The growth trajectory of Wiz has given our FinOps team a front-row seat to the complex realities of cloud cost management. Rapid growth can easily lead to runaway spend, but Wiz has never compromised on operational discipline or cost efficiency. Today, we protect some of the world's largest organizations across technology, financial institutions, pharmaceuticals, defense, and beyond. Supporting a customer base this diverse introduces immense operational complexity, especially as product teams ship dozens of new features each week.
In a fast-changing cloud environment, raw bills do not tell the full story. We need to rapidly diagnose cost spikes, separate productive investment from waste, and continuously optimize spend without slowing innovation. This post, the latest entry in our Wiz on Wiz series, will dive into how our internal FinOps team is using Wiz Cloud Cost to manage and optimize cloud spend. We’ll start with new capabilities Wiz Cloud Cost unlocked for us, highlight “win-win” initiatives that reduced both cost and security risk, and share how we’re approaching the challenges of cost management in the AI era.
The Spark: Designing a New Kind of FinOps Solution
The Wiz FinOps team were the original design partners for Wiz Cloud Cost. We recognized that the deep cloud visibility and context that already existed in Wiz could provide unique value for FinOps.
Cloud FinOps and cloud security have different goals, but share a key commonality: both depend on engineering teams (cloud resource owners) to implement the changes they are recommending. Wiz succeeded in cloud security by bridging the context gap between security and engineering, making it easy for engineers to remediate critical cloud risks. Now, over 50% of users in Wiz come from Engineering or DevOps. We believed that the Wiz model that worked in security could help transform FinOps as well.
Like many enterprise organizations, Wiz maintains a pragmatic, hybrid stack for cloud financial management. We rely on dedicated business intelligence (BI) tools for macro-level corporate allocations and ledger accounting. However, macro-level BI engines lack the granular infrastructure context needed for daily engineering engagement. Cost is one factor for engineers. They must balance cost, performance, reliability, compliance, and security when optimizing cloud resources. Wiz had a lot of cloud context already. By bringing in cost data, we could design Wiz Cloud Cost as our primary engine for engineering-facing cost management.
Bringing Cloud Context into the FinOps Operating Model
Instead of looking at cost line items in isolation, Wiz brings three distinct data layers together:
Infrastructure Context in the Wiz Graph: Maps every resource across our accounts, shows how assets connect, and links infrastructure back to source code repositories and commit histories.
Operational Context (Cloud Events): Captures API and operational activity, showing exact API calls, S3 request operations, and data transfers, rather than relying solely on delayed, aggregated provider billing files.
Financial Data (Cost): Correlates spend with infrastructure and operational activity.
Bringing these three layers together allows our team to solve practical problems that traditional billing reports struggle with:
Pinpointing the Root Cause of Spikes: When spend surges on RDS or a compute workload, cost data tells us where the jump happened, but Cloud Events tell us why it happened. We can see the exact API operations driving the surge, identify the backend service responsible, and trace it back to the repository where the code lives.
Resolving Shared & Untagged Spend: Unallocated spend can be an ongoing headache. When resource tags are missing or spend occurs in shared accounts, Cloud Events reveal the exact IAM role, service principal, or machine identity making the calls, improving attribution.
Tracking AI Model Usage: Provider billing labels for LLMs often lack granular tagging. Because Cloud Events log API invocations as they happen, Wiz will soon be able to track role-based model usage without waiting for clean provider billing files.
Because all of this information sits within the same platform engineers already use, we do not have to send spreadsheets. FinOps can surface cost metrics directly inside the Wiz Resource Drawer or share a direct link to the exact resource view so engineers can take action immediately.
Investigating Cost Anomalies: Putting Context Into Action
Having access to graph context and Cloud Events gives our team the raw data we need, but digging through event logs manually during a cost spike still takes time. To streamline investigations, we combine Cloud Events with Mika AI (Wiz’s built-in AI assistant) and Wiz MCP (Model Context Protocol) integrations.
When a cost anomaly occurs, such as a sudden surge in S3 request fees or backend compute activity, Mika AI uses Cloud Events under the hood to perform root-cause analysis. Mika analyzes the underlying event logs and graph relationships to show us:
The exact API operations or request types driving the spike.
The specific IAM role, service principal, or machine identity making the calls.
The urgency and financial impact of the anomaly.
To take investigations further, we leverage Wiz MCP. MCP allows our analysts and developers to query Wiz data directly from AI workflows like Claude using natural language. Rather than running complex custom queries across separate logs, an engineer can ask questions like, "What is this IAM role doing, and who owns the codebase triggering these calls?" to get an instant, contextual breakdown.
When a Wiz engineer noticed an unexpected spike in AWS S3 ListBucket API costs across production buckets, we turned to Mika AI to investigate. Within moments, Mika combed events to surface a clear signal: request volume on production buckets had surged from roughly 2 million per day to over 100 million starting at the end of the month, correlated precisely with a recently merged code change. Using Cost Explorer the team quickly narrowed the source to a service, which had begun enumerating at a dramatically higher rate after a feature flag was enabled for a new materialized-view query path. The root cause was confirmed and the behavior was validated as expected, reducing investigation time to minutes.
Win-win: Optimizing to Minimize Cost and Risk
Some of our most straightforward optimization wins happen where financial hygiene and security posture intersect. Because Wiz Cloud Cost sits on the same graph platform used by our security team, it automatically surfaces shared "win-win" opportunities where reducing cost also reduces security risk:
Unused Secrets (>90 Days): Forgotten secrets stored in Secrets Manager accrue monthly management fees while sitting there as an unnecessary attack surface. Identifying secrets that haven't been accessed in over 90 days gives both Security and FinOps a clear, shared reason to work with developers to delete them.
Shadow Data & Storage Hygiene: Storage spend often creeps up due to unneeded S3 buckets, forgotten retention policies, or excessive bucket versioning. Identifying these in Wiz lets us clean up unneeded data, reduce our attack surface, and lower storage bills at the same time.
Across these two categories alone, addressing unused secrets and shadow storage has translated to hundreds of thousands of dollars in annual spend saved on waste. A tighter cloud footprint means lower bills and a smaller attack surface at the same time.
How Cost Visibility Benefits Security
Our team was not the only group interested in the cost data in Wiz. The SecOps team was also intrigued. Because cost spikes often happen in real time when workloads change, sudden spending increases in compute or storage can act as an early warning system for potential security incidents.
By tracking usage alongside graph context, financial anomalies can help flag suspicious activity early, such as:
Unauthorized Crypto Mining: Resource-heavy compute workloads running unexpectedly inside the environment.
Log Ingestion Anomalies: Sudden spikes in telemetry volume that suggest an attacker is probing or attempting to breach the environment.
Unfamiliar Compute Deployments: Unexpected deployments of unauthorized EC2 instances or containers, especially in unusual regions.
By monitoring anomalous spend and correlating it with infrastructure context, we’re able to serve as a helpful partner to the broader security organization, catching unusual activity early before it escalates. In some cases, cost spikes and anomalies have been one of the first signs of an active attack.
What’s Next for FinOps and Cloud Cost at Wiz
We are excited to continue partnering with our product team to shape the direction of Wiz Cloud Cost based on real-world needs. Looking ahead, our team is focused on:
Deeper AI Tokenomics: Refining how we track and attribute LLM model calls, token usage, and inference spend across engineering teams.
Agentic & MCP Workflows: Embedding cost and graph context directly into AI developer workflows (via MCP) so engineers see financial impact as they build.
We look forward to sharing more of the journey, and would love to hear from you on how your team is tackling these challenges! If your security team is already using Wiz, we would love for you to give Wiz Cloud Cost a try. You can start a trial today from the Licenses page in your Wiz portal or request a demo.
