Four AWS security services changed in a single week. Here is what SAA-C03 and SCS-C03 candidates need to know.

GuardDuty Runtime Monitoring now catches three new file-modification findings

Announced 01 July 2026. GuardDuty Runtime Monitoring picked up three new threat-detection findings that fire when an attacker modifies critical files on an EC2 instance or on a workload running in EKS or ECS. The new finding names are Persistence:Runtime/SensitiveFileModified, PrivilegeEscalation:Runtime/SensitiveFileModified, and DefenseEvasion:Runtime/SensitiveFileModified. Each maps to a MITRE ATT&CK tactic and comes with a remediation recommendation.

What you actually need to remember for the exam: the findings are correlation-based (not raw command-line matches), they cover five file operations (open-for-write, rename, symlink, link and unlink), and they only appear once GuardDuty Runtime Monitoring is enabled on the relevant compute. A 30-day free trial is available if you have not turned it on yet.

If your study notes describe GuardDuty as a network- and account-anomaly service, that is now underselling it. For SCS-C03 specifically, expect a question that asks you to choose between GuardDuty, Security Hub and Detective for post-compromise file-modification detection. The right answer is GuardDuty Runtime Monitoring, and it has just got sharper.

Security Hub CSPM shipped an AI Security Best Practices standard

Announced 30 June 2026. Security Hub CSPM (the cloud security posture management side of Security Hub, not the aggregation side) now ships a new control standard called AI Security Best Practices, with 31 controls covering AI workloads. It is generally available in every AWS Region where Security Hub CSPM runs, including GovCloud and China, and the standard identifier is standards/ai-security-best-practices/v/1.0.0.

If you are sitting SAA-C03, the framing matters more than the controls. The exam blueprint now lists generative AI as a tested domain. A question like "which AWS service gives you continuous configuration checks against AI workload best practices" lands on Security Hub CSPM with this standard enabled. Before 30 June, the closest answer would have been Config rules. After 30 June, it is Security Hub.

SCS-C03 is where this lands hardest. The Security Specialty blueprint has been quietly tilting toward AI workload security for two exam refreshes. A specific AI Security standard with a documented control set is exactly the kind of thing an SCS-C03 question setter can build a scenario around. Read the standard page in the AWS docs the night before the exam, not on the morning of, and you will pick up the three or four control families (data access, model access, inference logging, training data isolation) that tend to show up.

AWS Artifact gained an AI assistant for compliance questionnaires

Announced 01 July 2026. AWS Artifact now includes Assurance Assistant, an AI-powered capability that answers security and compliance questions about AWS services with citations back to AWS compliance documentation. It supports single-question mode for on-screen answers and questionnaire-upload mode that processes XLSX files including CAIQ, SIG and custom DDQs.

For SAA-C03 the headline is the model: it is the same Bedrock-backed pattern you have seen in Q, Amazon Q for Business and the AWS DevOps Agent. If a question asks about a service that helps third-party risk teams complete vendor assessments faster, Artifact with Assurance Assistant is now a defensible answer alongside Audit Manager.

For SCS-C03, two new IAM managed policies land with the launch: AWSArtifactComplianceInquiriesReadOnlyAccess and AWSArtifactComplianceInquiriesFullAccess. If you get a least-privilege question that mentions compliance questionnaires, those policies are the specific lever to name.

Network Firewall added a third managed-rules vendor (VisionHeight)

Announced 25 June 2026. AWS Network Firewall now supports managed rule groups from VisionHeight, sold through AWS Marketplace. The two new groups are Zero-Day Threat Protection and Noisy Scanners and Tor Protection. VisionHeight joins an existing list that already includes Check Point, Fortinet, Infoblox, Lumen, Rapid7, ThreatSTOP and Trend Micro.

SAA-C03 question setters love "which AWS service supports managed rule groups from third-party vendors" questions. The right answer has been AWS Network Firewall for a while, and the vendor list keeps growing. Memorise the pattern, not the vendor list. The exam tests the architecture, not the specific vendors.

There was also a separate Network Firewall change on 22 June worth knowing about: the default stateful action for newly created firewall policies changed from "Application drop established (bidirectional)" to "Application drop established (server-directed only)". The old default could silently drop legitimate server-to-client TCP packets like window updates and keep-alives, which caused connection failures that were horrible to debug. If you are asked why a new Network Firewall policy behaves better than a six-month-old one, the default-action change is the answer.

What to do this week if you are sitting in the next 8 weeks

Run through your current notes for SAA-C03 Domain 3 (Security) and Domain 4 (Resilient Architectures), and for SCS-C03 Domain 2 (Security Logging and Monitoring) and Domain 5 (Data Protection). Anywhere the notes say "GuardDuty detects X" or "Security Hub standard Y exists", cross-check the AWS documentation page for that service. The four changes above are the only structural shifts in this period, but they sit on top of smaller updates that have shipped since the start of the year.

If you have a ReadRoost practice attempt booked this week, do it before you read this article. Then do another one after. The point of the second pass is to feel the difference between "I had to guess" and "I knew that one" on the AI Security Best Practices standard and the three new GuardDuty findings. That gap is the score lift you are chasing.

For SCS-C03 candidates who parked study last quarter: the SCS-C03 blueprint has been quietly refreshed twice this year. Pull the current exam guide PDF, compare it to the one you used to study from, and update anything tied to GuardDuty, Security Hub or Artifact first. Those three services moved. The rest of the blueprint is stable.

What to do if you are not sitting soon

If you are more than three months out from the exam, do not chase every AWS What's New post. Add a single monthly check to your study plan: open the AWS What's New feed, filter to Security, Identity and Compliance, and read the items published since your last check. Most of them will not affect your exam. The ones that do will surface quickly because they name a specific finding, standard or rule group, and that is what questions are built from.

AWS publishes a lot. Most of it is not your problem yet. The four changes above are your problem if you are sitting before September.