# Surprise! AWS Security Hub just learned to spot what's actually exposed to the internet!

Hi, it's Shiichan! Today I found an update that might make security folks do a double take, so let me walk you through it.

## What was announced?

According to AWS's What's New, AWS Security Hub added a new capability called Network Scanning. It identifies resources in your environment that are actually reachable from the public internet.

The key point is that instead of inferring "this could be reachable" from security group rules and route tables, it actively probes your resources from the internet to confirm whether they're genuinely reachable. It discovers public IP addresses, virtual machines, and load balancers across both AWS and Azure environments, identifies which ports are reachable, and figures out what services are running behind them.

## The story so far

Security Hub already had network reachability findings. But those worked by analyzing security group rules and route table configurations to flag "this configuration could make a resource reachable from the internet." That was a configuration-based inference, not a confirmation of actual internet-facing access.

Because configurations can interact in complicated ways, this left room for gaps: a resource that looks closed on paper might, in practice, end up visible from the outside for some overlooked reason.

## What changes

Network Scanning closes the gap between "theoretically reachable" and "actually reachable." Every time it finds a reachable port, it generates a Security Hub finding with evidence of the port and the service it discovered.

On top of that, Security Hub Exposures automatically correlates these findings with other findings and resource configurations to determine broader risk. Instead of just staring at configuration, you can now build your risk picture starting from what's genuinely visible from the outside, which should make it easier to catch exposure you didn't realize you had.

## Dive Deep

According to the announcement, Network Scanning is included with Security Hub Essentials at no additional cost. Existing Security Hub customers can enable it per account and Region, or organization-wide, while new customers have it enabled by default.

It's available in all AWS commercial Regions that support Security Hub. Notably, it scans both AWS and Azure environments, which should be welcome news for teams running multi-cloud setups.

For setup steps and details on reading the findings, check the AWS Security Hub User Guide.

## Wrap-up

- Security Hub added Network Scanning, which detects resources actually reachable from the public internet
- Unlike the existing configuration-based reachability findings, Network Scanning actively probes resources over the internet to confirm real exposure
- It discovers public IPs, virtual machines, and load balancers across both AWS and Azure, and identifies reachable ports and running services
- Findings feed into Security Hub Exposures, which automatically correlates them with other data for risk assessment
- It's included in Security Hub Essentials at no extra cost, available in all AWS commercial Regions that support Security Hub

This is an update security teams and cloud operators won't want to miss if they care about catching unintended public exposure!