AWS GuardDuty at $5K–15K/month is too much for mid-market.
GoodCiso AWS Monitor delivers the same CloudTrail, S3, EKS, and DNS detections — for a fixed monthly price. Deployed as a signed Lambda container in your AWS account. No SSM. No per-VM rollout. UK-GDPR + DPA-ready, eu-west-2 by default.
Same detections, different price model.
GuardDuty charges per event. AWS Monitor charges per account. If your CloudTrail volume is high enough that GuardDuty is painful, you save at most.
CloudTrail analysis
IAM-escalation, unusual API patterns, console logins from new geolocations. Same rules GuardDuty ships — reimplemented and tuned for the mid-market workload.
S3 data events
Public-bucket creation, cross-account access, exfil patterns (bulk GET on customer data buckets). Detection within 5 minutes.
EKS audit logs
Privileged container starts, RBAC escalation attempts, secret access from workload identity. Catches the workload-layer attacks GuardDuty misses.
DNS query logs
Cryptojacking C2 domains, DNS tunneling patterns, known-malicious resolvers. Optional — toggle on if you already forward VPC DNS query logs.
One signed container. Your account. Five minutes.
No agent. No SSM. No per-instance IAM. The Lambda image runs entirely from your CloudTrail bucket and publishes findings to your SNS topic.
Signed Lambda container
Multi-stage Docker build, minimal attack surface, pinned base image. cosign-keyless signature via GitHub OIDC — no checked-in key, verifiable with cosign verify.
SBOM + supply chain
Syft-generated SPDX SBOM attached as an in-toto attestation. Full dependency tree. Every image reproducible from source.
Bounded IAM
Lambda execution role scoped to the stack — no wildcard on Resource. Reads your CloudTrail bucket, publishes to your SNS topic. Nothing else.
eu-west-2 default
UK-GDPR + DPA-ready. Data never leaves the AWS region you deploy to. eu-west-1, us-east-1, us-west-2, ap-southeast-1, ap-northeast-1 supported.
Fixed monthly price, tiered by event volume.
No surprises. No per-event overage. The tier you pick is what you pay.
Your infra cost is on top of the license: typically $50–$300/month for the S3 + Lambda invocations, depending on event volume. Run the calculator with your actual CloudTrail volume for a precise number.
Run your own CloudTrail volume through the calculator.
A faithful JS port of the pricing engine. Your numbers stay in this browser. Nothing leaves the page.