What signals and metrics do you track to operate AWS Security Hub well?
Quick Answer
For AWS Security Hub, watch the aggregate security score, failed controls per standard (CIS, AWS FSBP), and finding volume by source and severity. Trend them over time; a single scan is a snapshot, the trend tells you if you are getting more secure or just accumulating debt.
Detailed Answer
Operating a scanner is not "turn it on" — it needs the same observability as any production system. For AWS Security Hub, the signals that matter are the aggregate security score, failed controls per standard (CIS, AWS FSBP), and finding volume by source and severity.
Trend them. Rising Critical counts on a stable codebase usually means a base image or dependency has aged, not that developers got careless. A rising false-positive rate is an early warning that the gate is about to lose the team's trust. Scan duration matters because a slow gate is a gate people route around.
Feed these into a dashboard alongside remediation SLAs so security posture is visible to the people who own it, not buried in a tool nobody logs into.
Code Example
# Signals to track for AWS Security Hub # the aggregate security score, failed controls per standard (CIS, AWS FSBP), and finding volume by source and severity # rule: trend over time, don't react to a single scan # rule: watch false-positive rate as closely as finding count
Interview Tip
Name false-positive rate as a leading indicator — it shows you understand adoption, not just scanning.