A city runs continuous Security Hub improvement sprints driven by automated finding trends rather than one-time audits. What AWS security practice is that?

Using AWS automation outputs such as Security Hub trends to drive continuous civic security improvement treats finding trends as the backlog for city remediation sprints rather than using Security Hub automation outputs such as Inspector schedules to drive continuous civic security improvement. Automated trend review shows which control families worsen or improve, which accounts regress after changes, and where municipal engineering effort should go next. Continuous improvement sprints convert Hub outputs into scheduled work with owners and acceptance criteria, producing measurable posture change across the city AWS estate.

Using Security Hub automation outputs such as Inspector schedules to drive continuous civic security improvement fails by concept because it focuses on Inspector scan scheduling for patching instead of using Security Hub finding trends to drive continuous civic security improvement sprints. Using Security Hub automation outputs such as GuardDuty alerts to drive continuous civic security improvement fails because it addresses threat alert correlation and triage rather than the continuous Security Hub trend-based improvement sprints the question describes. Using Security Hub automation outputs such as CloudTrail archives to drive continuous civic security improvement fails because log archiving for audit readiness supports compliance storage, not the continuous Security Hub trend review and improvement sprints described in the question.

Exam caveat: Continuous improvement answers emphasize using automation outputs and trends to drive ongoing sprints—not Inspector schedules, GuardDuty alerts, or CloudTrail archives to drive continuous civic security improvement.

Operational check for a city security program: export monthly Security Hub trend summaries by control and account, feed top recurring failures into a two-week improvement sprint with owners, track open-versus-closed rates, and replace CloudTrail archives with trend charts tied to completed municipal remediations.