Detection Catalog

1. Orphaned storage

Why it matters: the single most common finding, and the easiest to act on. A detached volume does nothing and bills forever.

2. Stale snapshots and images

Why it matters: snapshots accumulate silently for years. Nobody deletes them because nobody is sure what depends on them — which is exactly the dependency mapping Cloud-Vex provides.

3. Stopped-but-billing compute

Why it matters: the Azure Stopped vs Stopped (deallocated) distinction is one of the most expensive misunderstandings in cloud. A VM stopped from inside the guest OS keeps billing at full rate.

4. Idle and low-utilization compute

Signal: CPU, network in/out, and disk I/O across a configurable window — 14 days by default. Every finding shows the evidence and thresholds used, so an engineer can dispute it.

5. Over-provisioned resources (rightsizing)

Approach: ingest the native recommendation APIs rather than reinventing them. They’re free, first-party, and carry credibility with skeptical engineers. Cloud-Vex adds the layer they can’t — cross-cloud normalization and dollar-ranked prioritization across the whole estate at once.

6. Orphaned network resources

7. Idle load balancing

8. Idle gateways and connectivity

Why it matters: gateways bill hourly whether or not anything flows through them. A NAT gateway left behind from a decommissioned VPC is pure loss, and nobody ever looks at it.

9. Idle databases and caches

10. Containers and Kubernetes

Why it matters: forgotten clusters are a classic. An EKS or GKE control plane costs roughly $73/month doing nothing at all, and teams routinely leave three or four behind after a migration.

11. Object storage

Why it matters: incomplete multipart uploads are the best hidden-cost finding in the catalog. They don’t appear in the console object listing, they bill indefinitely, and a busy account can hold terabytes of them.

12. Analytics and data platform

13. Logging and observability

Why it matters: CloudWatch defaults to infinite retention. Multiply that by every Lambda function anyone ever deployed and it becomes a real line item that nobody has ever looked at.

14. Serverless and edge

15. Artifact registries

16. Commitments and discount instruments

Boundary: Cloud-Vex reports commitment health. It does not purchase, sell, or exchange commitments — that’s a different product with different risk, and buying financial instruments on a customer’s behalf is outside the read-only model.

17. Cross-cutting detections

Why the region check matters: a proof-of-concept spun up in ap-southeast-2 two years ago is invisible to everyone who only ever looks at their home region. This one’s on the roadmap, not live yet — see the pending items above.

18. Managed platform services

Why it matters: an Azure App Service Plan bills its full tier whether or not a single app is deployed on it. Delete the app, forget the plan, pay forever. App Engine is the same story — old versions keep instances allocated after traffic has been shifted away.

19. Machine learning, GPU, and notebook environments

Why it matters: this is the highest dollar-per-resource category in the catalog. A single idle GPU instance can run $1,000–$3,000/month, and notebook environments are notorious for being started on a Friday and rediscovered in a quarterly review.

20. Virtual desktops and end-user compute

Why it matters: virtual desktops for employees who left is one of the cleanest findings there is — nobody deprovisions them, because the offboarding checklist rarely reaches the VDI console. It’s on the roadmap; today’s reliable universal APIs for resolving desktop-to-user assignment against a directory aren’t there yet on either cloud.

21. Backup, disaster recovery, and replication

Why it matters: Azure Recovery Services vaults continue billing for backup items after the source VM is deleted. The VM is gone from every inventory view, but the protected item persists.

22. File and shared storage

23. Network path inefficiency

Why it matters: S3 gateway endpoints are free on AWS and eliminate NAT data-processing charges entirely for S3 traffic. An account moving heavy S3 volume through a NAT gateway is paying real money — often thousands a month — for something a one-line configuration change makes free. This is the highest-ROI single recommendation in the catalog.

Cloud-Vex does not do general data-transfer optimization. Architectural network waste — a missing free endpoint, a needless cross-AZ hop — is a different thing and is squarely in scope for the product. The missing-free-endpoint check ships today; cross-AZ and public-path traffic checks need flow logs, which are opt-in on every cloud and not yet built — see above.

24. CI/CD and build infrastructure

Why it matters: self-hosted runners are provisioned once and run continuously, but they’re only doing work during business hours on weekdays — roughly 25% of the time they’re billed for.

25. Small-unit sprawl

Individually trivial, collectively material at scale. These are reported as an aggregate line rather than one finding per item.

Why it matters: a thousand unused KMS keys is $1,000/month. Nobody notices, because no single item is worth noticing.

26. Behavioral and lifecycle patterns Not yet available

The most valuable category, and the one native tools handle worst — because these require watching change over time rather than inspecting current state. That’s also why this whole category is roadmap, not live: every detection below needs a baseline built from multiple scans over time, and scan-history comparison is a design we haven’t built yet, not a per-check gap. Everything else in this catalog is a point-in-time read; this table shows what we’re building toward.

Why it matters: “we upgraded that during the outage in March and nobody changed it back” is the most common origin story for large cloud waste, and no per-resource inspection will ever catch it. It requires baseline and drift — which is where scanning continuously will earn its keep over a one-time audit, once this category ships.

How costs are attributed

Every finding carries a dollar figure computed on effective amortized cost — after EDP, Enterprise Agreement, Savings Plan, Reserved Instance, and CUD discounts. Never list price.

Where the effective rate can’t be resolved, the finding is flagged confidence: medium and says so on the face of it.

Each finding also distinguishes:

• Cost incurred — what this resource bills today.
• Cost avoidable — what actually stops if you act, which is often less, since dependent resources may keep billing.
• Reversibility — whether the action is trivially undoable (stop an instance) or permanent (delete a snapshot).

What Cloud-Vex does not do

• No write access, ever. Cloud-Vex recommends; your team executes. No IAM role we request can change anything.
• No automated remediation. Deliberate. Auto-deletion inside a customer’s account is exactly what a security reviewer screens for.
• No commitment purchasing or brokerage.
• No application-level or code-level optimization. Infrastructure waste only.
• No general data-transfer or egress optimization. Bandwidth modelling needs data we deliberately never collect. Architectural network waste is a different thing and is in scope — see network path inefficiency.
• No FinOps chargeback, showback, or budget allocation.

The permission model shows exactly what is granted in each cloud, and the scan cycle shows every API a scan touches.