Which AWS service should a user choose to detect potential compromises or threats to instances or accounts proactively?

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts and workloads. It uses machine learning, anomaly detection, and integrated threat intelligence to identify potential compromises like cryptocurrency mining, unusual API calls, or unauthorized access. AWS WAF (Web Application Firewall) protects web applications from common web exploits. AWS Shield is a managed Distributed Denial of Service (DDoS) protection service. Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS by identifying vulnerabilities and deviations from best practices. While all contribute to security, GuardDuty specifically focuses on proactive threat detection for instances and accounts.