators come from Amazon Inspector , Amazon Virtual Private Cloud (Amazon VPC) Reachability Analyzer , Amazon Macie , and posture data surfaced through AWS Security Hub . You might already run these services for other reasons, and now Extended Threat Detection folds their signals into attack sequence findings. This post is an operational guide for teams already running the prerequisite services and discusses what the new indicators look like in a finding, what the post-launch data shows, and how to fold them into your incident-response workflow.

Practical impact for readers

In GuardDuty, a signal is any event it evaluates when looking for suspicious activity. A weak signal is one that, on its own, doesn’t clearly point to a threat which the five new indicators fall into. A single Common Vulnerabilities and Exposures (CVE) finding on a host, for instance, tells you a vulnerability exists not that an attacker is exploiting it. These findings earn their value when GuardDuty correlates them with the suspicious-activity signals it already tracks, as shown in the following table:.

Who should pay attention now

The five values appear on the Indicators tab of the attack-sequence finding in the AWS Management Console for GuardDuty and in the GetFindings JSON file.

What is still unclear

A note on EPSS, because the VULNERABILITY indicator carries it. According to the FIRST EPSS overview , the score is the probability that a published CVE will be exploited in the wild in the next 30 days ranging from 0 to 1. EPSS doesn’t replace CVSS, which describes the inherent severity of a vulnerability, whereas EPSS describes how likely it is to be exploited soon making it the more useful number for incident response.

Source notes

AWS Security Blog