On October 8, 2026, AWS extended GuardDuty RDS Protection beyond login anomalies to detect data exfiltration and destruction in Aurora PostgreSQL and RDS for PostgreSQL, using agentless behavioral baselines. Turn on the 30-day free trial if you run PostgreSQL — but know that MySQL remains outside the scope.

On September 1, 2026, AWS opened GuardDuty to custom detection rules, associable per account and controllable at the organization level with a dry-run mode and an expiry date. Security teams can now code their own detection scenarios instead of waiting for vendor findings.