AI-FinOps · Persona Bee · Cloud cost optimization

Find the waste. Show the arithmetic. Raise the pull request.

A dashboard shows the number. An autopilot changes your infrastructure behind a black box. NudgeBee’s AI FinOps does neither.

  • Ranks every finding by the dollars it frees
  • Shows the exact method, so it survives review
  • Lands the fix as a pull request you approve
  • AWS, Azure and GCP
  • Kubernetes rightsizing
  • Self-hosted
  • Free forever tier

namespace prod-shop · cluster prod-us-east-1

Rightsize deploy/checkout-api

ApplyRaise pull request
Projected saving

$1,380 / month

at current on-demand rates

CPU usage · 14 days- - request 420m

  • Current vs recommendedCurrentRecommended
  • CPU request1000m420m↓ 58%
  • Memory request1024Mi610Mi↓ 40%

Method published with every finding

  • CPU requestset at the 99th percentile of max rate
  • Memory requestobserved peak + 15%
  • Window14 days
  • Data points1,204
  • OOMKill in windownone
Approval-gated: applying creates a change request for a cluster admin

What is AI FinOps?

Autonomous agents that find and fix cloud waste, rather than only report it. NudgeBee scans AWS, Azure, GCP and Kubernetes against 501 rules, scores every finding by dollar impact, attaches the exact fix and applies it as a cloud API change or a pull request once approved.

  • Rules, not tokensThe 501 rules and the FinOps Score run without a model: no LLM tokens
  • Low tokensWhere a model is used: knowledge graph, prompt caching, on-device embeddings
  • Any modelEleven provider routes at zero markup, or open-weight models on your own GPUs
Today

Visibility is solved. The bill still went up.

Most FinOps tools stop at showing you the number. Deciding what to change, and changing it, is still manual.

  1. Visibility

    Dashboards did not help enough

    • Dashboards, tags and allocation reports show the bill went up
    • Nobody disputes the number
    • Deciding and changing still sits with a busy engineer
    Find the wasteEvery finding ranked by the dollars it frees
  2. No arithmetic

    Recommendations without a method

    • “Rightsize this workload”, with no stated method
    • An engineer cannot defend it in review, so it is not applied
    • The finding ages until nobody trusts it
    Show the arithmeticThe exact method behind every finding
  3. Knowing vs doing

    A backlog nobody has time for

    • Every FinOps team has accepted recommendations
    • Nobody has had time to implement them
    • Savings stay theoretical until something raises the PR
    Raise the pull requestThe fix lands as a change you approve
What it checks

501 rules for cloud and Kubernetes cost optimization

First-party savings are folded in and normalized to one dollar and severity model, so you are not reconciling four consoles.

  • AWS236
    AWS rules, the deepest coverage of the three clouds
  • Azure220
    Azure rules across cost, security and configuration
  • GCP54
    GCP rules in the same normalized model
  • 34
    Generic rules that apply across every provider

Four categories, five severities

One dollar and severity model for every finding

Categories

  • RightSizing
  • Security
  • InfraUpgrade
  • Configuration

Severity follows the money

  • High$100 per month or more
  • Medium$20 per month or more

First-party savings, folded in

Each cloud’s own recommendations, normalized

  • AWSAWS
    • Compute Optimizer
    • Cost Optimization Hub
    • Cost Explorer: Reserved Instances and Savings Plans
    • Trusted Advisor
  • AzureAzure
    • Azure Advisor
  • GCPGCP
    • GCP Recommender

One collector, one data model

  • AWSAWS
  • AzureAzure
  • GCPGCP
  • KubernetesKubernetes
  • Cloud Foundry

One recommendation taxonomy across all of them

Spot versus on-demand

  • Karpenter
  • EKSEKS
  • AKSAKS
  • GKEGKE
  • Spotinst

Node hardware, capacity and placement read directly

Allocation and reporting

  • OpenCost, in your own cluster
  • Top 5 accounts, top 20 services
  • Week over week movement
  • CSV and Excel export

Chargeback and showback, so finance gets what it needs

Reads your existing cost and observability stack in place

Browse all 78 integrations
Evidence

Every recommendation shows its working

No competitor publishes their method. Every parameter here is exact, so a recommendation is defensible in review.

  1. Vertical rightsizing

    CPU and memory, derived from KRR

    • CPU requestp99 of max rate
    • Memorypeak + 15%
    • After an OOMKillpeak + 25%
    • Data needed50+ points
    • Windowtwo weeks
  2. Replica rightsizing

    Horizontal, from an LSTM forecast

    • Input24 steps
    • Horizon168 steps, 7 days
    • Sized topredicted demand
    • Not tolast week’s peak
  3. Cluster node fleet

    Integer linear program, solved with PuLP

    • Objectiveminimize cost
    • Choosescheapest instance mix
    • Must meetCPU and memory demand
    • Scopethe whole fleet
  4. Persistent volumes

    PFSS90 storage trend formula

    • Projectsstorage growth
    • Priced at$0.10 per GB-month
    • Safety margin1.3x

Also covered

  • Spot migration, priced against on-demand
  • Abandoned workloads, on a seven-day window
Prioritize

A single ranked inbox, not four dashboards

A ranked queue means the team works the top of the list, instead of debating which console to trust.

Every finding gets a FinOps Score

From 0 to 100, then ranked into one of five bands

  1. Act NowScore 90 and above
  2. Critical75 and above
  3. High55 and above
  4. Medium35 and above
  5. Lowbelow 35
  • Recomputed every six hours
  • The queue reflects what is worth the most right now
  • Scored without a model, so ranking costs no LLM tokens

Recommendations

  • All clouds
  • prod-us-east-1
Recomputed 2h ago
  1. 81CriticalKubernetesdeploy/payment-gatewayRightSizing$1,380/mo
  2. 77CriticalAzurevmss/web-pool-01InfraUpgrade$1,120/mo
  3. 63HighAWSebs vol-0a91…InfraUpgrade$920/mo
  4. 55HighGCPmig/batch-workersRightSizing$740/mo
  5. 48MediumAWSrds/orders-dbConfiguration$610/mo
  6. 36MediumAWSs3/audit-logsSecurity$340/mo
  7. 29LowAWSasg/web-frontendRightSizing$190/mo

214 findings, highest score firstApply is approval-gated

Fix

Three ways a fix lands. Nothing skips approval.

The remediation is attached to the finding. How it lands depends on the resource.

The fix lands where it belongs

Every ranked recommendation arrives with the exact change attached

  1. A cloud API changeThrough the provider API, for major compute and database services
  2. A live Kubernetes patchRightsizing and configuration, applied to the deployment in your cluster
  3. A pull requestRaised automatically against GitHub or GitLab, for teams running GitOps
Every apply is gated behind approval, the same model as AI-SRE

nudgebee-shop / deploy/checkout-api.yaml

Rightsize checkout-api requests (FinOps) #1287

Open

Nubi wants to merge 1 commit into main from nubi/finops-rightsize-checkout-apiChecks passed

deploy/checkout-api.yaml+2 −2

  1. @@ -31,8 +31,8 @@ spec.template.spec.containers[0]
  2. 31 resources:
  3. 32 requests:
  4. 33- cpu: "1000m"
  5. 34- memory: "1024Mi"
  6. 33+ cpu: "420m"
  7. 34+ memory: "610Mi"
  8. 35 limits:
  9. 36 cpu: "2000m"

All checks have passed: build-verification passed

Merge pull requestRequires 1 approving review from a cluster admin
FinOps automation

It runs without being chased

Agentic FinOps carries a finding all the way to a change you approve, instead of leaving it in a backlog.

Durable, approval-gated runbook automation Compare cloud automation tools
  1. New finding, fix attached
  2. Poller, every 180 s
  3. Triggered runbook
  4. Blast radius scored
  5. Applied once safe or approved
  • The blast radius comes from the live dependency graph
  • Only what is safe auto-applies; the rest waits for you
  • Auto-Pilot runs the routine ones on a schedule, with dry-run and guardrails
Anomalies

It tells you the day the spend changed, not at month end

Statistical detection on cloud spend, tuned to stay quiet, so a single noisy day does not page anyone.

Spend anomaly · AWS account 4821 (prod)

Flagged

Daily spend · last 30 days

Jun 23Jul 7Jul 22

  • Z score4.1threshold 3.0
  • Absolute change+$1,150threshold $50
  • Relative change+61%threshold 20%

Top contributor: NAT gateway data transfer

  • A 30-day clean baselineCloud spend is measured against it, every day
  • Three thresholds, all at onceZ of 3.0 or more, at least $50 and at least 20% change
  • It resolves on its ownAfter two consecutive normal days
  • Kubernetes metric anomalies, separatelyThree swappable engines: IsolationForest by default (1% contamination, 100 estimators), DBSCAN, or Z-score at 3 sigma
    • CPU
    • Memory
    • Latency
    • Error rate
    • Replicas
Where it runs

Your cost data does not leave your environment

Your billing data stays in your account. Here is exactly how.

Where does it run?

In your cluster. Nothing leaves.

  • Self-hosted in your own cluster
  • Zero telemetry
  • Outbound AI requests scanned for secrets first
  • Secrets redacted or blocked before any model
  • Embeddings fully on-device, so air-gap is viable

What does it read?

Your billing data, in place.

  • Billing and usage data, queried in place
  • Nothing shipped to a third-party vendor
  • Least-privilege AWS onboarding: STS AssumeRole
  • An External ID, not long-lived credentials
  • Credentials encrypted at rest with AES-256-GCM

What can it change?

Nothing without you.

  • Every apply gated behind your approval
  • Auto-Pilot only where you configure it
  • Dry run, resource filters and guardrails
  • Skips if the agent disconnects or a PR is open
  • Readable source: rules, bands and parameters; free Community edition
Proof

See it against a real cloud bill

AI-FinOps case study · Payments platform

Payments platform cuts cloud spend 34% and recovers $2.4M in waste

  • Anomaly alerts in real time
  • Unified tagging across 8 AWS accounts
  • Rightsizing via automated pull requests
  • No FinOps headcount required
Read the case study
  • 34%cut in cloud spend
  • $2.4Min waste recovered
  • 8AWS accounts under unified tagging
AI FinOps FAQ

Frequently asked questions

For the engineer who owns the bill and the leader being asked why it went up.

Book a Demo
AI FinOps is the use of autonomous agents to find and remediate cloud waste, rather than only report it. Where traditional FinOps tooling surfaces spend and leaves the change to an engineer, an AI FinOps agent ranks findings by dollar impact, attaches the specific fix and can apply it once approved.
Visibility tools tell you what you spent and where. NudgeBee adds the remediation: a ranked recommendation with a published method behind it, the exact change required and the ability to apply that change as a cloud API call, a Kubernetes patch or a pull request against your repository.
Cloud cost management tools show what you spent, broken down by service, team and tag, and leave the change to an engineer. AI FinOps tools go further and rank what to do about it. NudgeBee attaches the exact remediation to every ranked finding, then applies it as a cloud API change, a Kubernetes patch or a pull request once you approve, so the saving actually lands.
CPU requests are set at the 99th percentile of max rate. Memory is set at observed peak plus 15%, or plus 25% where an OOMKill happened. It requires at least 50 data points across a two week window, so it will not act on thin data or a single quiet weekend.
Only where you have configured it to. Auto-Pilot supports dry run, resource filters and guardrails that skip execution if the agent is disconnected or a pull request is already open for that resource. Outside Auto-Pilot, every change is gated behind explicit human approval.
AWS, Azure and GCP, plus Cloud Foundry and Kubernetes, through one collector and one recommendation model. The rule set is 236 AWS rules, 220 Azure, 54 GCP and 34 generic. AWS has the deepest service coverage of the three. If you are evaluating the wider operations category alongside cost, see our comparison of the best AIOps platforms.
NudgeBee runs OpenCost inside your own cluster for Kubernetes cost allocation, so the allocation model will be familiar. The difference is what happens next: allocation data feeds the rightsizing algorithms and the ranked recommendation queue rather than terminating in a dashboard. Kubernetes your biggest line item? Compare the best Kubernetes cost optimization tools and see how NudgeBee lands rightsizing as an approval-gated pull request.
Cloud spend anomalies are detected against a 30 day clean baseline. A spike must clear three thresholds at once: a Z score of 3.0 or more, at least $50 in absolute change and at least 20% in relative change. It resolves automatically after two consecutive normal days.
No. NudgeBee is self-hosted in your own cluster with zero telemetry, and cloud billing and usage data is queried in place. AWS onboarding uses least-privilege STS AssumeRole with an External ID, so you are not handing over long-lived credentials.
Yes. The full implementation is readable: the rule set, the scoring bands and the rightsizing parameters. You can self-host it in your own cluster and run it in production internally for free, at any scale. The 2 cluster or cloud account limit applies to the hosted Cloud SaaS free tier.
AI-FinOps is included in every NudgeBee edition, alongside the other Persona Bees. The Community edition is free: you self-host it with no cluster limit. On the hosted Cloud SaaS there is a free forever tier covering up to two clusters or cloud accounts, with no credit card required. Enterprise Support starts at $500 a month, billed annually and priced by environments and clusters, and Enterprise Platinum is priced on environments, clusters and accounts. Full details are on the pricing page.