Project Ember
Combines cloud cost telemetry with security signals so that unusual cost spikes, often an early indicator of compromise, are investigated as security events rather than just budget anomalies.
Product status
- Concept
- Prototype
- MVP
- Pilot
- Beta
- Production
- Scale
Problem
Cost anomalies caused by security incidents are often first noticed by finance teams reviewing bills, well after the fact, rather than by security teams.
Why this problem matters
Closing the gap between cost anomaly detection and security investigation shortens the time to detect certain kinds of cloud compromise.
Solution
Correlates cloud billing and usage telemetry with security-relevant signals to flag cost anomalies that likely have a security root cause.
Core capabilities
- Cost-anomaly detection
- Security-signal correlation
- Joint security/FinOps alerting
Architecture
Billing telemetry is evaluated alongside security-relevant cloud events; a correlation layer flags anomalies that combine cost and security signal.
How it works
- 1Connect cloud billing and usage data.
- 2Connect security-relevant telemetry.
- 3Anomalies where cost and security signals align are flagged.
- 4Security and FinOps teams receive a joint alert rather than two disconnected ones.
Security model
- • Read-only billing and telemetry access
Not yet independently assessed
Integrations
- • AWS Cost Explorer
- • Azure Cost Management
- • Planned: GCP Billing
Deployment models
Target customers
- • Cloud security teams
- • FinOps teams
- • Platform engineering
Business model
To be determined.
Differentiators
- • Treats cost anomalies as a security signal rather than a purely financial one.
Evidence
Architecture & documentation
Concept brief
ConfidentialTraction
Stage
Concept
Roadmap
now
Correlation model design
Define the signal set and correlation heuristics.
next
AWS pilot
First working correlation pipeline on AWS billing and CloudTrail data.
later
Multi-cloud expansion
Extend to Azure and Google Cloud.
Team capability
Investor relevance
A novel cross-functional angle on cloud security that has not yet been broadly commoditized.