From Security Hub findings to fixes, in your own AWS account.
Cloud Certainty Watchtower turns AWS Security Hub from a long list of findings into work your engineers can finish: instant search across every account and Region of your organisation, a fix list ranked by risk with Terraform, CloudFormation and CLI remediation, tasks with SLAs, exceptions that expire, and each finding mapped to the code that created it. It runs entirely in your AWS account, and nothing leaves it.
ONE CLOUDFORMATION STACK · YOUR ACCOUNT · YOUR IDP · EARLY ACCESS · PLANNED FROM $100 A MONTH
Not on AWS Marketplace yet. Early access by email: [email protected].
[ A ] WHAT THE SECURITY HUB CONSOLE LACKS, AND WHAT WATCHTOWER ADDS
Security Hub is good at collecting findings and poor at helping people work through them. Teams with thousands of findings end up exporting to spreadsheets, copying rows into Jira, suppressing what they can't fix and fixing in the console what the next deployment puts back. Watchtower covers the gaps and keeps everything in your account.
Search
The Security Hub console:Filters are a form, one field at a time: no free text search, no counts per value and no quick “not”.
Watchtower:Free text across titles, resources, accounts, CVEs, packages and tags, a query language such as severity:critical,high account:prod-* -workflow:suppressed, and filters with a count for every value.
Speed
The Security Hub console:Sorting on a few columns, pages of 20 to 100 rows, and every change reloads from the API.
Watchtower:Results from Watchtower’s own index in milliseconds, for hundreds of thousands of findings: sorting on every column, grouping, keyboard navigation, CSV export and bulk triage of up to 500 findings at once.
Fix list
The Security Hub console:One row per resource and control, so the same fix appears as 400 rows and nobody sees the list of fixes.
Watchtower:Findings grouped into issues by control and ranked by risk: severity, how many resources, how old and how exposed. A fix list, not a list of rows.
Remediation
The Security Hub console:A link to a documentation page. Engineers still work out the change themselves.
Watchtower:A remediation guide for about 60 of the most common controls, written for engineers: why it matters, console steps, AWS CLI, Terraform and CloudFormation.
Work tracking
The Security Hub console:Workflow status is the only state and a note is one line, so findings are copied into Jira by hand and lose the link back.
Watchtower:Tasks from findings or a whole issue, with an owner, a due date, comments and links. Progress is measured from the findings themselves, and the task closes when the last resource passes.
SLAs
The Security Hub console:No SLAs, no ageing and no mean time to remediate, so nobody can see whether the backlog is shrinking.
Watchtower:An SLA per severity (7, 30, 90 and 180 days by default), overdue findings in every view, ageing, and mean time to remediate per severity.
Accepted risk
The Security Hub console:Suppressions are permanent, and nobody reviews them again.
Watchtower:Exceptions with a scope, a reason and an expiry date, written back to Security Hub. When one expires or is revoked, its findings come back as new. Team and above
Code
The Security Hub console:No link to the code that created a resource, so a fix made in the console is undone by the next terraform apply.
Watchtower:Each finding mapped to the Terraform or CloudFormation block on GitHub that defines the resource, “defined in infra/s3.tf:12”. On Business and above, a fix preview and a pull request for common controls. Team and above
Scanners
The Security Hub console:Trivy, Checkov and SonarCloud live in another world: the same misconfiguration is reported twice, by two tools, to two teams.
Watchtower:Built-in Trivy scans, SonarCloud, and SARIF uploads from any CI scanner, mapped to the same Security Hub controls, so a problem is seen once, from code to cloud. Business and above
Access
The Security Hub console:Security Hub has no per-account permissions: whoever can read the delegated administrator sees every member account.
Watchtower:Grants per user or group on account and Region patterns, applied to every search, count and export. CloudTrail names the person behind every Security Hub call.
[ B ] THE FINDINGS EXPLORER
A sync worker keeps every finding of every connected account and Region in Watchtower’s own index, so a search answers in milliseconds instead of paging through the API. Details and history are still read live from Security Hub, and users see only the accounts and Regions they are granted.
- Search
- Free text with quoted phrases and -terms to exclude, and a query language with field aliases such as sev, acct, res, status and control. Every term must match.
- Facets
- Counts for every value of severity, state, workflow, account, Region, resource type, control, standard, product and tag. Selecting HIGH still shows how many are CRITICAL.
- Grouping
- Group by control, account, resource type or any facet field, with the severities in each group.
- Saved views
- A search with its filters, sort and columns, kept privately, or shared with the whole team on Team and above.
- Finding detail
- The full finding and its history, read live from Security Hub with your own session, beside its task, exception, code match and scanner findings.
- Triage
- Workflow status, notes and severity for up to 500 findings at once, written back to Security Hub with your name on every change.
- Organisation-wide
- Every account and Region, through one connection to the Security Hub delegated administrator and its aggregation Region.
severity:critical,high account:prod-* -workflow:suppressed "public access"- CRITICAL3
- HIGH41
- prod-core22
- prod-data14
- prod-edge8
- NEW37
- NOTIFIED7
[ C ] THE FIX LIST
Four hundred findings of S3.8 are one fix, not four hundred. Watchtower groups findings into issues by control and ranks them by risk: each open finding weighs by its severity, counts up to three times as much as it ages, and twice when the resource is publicly exposed. Work from the top.
- Every issue shows its open, suppressed and recently closed findings, the resources, accounts and Regions, and how many are overdue or publicly exposed
- Filters apply to the findings first, so account:prod-* gives you the fix list of production
- Each guide links the scanner rules for the same control, so Trivy AVD-AWS-0086 and Checkov CKV_AWS_53 land on S3.8
- One task for the whole issue: every open finding you can see is added, and progress counts down as resources pass
In every remediation guide
Why the control matters, the console steps, the AWS CLI command, and the Terraform and CloudFormation snippets, for about 60 of the most common controls. Every issue links the AWS documentation as well.
S3 general purpose buckets should block public access
- Severity HIGH
- Open findings 40 · 12 overdue
- Resources 38 in 6 accounts
- Oldest 94 days
- Code matches 31 in 2 repositories
- Automatic fix Terraform, CloudFormation
[ D ] TASKS, SLAS AND EXCEPTIONS
Tasks
From findings, a whole issue or scanner findings, numbered WT-1, WT-2 and on: an owner, a priority from the highest severity, labels, comments in Markdown and links to pull requests and issues.
Progress from the findings
Watchtower counts the resources that pass (12 of 38 fixed) on every sync, and closes the task when the last one does. No one has to remember to update it.
SLAs per severity
Critical in 7 days, high in 30, medium in 90 and low in 180 by default, all adjustable. A task is due on its earliest finding’s date, and overdue findings show everywhere.
Write-back
Mark a task’s findings NOTIFIED in Security Hub with the note “Tracked in Watchtower WT-42”, so the rest of AWS sees that someone owns them. On Team and above, open a GitHub issue from the task.
Exceptions that expire
An accepted risk scoped by control or issue, accounts, Regions and resources, with a reason and an expiry at most a year ahead by default. Preview what it matches before you save it. Team and above.
And come back
An active exception suppresses its findings, in Security Hub too. When it expires or is revoked, they return as new with a note. Every exception is visible to everyone and audited.
[ E ] CODE TO CLOUD
Connect GitHub and Watchtower indexes the Terraform and CloudFormation in your repositories, then shows each finding where its resource is defined. Fix it there, through a pull request, and the next deployment keeps it fixed instead of undoing it.
How a finding finds its code, best match first
- Source tags
- git_repo and git_file tags from yor, or a watchtower:source tag, point at the file
- CloudFormation logical ID
- The stack name and logical ID tags every CloudFormation resource carries
- Physical name
- The bucket, role or function name in the code, with interpolations as wildcards
- Type in the account’s repository
- The only resource of that type in a repository that deploys the account, at low confidence
Scanners, correlated with the cloud Business and above
- Trivy, built in: misconfiguration, secret and dependency scans of your repositories, run daily on Fargate from the Watchtower image, with no network access but its database
- SonarCloud and SonarQube: open vulnerabilities, bugs and security hotspots of each mapped project
- SARIF 2.1.0 or Trivy JSON from any CI pipeline (Checkov, tfsec, KICS, Semgrep), posted with an ingest token scoped to the repository
- Mapped to Security Hub controls: a cloud finding shows “also flagged by Trivy in infra/s3.tf:12”, and a scanner finding shows the cloud findings it will turn into
--- a/infra/s3.tf
+++ b/infra/s3.tf
@@ -12,3 +12,11 @@
resource "aws_s3_bucket" "logs" {
bucket = "acme-prod-logs"
}
+
+resource "aws_s3_bucket_public_access_block" "logs" {
+ bucket = aws_s3_bucket.logs.id
+ block_public_acls = true
+ block_public_policy = true
+ ignore_public_acls = true
+ restrict_public_buckets = true
+}watchtower/fix-s3.8-…, linked to the task. Mapping is on Team and above; fix
pull requests on Business and above.[ F ] OVERVIEW AND COMPLIANCE
The questions a security lead is asked every week, answered from the same index and the same grants: is the backlog shrinking, how fast do we fix things, and which accounts need attention first.
Open by severity
Open and suppressed findings, new and closed in the last 7 days, for everything you may see or any saved view.
Trends
New against closed per day and open by severity over time, kept from 30 days on Starter to two years on Enterprise.
Mean time to remediate
The median days from first seen to closed, per severity, for findings closed in the last 30 days.
Ageing and SLAs
Open findings by age (up to 7, 30, 90 and 180 days, and older) and overdue against your SLA, with open and overdue tasks.
Accounts by risk
The 50 riskiest accounts, with their open findings by severity and what is overdue, and the ten issues that matter most.
Compliance
Pass rates per enabled standard and per control, across the accounts and Regions you are granted, with the failing accounts of each control.
[ G ] SECURITY
Nothing leaves your account
Cloud Certainty runs no service in the data path, and Watchtower sends no telemetry. The stack calls AWS, the code hosts you configure, and optionally once a day a public release manifest.
Grants on every read
Security Hub has no per-account permissions, so Watchtower applies account and Region grants to every search, count, facet, issue, export and detail. A finding outside your grants does not exist for you.
AWS bounds every session
Each connection role is Read or Triage, set by the account owner. A user without triage gets a session policy that cannot call BatchUpdateFindings, so AWS refuses the change even if a check in Watchtower had a bug.
Fixes change code, not infrastructure
A fix is a small, tested edit for one control, committed to a new branch and offered as a pull request. Watchtower never merges or applies anything; your review and your pipeline decide.
Tokens stay secret
GitHub and SonarCloud tokens are write-only, kept in Secrets Manager under your KMS key, and never returned or logged. SARIF ingest tokens are scoped to a repository, shown once and revocable.
Audit
CloudTrail names the person on every Security Hub call, and the audit log keeps triage, tasks, exceptions, pull requests and administrative changes for 30 days to 10 years by plan.
The security overview has the threat model, the IAM roles, the data flows and the shared responsibility a security review needs.
[ H ] RUNS IN YOUR ACCOUNT, FROM LAUNCH TO THE FIRST FIX
- 01
Deploy
Launch one CloudFormation stack in your own account and Region. It is serverless: between syncs it costs close to nothing.
Stays in your account
The findings index, trends, tasks, exceptions, saved views, code indexes, scan results and the audit log are in DynamoDB and S3 in your account. Nothing is sent to Cloud Certainty.
Licensed through AWS
The licence is read from AWS License Manager in your own account. Nothing phones home.
- 02
Sign in
Users sign in through Amazon Cognito with MFA or AWS IAM Identity Center on every plan, or your own SAML or OIDC provider, such as Microsoft Entra ID or Okta, on Team and above.
Only trusted identities
Roles and grants follow the user’s email, so Watchtower accepts only emails your directory asserts or has verified.
- 03
Connect Security Hub
Deploy a small role in your Security Hub delegated administrator account. With cross-Region aggregation, one connection covers every member account and Region.
The role is the ceiling
At the Read level Watchtower can only read findings. Triage adds updating workflow, notes and severity, and nothing else: no IAM, CloudFormation or S3 writes in your accounts.
- 04
Grant and fix
Give each team view, triage or fix on its accounts and Regions. They search, triage, track and fix without access to the AWS console.
Scoped on every request
Grants filter every search and count. Each Security Hub call runs with short-lived credentials, and a session without triage can’t change a finding.
Every change traced
The user’s email is the source identity of every session, so CloudTrail names the person.
One stack: a serverless API (API Gateway and Lambda), a sync worker Lambda, the web app on Amplify Hosting, Amazon Cognito sign-in, two DynamoDB tables, a private data bucket for the index, and a Fargate task for Trivy scans. The installation guide lists every parameter.
[ I ] PLANS AND PRICING
The pricing planned for the AWS Marketplace launch: contract pricing, monthly or 12 months up front. Plans are not priced per user or per finding: everyone in your organisation can use Watchtower. Prices in US dollars, billed through your AWS bill.
Starter
For a small team that needs what the Security Hub console lacks most: fast search, the fix list with remediation code, tasks and SLAs.
- Monitored AWS accounts
- 10
- Connections
- 2
- Fastest sync
- 60 minutes
- Trend history
- 30 days
- Audit log kept
- 30 days
Team
Adds shared views, exceptions that expire, findings mapped to your code on GitHub, GitHub issues and your own SAML or OIDC sign-in.
- Monitored AWS accounts
- 50
- Connections
- 10
- Fastest sync
- 15 minutes
- Trend history
- 90 days
- Audit log kept
- 90 days
Business
Adds automation and shift-left: fix pull requests, Trivy, SonarCloud and SARIF findings correlated with the cloud, and the IP allowlist.
- Monitored AWS accounts
- 250
- Connections
- 50
- Fastest sync
- 5 minutes
- Trend history
- 365 days
- Audit log kept
- 365 days
Enterprise
Everything in Business, with no limit on accounts, connections, views or repositories, two years of trends and ten years of audit log.
- Monitored AWS accounts
- Unlimited
- Connections
- Unlimited
- Fastest sync
- 5 minutes
- Trend history
- 730 days
- Audit log kept
- 3,650 days
| Feature | Starter | Team | Business | Enterprise |
|---|---|---|---|---|
| Per month | $100 | $250 | $1,000 | $2,500 |
| 12 months | $1,000 | $2,500 | $10,000 | $25,000 |
| Monitored AWS accounts | 10 | 50 | 250 | Unlimited |
| Connections | 2 | 10 | 50 | Unlimited |
| Fastest sync | 60 minutes | 15 minutes | 5 minutes | 5 minutes |
| Trend history | 30 days | 90 days | 365 days | 730 days |
| Audit log kept | 30 days | 90 days | 365 days | 3,650 days |
| Saved views per user | 10 | 100 | 500 | Unlimited |
| Code repositories | None | 10 | 100 | Unlimited |
| Saved views shared with everyone | Not included | Included | Included | Included |
| Exceptions with a scope, a reason and an expiry, written back to Security Hub | Not included | Included | Included | Included |
| GitHub and GitHub Enterprise Server: Terraform and CloudFormation mapped to findings | Not included | Included | Included | Included |
| GitHub issues created from tasks | Not included | Included | Included | Included |
| SAML and OIDC identity providers, such as Microsoft Entra ID and Okta | Not included | Included | Included | Included |
| Fix previews and pull requests for controls with automatic fixes | Not included | Not included | Included | Included |
| Built-in Trivy scans, SonarCloud and SonarQube, and SARIF uploads from CI, correlated with Security Hub controls | Not included | Not included | Included | Included |
| IP allowlist on every API call | Not included | Not included | Included | Included |
Every plan includes
- Findings explorer: free text search, the query language, facets with counts, sorting on every column, grouping and keyboard navigation
- Private saved views, and CSV export of any search
- The fix list: issues by control, ranked by risk, with remediation guides for the console, AWS CLI, Terraform and CloudFormation
- Finding detail with the full finding and its history, read live from Security Hub
- Triage written back to Security Hub: workflow status, notes and severity, up to 500 findings at once
- Tasks with owners, SLAs per severity, comments, and progress measured from the findings
- Overview with trends, mean time to remediate, ageing and overdue SLAs, and compliance pass rates per standard and control
- Grants per user or group on account and Region patterns, enforced on every request and bounded by AWS
- Hub and spoke connections, normally to your Security Hub delegated administrator account
- An audit log, and the user’s email in CloudTrail on every Security Hub call
- Amazon Cognito sign-in with MFA, and IAM Identity Center
Pricing for the launch
Watchtower is in early access and not on AWS Marketplace yet. These are the plans and prices planned for the launch. Until then, ask for early access.
Business and Enterprise are add-ons
On the Watchtower listing, Team is the base plan. Business is Team plus the Business add-on ($750 a month or $7,500 for 12 months), and Enterprise adds the Enterprise add-on to both ($1,500 a month or $15,000 for 12 months). An add-on on its own grants nothing. Starter is a separate listing, Watchtower Starter.
Security Hub is billed by AWS
Security Hub bills its checks and finding ingestion exactly as it does today; Watchtower only reads findings and updates their workflow, which Security Hub does not charge for. The stack’s Lambda, DynamoDB and S3 cost a few dollars a month for a mid-size organisation, plus a few minutes of Fargate per Trivy scan and $0.40 a month per integration secret.
Support
Basic support is included. Paid plans with response times, and a fixed-price installation service, are on the support page. Questions about plans: [email protected].
[ J ] QUESTIONS
- Can I use Watchtower today?
- It is in early access. It is not on AWS Marketplace yet; email us about your AWS setup and we will set you up ahead of the launch.
- Does any data leave my AWS account?
- No. The stack runs in your account and calls AWS and the code hosts you connect. Everything Watchtower stores is in DynamoDB and S3 in your account, and the licence is read from AWS License Manager there.
- Can it change my AWS resources?
- No. Its roles can read findings and, at the Triage level, update their workflow, notes and severity in Security Hub. Fixes are pull requests to your code, which people review and your pipeline applies.
- Does it replace Security Hub?
- No. Security Hub keeps running the checks and collecting findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, Config and partners. Watchtower is a better way to work through them.
- What does it cost to run?
- The licence is a monthly or 12-month contract. Security Hub bills you as today; reading findings and updating workflow cost nothing extra. Lambda, DynamoDB and S3 cost a few dollars a month for a mid-size organisation.
- Which code hosts and scanners work?
- GitHub and GitHub Enterprise Server, through a GitHub App or a fine-grained token. Trivy is built in; SonarCloud, SonarQube and any scanner that writes SARIF can be connected.
More in the FAQ, and the documentation.
[ K ] EARLY ACCESS
Watchtower is in early access ahead of its AWS Marketplace launch. Tell us how your organisation runs Security Hub (accounts, Regions, the delegated administrator, your code hosts) and we will set you up.
Amazon Web Services, AWS, AWS Security Hub, Amazon GuardDuty, Amazon Inspector, Amazon Macie, AWS CloudTrail, AWS CloudFormation and AWS Marketplace are trademarks of Amazon.com, Inc. or its affiliates. GitHub, Terraform, Trivy, SonarCloud and SonarQube are trademarks of their respective owners. Watchtower is a product of Cloud Certainty OÜ and is not affiliated with or endorsed by Amazon.