Cost anomaly detection conversation

Overview

Anomaly detection flags unusual spend early (mis-sized instances, leaked keys mining crypto, forgotten sandboxes). Position it as insurance, not micromanagement.

What to enable

• Azure Cost Management anomaly alerts (or AWS Cost Anomaly Detection) on subscriptions/payer.
• Budgets with action groups to ticketing, not only email to one person.
• Advisor / Compute Optimizer recommendations exported to QBR slides.

Talking points with clients

• “We tune thresholds after a baseline month; expect some noise first.”
• “Root cause is often a scaled test that was not torn down—RMM or IaC destroy jobs close the loop.”
• Regulated clients may require change approval before auto-scaling limits are raised; document that guardrail.

When anomalies fire

Runbook: identify resource group and owner tag, check deployment pipeline history, review network egress, revoke keys if compromise suspected, open vendor ticket if platform bug.