We run Security Hub CSPM as the evidence layer on the environments we operate: continuous, account-level configuration and security checks against the AWS Foundational Security Best Practices standard plus CIS, PCI DSS and NIST; GuardDuty, Inspector and Macie findings normalised into the AWS Security Finding Format and correlated so the highest-priority issues surface first; and automation rules with EventBridge actions to route findings straight into triage. It depends on AWS Config recording resources, and it only reports on findings generated after it is enabled — so we enable it across every supported Region at the start, not after an incident.
Any environment where someone will eventually ask for proof: payments and collections platforms in PCI-DSS scope, regulated government workloads, and SaaS products facing enterprise procurement or investor due diligence.