Looking long at security operations, it converges to one underlying tension: "Attacks hide among normal traffic — how do we automatically extract that handful of malicious signals and respond instantly without human intervention?" This question splits into two axes: detection and response. On AWS, GuardDuty supports the first axis. In the console, GuardDuty looks like "a managed threat detection service activated with one button," but underneath lies decades-old signal processing from the 1980s onward — signature-based detection, anomaly detection, threat intelligence, and behavioral analysis — directly embedded