Anomaly detection
The expensive ones
never spike
A spike gets noticed. A workload that grows eleven per cent a week for a quarter does not, and costs more. Zephto reads daily billing detail and reports both, alongside the services that appeared and the ones that quietly stopped.
The short answer
What gets flagged
Zephto detects anomalies from the customer’s own daily cost data using a weekly comparison: the last seven days against the prior four-week baseline. Four patterns are reported — a spike above the baseline, a service that has appeared, a service that has stopped billing, and monotonic upward growth across four weeks.
Each is reported with the service, the scope it sits in and the size of the movement in dollars, so the question that follows is who deployed it rather than what happened.
Four patterns
What the daily data will tell you
A week well above the baseline
Usually an unplanned deployment, an autoscaler over-shooting, a backfill, or a load test nobody turned off. Worth investigating the same week, which is why the window is seven days rather than a month.
A service or scope not seen before
New spend that no budget knows about. On AI estates this is the most common one: a new model deployment, a new workspace, an agent that went to production on a Friday.
Billing that fell to zero
Sometimes a saving worth confirming, sometimes a pipeline that broke and nobody noticed. Both are worth a look, and only one of them is good news.
See what moved last quarter
The audit reads 90 days of daily billing detail and reports what changed and when.