# AWS Security Hub adds on-demand S3 exports for findings > Security teams can export findings from Security Hub console pages to S3, choosing CSV for spreadsheets or OCSF-formatted JSON. Canonical URL: https://www.devobs.io/news/news-event-a9ab293bd53b2697644531f3/ By: Sofia Reyes Published: 2026-10-12T07:09:27.704Z Updated: 2026-10-12T07:09:27.704Z Event date: 2026-10-09 Section: Security AWS announced on October 9, 2026 that Security Hub supports on-demand exports of findings to Amazon S3 in CSV or Open Cybersecurity Schema Framework (OCSF) JSON format. AWS positions the feature for teams that need findings outside the console, including for compliance reporting and audit evidence. [AWS announcement](https://aws.amazon.com/about-aws/whats-new/2026/10/security-hub-exports-s3-csv-json/) ## Exports start from the findings console Users can initiate an export from the findings page they are viewing and have Security Hub deliver the results to an S3 bucket in their account. AWS says exports are supported across every findings page: Threats, Exposure, Vulnerabilities, Posture Management, Sensitive Data, and All Findings. [Source](https://aws.amazon.com/about-aws/whats-new/2026/10/security-hub-exports-s3-csv-json/) For teams maintaining extraction code solely to produce occasional reports, the practical change is a built-in alternative to evaluate for that step. Exporting records should not be confused with completing an audit package: teams still need to decide which findings matter and how to present the evidence. ## Choose the format around its consumers CSV fits spreadsheet review and sharing. OCSF-formatted JSON is the option to evaluate when downstream tooling expects findings in that schema—the distinction AWS makes in its announcement. The export workflow also leaves governance decisions to the team. Before using it, establish who should be able to read exported objects, how long those objects should remain in S3, and how downstream consumers will validate them. Assign an owner and retention rules rather than letting occasional reports accumulate without a plan. ## Availability and planning boundaries Findings export is available in all AWS Regions where Security Hub is available, according to the [launch notice](https://aws.amazon.com/about-aws/whats-new/2026/10/security-hub-exports-s3-csv-json/). The notice describes on-demand exports initiated from the console. It does not specify scheduling support, export-size limits or delivery-time guarantees. Teams planning a recurring ingestion feed should verify those requirements in the product documentation before designing around this workflow. ## Source references -