IFO4

CFO-R Course/Chapter 5 , Signal & Exposure/§5.3

§5.3 , 18 min read

Cost anomaly detection

Real-time detection of cost spikes, budget breaches, and forecast deviations.

Cost is the fastest-moving signal in the modern platform. A single misconfigured workload can burn a month of budget in hours. Ring 5 cost detection sits upstream of budget enforcement (Ring 3) and cost attribution (Ring 4).

▸Every billing account has a budget with at least 5 threshold rules (50, 75, 90, 100, 150 percent).
▸Thresholds route to a single PubSub topic; human and automated responders are subscribers.
▸Forecasted-spend rules catch exponential burns before they exceed the actual threshold.
▸Day-over-day anomaly detection computes the standard deviation of spend per service and alerts on 3-sigma events.

Sidebar

Case , the $72,000 Cloud Function

A developer deployed a Cloud Function with an unintended infinite recursion. It ran for four hours before the primary budget alert fired. A Ring-5-correct organization would have caught it at hour one via 3-sigma anomaly detection on day-over-day spend.

Study questions

Confirm your comprehension.

Question 1

How many threshold rules should every budget have at minimum?

Question 2

Forecasted-spend rules catch:

Question 3

A 3-sigma day-over-day anomaly:

 Previous

§5.2 , Asset discovery & continuous inventory

Next 

§5.4 , Shadow IT & shadow spend identification

IFO4