If you're running S3 workloads on AWS, you probably have GuardDuty enabled. You should. It's a solid first line of defense — scanning CloudTrail logs against AWS's threat intelligence feeds to flag known attack patterns like credential exfiltration, crypto-mining callbacks, and unauthorized API calls.
But here's the question nobody asks in the security review: what happens when the threat doesn't match a signature?
The Signature Gap
Signature-based detection works by comparing observed behavior against a database of known-bad patterns. It's fast, it's reliable for known threats, and it has near-zero false positives for the patterns it covers. The problem is coverage.
- A developer copies 40,000 objects from a production bucket to a personal S3 bucket at 2 AM — no signature exists for "employee doing something unusual"
- A compromised IAM role starts accessing prefixes it has never touched before — the API calls are all legitimate, just contextually wrong
- An automation script starts running at unusual velocity — every individual call is authorized, but the aggregate behavior is anomalous
None of these trigger GuardDuty. They're not in the threat intel database. They're not malformed requests. They're legitimate API calls that are behaviorally abnormal.
Behavioral Analysis: Learning What's Normal
Behavioral detection takes the opposite approach. Instead of maintaining a list of known-bad patterns, it learns what normal looks like for your specific environment — then flags anything that deviates significantly.
The difference is granularity. A global baseline for an entire AWS account averages out the signal. What's normal for your logging infrastructure is wildly different from what's normal for your config store. A behavioral system needs to know the difference.
So it's not just "GetObject happened." It's whether this specific access, by this specific actor, to this specific prefix, at this time of day, fits the pattern — or breaks it.
The Complementary Model
We don't position Entroptics as a GuardDuty replacement. The strongest security posture runs both: GuardDuty for known threats (signatures, threat intel), Entroptics for unknown threats (behavioral anomalies, insider risk, zero-day patterns).
Think of it as two lenses on the same data. GuardDuty asks: "Does this match something we've seen before?" Entroptics asks: "Does this match what's normal for this environment?" Together, they cover both the known and unknown threat landscape.
What This Looks Like in Practice
A real scenario: a contractor's IAM role, normally used for read-only analytics on one part of your data, starts issuing write operations to a completely different area at 11 PM on a Saturday. Every API call is authorized. GuardDuty sees nothing wrong.
Entroptics flags multiple anomalies simultaneously: unusual access context (new area for this role), unusual time-of-day (outside this role's historical window), and unusual operation type (writes when the baseline is almost entirely reads). Multiple independent signals converge on the same conclusion within minutes.
That's the difference between "is this a known attack?" and "is this normal behavior?"
Getting Started
Entroptics connects to your existing CloudTrail stream — no code changes, no agents to install on your workloads. Behavioral baselines begin building immediately and mature within 24-48 hours. You can start with the free tier (500K events/day) and see your first anomaly in minutes.