Detection presumes prevention has been breached. No matter how much firewalls, IAM, and encryption block, credential theft, insiders, and zero-days get through. So the second pillar of security operations is "recognizing malicious activity already happening (or underway) with evidence-based detection." Amazon GuardDuty is the first entry point to this detection layer — agentless, it continuously analyzes telemetry across the account and outputs threats as findings.