AWS Security Hub adds resource criticality to exposure prioritization

AWS announced on October 14, 2026, that Security Hub now includes resource criticality in exposure prioritization. AWS says the signal is intended to help central security teams focus on exposures affecting their most business-critical resources, according to the announcement.

How criticality is assigned and displayed

Teams can set criticality through an automation rule—for example, marking every compute resource in a particular account as Very High. AWS says the rule applies to resources already in the inventory and to new resources as Security Hub discovers them.

Security Hub also infers criticality from resource tags and names without configuration, and records which source determined the value. A Criticality column on the Resources page supports sorting, filtering and grouping; the value also appears on an exposure finding’s Impact assessment tab. AWS describes these assignment and display behaviors in the release notice.

What to check before relying on criticality

For engineers, the practical implication is that inventory conventions deserve attention alongside prioritization rules. Before assigning every compute resource in an account the same criticality, check whether that account mixes business-critical systems with lower-priority workloads.

For tag- and name-based inference, review whether metadata consistently expresses business importance. If a classification looks unexpected, start by inspecting the recorded source. Also verify how automation rules and inferred values interact before relying on criticality in a triage workflow; the announcement does not specify their precedence.

Treat criticality as business context within a broader triage decision, rather than the sole reason to choose which exposure to remediate first.

Availability and cost

AWS says resource criticality is always on for all customers, requires no new enablement and is included with Security Hub Essentials at no additional cost.

For regional availability, the announcement points to the AWS Region table for Security Hub. It does not enumerate a feature-specific regional rollout. These availability and pricing details come from the AWS release notice.