AI-CloudOps · Persona Bee · One console across your clouds

One AI console for AWS, Azure and GCP

NudgeBee's AI-CloudOps puts your inventory, security findings and remediations across every cloud in one place.

  • The three providers, treated the same way
  • Self-hosted in your own environment
  • Nothing changes without your approval
Book a Demo Start free
  • AWS, Azure and GCP
  • Self-hosted
  • Zero telemetry
  • Free forever tier

AI-CloudOps · All accounts

Agentless · synced 12m ago
  • Resources2,8473 clouds · 5 accounts
  • Spend MTD$35,890Forecast $47,100
  • Findings6 Critical18 High
  • AWSaws-prod37EC218S354Lambda
  • Azureazure-prod41VMs12Storage17Functions
  • GCPgcp-prod29GCE9GCS22Functions

Security findings, one queue Across 3 clouds

  • HighAzure Defender Storage account allows public access
  • MediumSecurity Hub S3 bucket without default encryption

Awaiting approval Enable SSE-KMS encryption on S3 bucket audit-logs

Approve

What is AI CloudOps?

AI for IT operations across every cloud: one agent, one console, a unified inventory, correlated security and cost findings, and remediation through each cloud's own APIs. It runs in your environment; every change waits for human approval.

For operations, cost and security. Not for provisioning.

  • Three clouds, one modelAWS, Azure, GCP and Cloud Foundry, one pipeline
  • One graphA finding in one account, traced to the workload it affects in another
  • In your environmentLeast privilege, encrypted credentials, no third party
AIOps services

AIOps services across AWS, Azure and GCP

The operational work that normally needs three consoles, run by one agent, with the three providers treated the same way.

  1. 01

    Read

    Every account, every cloud

    • Inventory, security and cost data, read in place
    • One pipeline into one data model
    • One recommendation taxonomy
  2. 02

    Rank

    What matters, in one queue

    • Native security signals from each cloud
    • One queue instead of three
    • Nothing left in a console nobody opens
  3. 03

    Correlate

    Across accounts and clouds

    • A knowledge graph of real dependencies
    • Default cross-account rules
    • Failures traced to everything downstream
  4. 04

    Fix

    Carried through to your approval

    • Through each cloud's own APIs
    • Or a Kubernetes patch, or a pull request
    • Nothing applies until you approve

Multi-cloud management usually means

  • One tool per provider
  • A spreadsheet to reconcile them

One AI-driven cloud management platform over all three

Inventory and security

Every account, every cloud, one inventory. Every security finding, one queue.

Instead of three consoles and three mental models, one list of what exists, where and in what state.

One inventory across every cloud

Each cloud's own types, in one data model and taxonomy

  • One modelAWSAzureGCP
  • ComputeEC2 instancesVirtual MachinesGCE instances
  • StorageS3 bucketsStorage AccountsGCS buckets
  • DatabasesRDS databasesSQL databasesCloud SQL
  • FunctionsLambda functionsFunction AppsCloud Functions

Coverage

  • AWSDozens of service scanners, the deepest coverage
  • AzureBroad coverage across the estate
  • GCPRead through the same single collector
  • Cloud FoundryCollected through the same pipeline

Security findings from every cloud

Ranked in the same queue as everything else

  • SourceFindingSeverity
  • GuardDutyUnauthorizedAccess:EC2/SSHBruteForceHigh
  • Azure DefenderStorage account allows public accessHigh
  • SentinelSuspicious sign-in from new locationHigh
  • InspectorCVE-2024-6345 in Lambda runtime python3.8Medium
  • Security HubS3 bucket without default encryptionMedium

A critical exposure in a rarely-watched account does not sit unseen

Native signals, normalized into one queue

  • AWS GuardDuty
  • Inspector
  • Security Hub
  • Azure Defender
  • Sentinel
  • Kubernetes RBAC
  • CIS benchmarks
Correlation

It connects resources across accounts, not just within them

A knowledge graph links resources and their real dependencies across accounts and clouds.

Who depends on payments-db?

Edges drawn from network flows and IAM

  • Cross-account or cross-cloud
  • Same account
  • 3 accounts · 2 clouds
  • Traced downstreamA change or failure in a shared service reaches everything it affects
  • Across team linesA dependency stays in view in another team's account
  • Across cloudsOne graph spans AWS, Azure and GCP
  • Default cross-account rulesResources are linked across accounts by a default rule set
Fix

Fixes applied through each cloud's own APIs

When you approve a change, it is applied the native way, as durable, approval-gated runbook automation.

  • A cloud API changeSupported services on AWS, Azure and GCP, through the provider API
  • A Kubernetes patchApplied to the deployment in your cluster
  • A pull requestRaised against your infrastructure repository, the GitOps way

Apply coverage varies by service. Major services are supported directly; everything else lands as a pull request.

Remediation queue

Awaiting approval · 2 of 7
  • Applies via cloud APIAwaiting approval

    S3 bucket without default encryption

    Security Hub · aws-prod

    Proposed fix
    Enable SSE-KMS default encryption
    Applies via
    s3:PutBucketEncryption API call
    Blast radius
    No downtime, new objects only
    Audit
    Change record written on apply
    Approve and applyDismiss
  • Opens a pull requestAwaiting approval

    Security group open to 0.0.0.0/0 on port 22

    GuardDuty correlation · sg-0b42 · in Terraform

    Proposed fix
    Restrict ingress to VPN CIDR 10.8.0.0/16
    Applies via
    Pull request, resource is code-managed
    Target repo
    infra-terraform #482
    Merge gate
    1 approving review, plan must pass
    Review pull request

Every fix is gated behind approval

Cost

Cost and incidents share the same pane

One console for spend, security and reliability across every cloud, so the team stops switching tools to get the full picture.

AI-CloudOps · the breadth layer

Every cloud, in one console

  • SpendCost optimization findings
  • SecurityFindings from every cloud
  • ReliabilityIncident investigations
Go deeper on costAI-FinOps

CloudOps is the breadth layer over both, in one place

Go deeper on incidentsAI-SRE
Gates

It reads freely. It changes nothing without you.

Two modes, drawn at the tool layer, not left to the model’s judgment.

Reads

Reads every cloud without asking

  • Read-only reads run without asking
  • Building the picture across your clouds never waits on a prompt
Writes

Gated behind your approval

  • Every create, update and delete is classified
  • Blast radius scored from the live dependency graph
  • Only what is safe auto-applies; the rest waits for you
  • No self-granted accessForbidden from modifying IAM or RBAC to grant itself access
  • It does the work, not youNever asks you to go and run commands yourself
  • Untrusted by defaultAll tool output is untrusted input, a prompt-injection defence

Approvals arrive where the team already works

  • SlackSlack
  • Microsoft TeamsMicrosoft Teams
  • Google ChatGoogle Chat
  • Signed link
Where it runs

Your cloud data does not leave your environment

Self-hosted, outbound only and least-privilege, with your own model behind it.

Where does it run?

In your environment.

  • Self-hosted in your own environment
  • Zero telemetry; nothing shipped to a third party
  • The in-cluster agent dials out only
  • No exposed API server
  • No inbound ports, no VPN

How does it get access?

Least privilege.

  • AWS onboarding via STS AssumeRole
  • With an External ID, not long-lived credentials
  • Credentials encrypted at rest, AES‑256‑GCM
  • Cannot grant itself IAM or RBAC access

What reaches the model?

Nothing that should not.

  • Your model, across eleven provider routes
  • Outbound AI requests scanned for secrets first
  • Secrets redacted or blocked before any model
  • Readable source, with a free Community edition

Model routes include

  • AWS Bedrock
  • OpenAI
  • Azure OpenAI
  • Google AI
  • Vertex AI
  • SageMaker
  • HuggingFace
  • Anthropic
  • Ollama
  • vLLM
Proof

See it across a real multi-cloud estate

“Multicloud complexity does not slow down when your team does. NudgeBee’s SRE and AIOps agents absorb routine operations autonomously so our teams focus on high-value engineering. Their extensive library of specialist agents gives Rackspace the building blocks to rapidly create custom agentic workflows at scale.”
Nirmal RanganathanCTO, Global Public Cloud, Rackspace

CloudOps case study · Healthcare enterprise

Healthcare enterprise saves $1.2M a year across 4,500+ instances

  • $1.2Msaved a year
  • 4,500+instances
  • 14 daysto deploy
  • Zerocompliance breaches
  • Every dollar mapped to a business outcome
  • Rightsizing actioned via automated pull requests
  • Real-time cost visibility for product owners
Read the case study
CloudOps FAQ

Frequently asked questions

For the lead who has to answer for every cloud at once.

Book a Demo
AI CloudOps is the use of an autonomous agent to run multi-cloud operations from one console: a unified inventory across AWS, Azure and GCP, correlated security and cost findings and remediation applied through each cloud's own APIs. It runs in your environment, reads freely and applies every change only after human approval.
A CSPM shows posture and a cloud management tool shows inventory, and both usually leave the fix to you, per cloud. NudgeBee unifies inventory, security and cost across AWS, Azure and GCP in one queue, correlates findings across accounts and applies the remediation on approval through each cloud's native API.
AIOps services apply AI to IT operations work: collecting the state of the estate, ranking what is wrong and acting on it. NudgeBee delivers that across AWS, Azure and GCP from one console, with a unified inventory, native security findings normalized into one queue and remediation applied through each cloud's own APIs after human approval.
AWS, Azure and GCP, plus Cloud Foundry, collected through one pipeline into one data model and one recommendation taxonomy. Instead of three consoles and three mental models, you get one. AWS has the deepest service coverage of the three, which the collector reflects honestly.
Same platform, different job. AI SRE goes deep on incidents and AI FinOps goes deep on cost. CloudOps is the breadth layer: one console across every cloud for inventory, security and remediation, with the depth of the other two Persona Bees available in the same place when you need it.
Only with your approval. Read-only reads run freely, but every create, update or delete is classified at the tool layer and gated behind explicit human approval, delivered in Slack, Teams, Google Chat or a signed link. The agent cannot grant itself permissions it does not already have.
Native signals from each cloud, normalized into one queue: AWS GuardDuty, Inspector and Security Hub; Azure Defender and Sentinel; plus Kubernetes RBAC analysis and CIS benchmark scans. A critical exposure in a rarely-watched account is ranked alongside everything else, not left in a console nobody opens.
Yes. A knowledge graph links resources and their real dependencies across accounts and clouds, using a set of default cross-account rules. A change or failure in a shared service can be traced to everything downstream of it, even when the downstream sits in a different account or a different cloud.
No. NudgeBee is self-hosted in your own environment with zero telemetry, and your inventory, security and cost data is read in place. AWS onboarding uses least-privilege STS AssumeRole with an External ID, so you are not handing over long-lived credentials.
Yes. The full implementation is readable: the agent architecture, the prompts and the quality gates. You can self-host it in your own cluster and run it in production internally for free, at any scale. The 2 cluster or cloud account limit applies to the hosted Cloud SaaS free tier.
AI-CloudOps is included in every NudgeBee edition, alongside the other Persona Bees. The Community edition is free: you self-host it at any scale. On the hosted Cloud SaaS there is a free forever tier covering up to two clusters or cloud accounts, with no credit card required. Enterprise Support starts at $500 a month, billed annually and priced by environments and clusters, and Enterprise Platinum is priced on environments, clusters and accounts. Full details are on the pricing page.
Partly. NudgeBee manages operations across AWS, Azure and GCP: a unified inventory, correlated security findings, cost and approval-gated remediation, all in one console. It complements provisioning and governance platforms like Terraform or CloudBolt rather than replacing them, so if what you need is infrastructure provisioning, NudgeBee is not that tool; if what you need is day-two operations across every cloud, it is.
Persona Bees

One platform, five Persona Bees

Each Persona Bee is a group of Task Bees and inherits their limits. Add another on the same platform and knowledge graph, with no new install and no re-integration.

Free forever · No credit card

Put every cloud in one console.

  • Self-host at any scale
  • Or 2 clusters or cloud accounts free on Cloud SaaS
  • Nothing leaves your environment
Start free Book a demo Read the source on GitHub