FinOps & process
Cost anomaly detection
Flagging spend that moves far from a service's or workload's own history. It happens automatically, so you do not wait for a person to notice it on the invoice.
Last updated
Definition
Anomaly detection compares current spend with what a specific service or workload usually costs. It does not compare against total spend. That is the key difference. Total spend absorbs normal week-to-week variance, so it can hide a large local runaway. A good anomaly signal fires when one service crosses its own baseline by an unusual margin. The account-wide total need not move at all.
The signal is only as good as the data it compares against. It needs a normalized view on the same schedule across every provider. Only then does it have a reliable baseline to deviate from.
Where it shows up
Cost anomaly detection shows up as an alerting feature in a provider's billing console, such as AWS Cost Anomaly Detection. It compares the recent spend of one service or usage type with its own history. It does not compare that spend with the account's undifferentiated total for the same period.
What makes it expensive
An account-wide total is a poor alarm. It absorbs normal week-to-week variance. One service can run away and hide under a figure that still looks ordinary. Compare each service with its own history instead. That only works if every provider lands on the same schedule and in the same shape first.
Related
The invoice is a lagging signal.
A monthly invoice tells you what already happened. CostMon builds a daily baseline, so a spike stands out while you can still act on it.