Compare
What it is next to the alternatives.
By property, not by score. Cloud-native threat detection means a managed detection service such as Amazon GuardDuty. The other two columns describe kinds of tools, not products. Numbers appear only where a replay run measured them, under Measured on replay.
| Property | Warden | One admin-role AI agent | Cloud-native threat detection | General-purpose cyber models |
|---|---|---|---|---|
| Where it runs | In your AWS account and EKS cluster. Models run on Bedrock in your account; nothing about your estate leaves it. | Wherever the agent is hosted. What it reads goes to that host and its model provider. | A managed AWS service in your account, operated by AWS. | On the model provider's service. What you paste is sent there. |
| Presence | The scanner, every 15 minutes: the tick, the full sweep on your schedule, the rules and the agents. | Present while a session runs. It sees a snapshot. | Always on, over the sources you enable. | Present when someone asks a question. |
| What normal looks like | Per-principal history over 30 days, learned only from calls no case accuses. Thirty days of case memory. | Starts from nothing each session, unless someone builds memory for it. | Learned baselines for the sources it analyses. | None for your estate. |
| Credentials it holds | Read-only roles for the scan. The agents hold one credential that can only call the pinned models. | Usually an admin or broad role, so it can both read and act. | A service-linked role managed by AWS. | None, unless someone wires it to tools. |
| Attacker-written text | Names, tags and user agents reach a model only as handles and fixed vocabulary. A decoy and a prompt-leak token ride on every call. | Reads raw names, tags and logs. One injected string can steer an agent that holds admin. | Rules and models over structured events; no conversational agent to steer. | Reads whatever is pasted in, including text an attacker wrote. |
| How claims are checked | Code checks every sentence against the records it cites; a model from a different maker refutes it. What cannot be proven is dropped and counted. | One model's word. | Findings come from detection logic, with the events attached. | One model's word. |
| Investigation | A case: a timeline of verified events, every attacker identity and its lineage, what they can reach, and what could not be checked. | As deep as the session goes, from what it chose to read. | Findings, and correlated attack-sequence findings for some patterns. Deeper investigation is a separate service or your team's work. | Explains what you show it. |
| Self-replicating swarms | Found in code, across runs, at any branching factor, with the family tree back to the first stolen credential. | Many low-signal actors can read as noise to a single pass. | Each actor's activity is judged by its own detections. | Only what is pasted in. |
| Response | A plan per attack: contain every attacker identity, then close the path they used. Dry-run, time-boxed and undoable steps; one passkey signature over the whole plan. | Acts with its own role, or does nothing. Its actions are as accountable as its logs. | Findings go to EventBridge; the response is automation you build. | Suggests commands for someone to run. |
| Who can make it act | Only a keeper's passkey signature. No model can act, suppress a finding or excuse an actor. | Whoever, or whatever text, can instruct the agent. | Your automation's owners. | Whoever runs what it suggests. |
| Inside workloads | Does not see processes or files. Reads runtime monitoring and EKS audit logs as witnesses when you have them. | Depends on what it is given access to. | Runtime monitoring, where enabled, sees process and file activity. | Not applicable. |
| Cost shape | Rules cover every read. Models run only on what changed, under hard ceilings per call, case and day. Every resource and its cost is on the Footprint page. | Model tokens for every pass over the estate, growing with its size. | Billed by the volume of events and data it analyses. | Per token or per seat. |
Measured on replay
The only numbers this page compares come from one replay run: the harness plays each scenario below against Warden and against a generic admin-role agent given the same estate and the same scenarios, and scores detection, time to plan, false-suppression rate. A number appears here only with its unit, the date of the run and the commit it ran. That run has no result yet, so every cell below is not measured yet.
| Scenario | Metric | Warden | One admin-role AI agent | Run |
|---|---|---|---|---|
| A self-replicating key swarm | Detection | not measured yet | ||
| A self-replicating key swarm | Time to plan | not measured yet | ||
| A self-replicating key swarm | False-suppression rate | not measured yet | ||
| AI-paced enumeration | Detection | not measured yet | ||
| AI-paced enumeration | Time to plan | not measured yet | ||
| AI-paced enumeration | False-suppression rate | not measured yet | ||
| A slow insider | Detection | not measured yet | ||
| A slow insider | Time to plan | not measured yet | ||
| A slow insider | False-suppression rate | not measured yet | ||
| An injection-laden estate | Detection | not measured yet | ||
| An injection-laden estate | Time to plan | not measured yet | ||
| An injection-laden estate | False-suppression rate | not measured yet | ||
Used together
Warden is not a replacement for managed threat detection. It reads GuardDuty findings as a witness: they raise attention and seed cases, and their silence proves nothing. Where GuardDuty sees inside a workload, Warden sees what that workload then does with the cloud's API, works it into a case, and puts a signed response in front of you.
What Warden misses
It watches the control plane: every call to the AWS API, which is where a cloud attacker must go to escalate, spread, persist or take data. It misses an attacker who stays inside one workload and never calls the cloud API, data read through a data plane whose events are off, and anything in the minutes before the event lane sees it. The console names what an install cannot see.