Malware caught at the volume, not at the customer.

The near-miss was the wake-up call. A customer had uploaded an infected file; the EKS processor had pulled it, decompressed it, and started parsing it. The malware was a known-bad-but-not-active strain, but the team did not know that until after the file had been on the cluster for two hours.

We deployed GuardDuty Malware Protection for S3 (scanning on object upload) and for EKS (scanning running pods’ filesystems). Findings routed to EventBridge: critical findings triggered an immediate Lambda quarantine — move object to lock-bucket, kill the pod, notify the customer success rep.

In the first 60 days the system quarantined 11 files. All were legitimate customer uploads from compromised customer machines. The scan latency p95 is under 30 seconds; legitimate traffic doesn’t notice.