A cloud cost audit used to be a person with a billing export and a fortnight. An AI agent compresses that into one run: it ingests the estate, enriches every resource with current pricing, sweeps for the recurring forms of waste, and returns a ranked list where each item carries a dollar figure, a confidence score, and an effort estimate. On the sample estate we ship with Datum, one run inventoried 515 resources across AWS, Azure, GCP, and OCI and surfaced roughly a third of the bill as recoverable, split into 165 recommendations. The value is not that a machine looked. It is that the machine shows its work and then argues against itself before asking you to act.
Here is what actually happens inside a run, and why the order matters.
Step one: inventory and normalize
The agent first builds one normalized picture of the estate. Native billing data arrives in four different shapes, so the agent maps AWS, Azure, GCP, and OCI resources into a single schema, groups raw resources into the applications they belong to, and reconciles tags so cost can be traced to a team and a product. Without this step everything downstream is guesswork, because you cannot rightsize what you cannot see and you cannot allocate what you cannot name. This is also where coverage gets measured honestly: the share of spend that carries no owner is called out rather than hidden, because untagged spend is where waste hides longest.
Step two: seven detectors, run in sequence
With a clean inventory, the agent runs seven waste detectors. Each targets a distinct failure mode, which is why a single rule rarely catches everything.
| Detector | What it looks for |
|---|---|
| Idle resources | Compute and databases doing no useful work, non production left running |
| Rightsizing | Instances provisioned well above observed utilization |
| Orphaned storage | Volumes, snapshots, and addresses that outlived their owners |
| Storage tiering | Cold data sitting on hot, expensive tiers |
| Commitment coverage | Steady baseline running on demand where a commitment would discount it |
| Anomalies | Sudden movements against the trend, with root cause |
| Cross cloud arbitrage | Workloads that would cost materially less on another provider |
You can watch this happen. The activity feed shows each step as the agent works, so a run is legible rather than a black box that emits a number.
Step three: quantify, then try to disprove
Every candidate saving is computed by a deterministic pricing engine from your usage and dated vendor catalogs, not written by the language model. The model contributes the explanation, the plain English reason a resource is wasteful and what to do about it. Then comes the step that separates a usable audit from a noisy one: adversarial verification. A second AI pass attempts to knock down each finding, to argue that the idle database is actually a warm standby or that the oversized instance has a seasonal peak. Findings that survive the challenge carry the verdict with them. Findings that do not are set aside. This is why the list you receive is short and defensible rather than long and hedged.
Why the order is the whole point
Run the detectors before the inventory is clean and you get confident nonsense. Quantify with the model instead of an engine and you get numbers no board will trust. Skip verification and you get a list so long that the team stops reading it, which is how good tools quietly fail. The sequence, normalize then detect then quantify then verify, is what turns a scan into an audit. It is the same sequence a senior analyst follows by hand; the agent just does it in one run across four clouds and never gets bored on the thousandth resource.
A trustworthy audit tool should let you answer three questions about any finding: where did this number come from, what happens if I am wrong, and did the fix actually lower the bill. If a tool cannot answer all three, it is reporting, not auditing.
What an audit does not do
An agent finds and quantifies. It does not negotiate your enterprise agreement, decide your commitment risk appetite, or apply a change to production. Those remain human calls, and deliberately so. Datum is read only for exactly this reason: it recommends, and you or your pipelines decide and act, with approval workflows gating anything above a threshold you set. The audit is the start of the work, not the end. Read how we turn findings into executed savings in how our engagements work.
Frequently asked questions
How long does an AI cost audit take?
Does the AI actually calculate the savings?
Can I trust findings from a single run?
See a run on your own estate
Datum runs the same audit on your billing data, read only, with every number traceable and every finding verified. Upload one month and see what a single run surfaces, or tour the platform first.
Put a defensible number on your cloud spend.
No provider in the room, no published price list. Tell us your footprint and we will scope the savings against your billing data — we reduce your cloud spend or we reimburse our service fee.
The Cloud Spend Navigator: what changed in cloud pricing, commitments, and FinOps — no vendor spin.