Zhivko Todorov
ALL CASE STUDIES

CASE 92 · TALLY · 2023

COST ANOMALY DETECTIONBUDGETSCHARGEBACKFINOPS

A surprise on the AWS bill, every month, that nobody minds.

A software vendor’s finance team got the AWS bill on the third of every month and the engineering team got the angry email on the fourth. We deployed Cost Anomaly Detection at the org level with detectors scoped per team, and the angry email stopped arriving.

INDUSTRY

Software vendor

DOMAIN

LANDING ZONE

DELIVERED

2023

STACK

COST ANOMALY DETECTION·BUDGETS·COST CATEGORIES·EVENTBRIDGE·SLACK

RESULTS

What changed, by the numbers.

SURPRISE BILL EVENTS

−95%

YEAR-OVER-YEAR

MEDIAN DETECTION

< 24h

AFTER ANOMALY

DETECTORS

14

BY TEAM + SERVICE

ALERT NOISE

LOW

TUNED ML BASELINE

HOW IT WENT

The third-of-the-month rhythm had become institutional dread. Most months the bill was fine; occasionally a forgotten GPU cluster or a misconfigured CloudFront distribution made the bill memorable. The angry email always came after the damage was done.

Cost Anomaly Detection runs ML against the daily spend patterns; we configured detectors at team-level granularity (using Cost Categories as the dimension) and routed anomalies to team-specific Slack channels via EventBridge. Within a quarter, teams owned their own anomaly response.

Surprise bill events dropped 95% year-over-year — the surprises now arrive within 24 hours, while the team that caused them can still remember what they did. The third-of-the-month dread is gone. The finance team has started using "we’re cheap this month" as the lead in their digest.

READY WHEN YOU ARE

Let's get your AWS bill (and architecture) in order.

The discovery call is free. You walk away with at least one concrete idea — even if we never work together.

Or email directly →