Outcome
By the end of this lesson, you will be able to describe the operate motion and design a weekly + monthly cadence that compounds savings instead of decaying them.
New to the cloud? The optional track Cloud, from zero covers the basics first.
| Prerequisites | L1, L2, L3 |
| Time | 9 minutes |
1. Concept
FinOps, the practice of managing cloud spending jointly across engineering, finance and the business, has three phases: Inform (see the spend), Optimize (cut it) and Operate. Operate is the third phase, and it is the difference between a company that does this and a company that did it once.
Without it, every saving unwinds. Schedules, which switch non-production machines off at set times, get switched off and stay off. Tags, the labels that say which team owns a resource, stop being applied. Commitments, promises to the cloud provider of a year or more of use in return for a lower price, come up for renewal and get approved without anyone checking. A year later the avoidable spending is back where it started.
This phase is not a project with an end date. It is a set of recurring checks on a weekly, monthly and quarterly rhythm, called a cadence. Each has a named owner, and each is attached to a number that triggers an action.
What decays without Operate
WHAT WAS DONE WHAT DECAYS WITHOUT OPERATE──────────────────────────────────────────────────────────────────────Scheduled non-prod off-hours Schedules disabled "just this once"Rightsized 30 instances Re-grown to original size in 6 monthsBought a 1-yr commitment Renewed without re-baselining floorSet lifecycle policy on snapshots Exceptions accumulate, policy weakensCleaned untagged spend to 5% Drifts back to 18% over two reorgsEstablished budget per team Variance reports stop being readRightsizing means shrinking a machine to the size it needs; a lifecycle policy is a rule that deletes old copies automatically; re-baselining the floor means re-measuring the minimum usage before committing again.
None of this happens because a team is careless. It happens because nobody owns the recurring check. This phase is the part where that ownership gets written down.
The three cadences
Weekly (operational).
- Work through the recommendations (suggested fixes from your cost tool). Apply, dismiss, or defer with a reason written down.
- Check the schedules. Is anything switched off with no date to switch it back on?
- Check the spending alerts. Is anything from last week still unexplained?
- Who runs it: one cost specialist and one engineer, rotating.
- How long: 30 to 45 minutes.
Monthly (tactical).
- Close the month. Reconcile billed cost against budget per team.
- Update unit economics dashboards. Unit economics means cost divided by something the business counts: cost per order, per customer, per thousand requests.
- Review the avoidable-spend KPI.
- Update tag-coverage trend.
- Owner: FinOps + finance + each team lead.
- Time: 1 hour.
Quarterly (strategic).
- Re-baseline commitments: Reserved Instances (RI) and Savings Plans (SP) on AWS, committed use discounts (CUD) on Google. Check how much usage they cover and how much of what you bought is used.
- Review the FinOps maturity self-assessment.
- Update the forecast for the next quarter.
- Review the OKRs (objectives and key results: the team’s goals for the quarter).
- Owner: FinOps lead + finance + engineering leadership.
- Time: 2 hours.
Five operate KPIs
A KPI (key performance indicator) is a number you track to see whether things are working. These are the five a healthy FinOps practice tracks weekly:
- Avoidable spend % of bill (money going on things nobody needs). Target: below 8%.
- Tag coverage %. Target: above 95%.
- Open recommendations dollar value. Trend toward zero.
- Commitment coverage % and utilization %. Coverage stable; utilization above 90%.
- Unit economics trend (cost per monthly active user, per order, per 1K API requests). Direction matters more than absolute number.
These five drive the operate conversation. Anything else is supporting detail.
The compounding effect
A team that runs this phase well sees savings build rather than fade. The mechanism is simple. New recommendations keep appearing as the estate changes. Schedules keep firing. Alerts keep catching sudden jumps in spend (anomalies). The weekly rhythm deals with each one while it is still small.
A team that does not practice Operate will run an optimization sprint, claim savings, and find six months later that the savings are partially gone. The post-mortem usually concludes “we need another optimization sprint.” The actual fix was always Operate.
Who owns Operate
A common failure mode is “FinOps owns Operate.” This is principle 3 (ownership) inverted. Central FinOps owns the cadence and tooling; each team owns its own operate work within that cadence.
The right structure is simpler than it sounds. A small central group publishes the standards, the numbers to watch, the weekly template and what to do when spending spikes. It runs the tools and hosts the meeting. Each team brings its own numbers and its own actions.
2. Demo
A sample weekly operate meeting agenda for a mid-size FinOps practice:
WEEKLY FINOPS REVIEW: 30 min, Mondays at 10:30─────────────────────────────────────────────────────────1. KPI dashboard read (5 min) - Avoidable spend % WoW - Tag coverage % WoW - Open recommendations $ value WoW - Anomaly (unexpected spend jump) count last 7d
2. Recommendations triage (10 min) - Top 10 open recommendations by savings - Apply / dismiss / defer (with reason) - Note any new patterns
3. Schedule + autoscaler health (5 min) - Any disabled schedules without expiry? - Any autoscaler policies (rules that add and remove machines with load) in error state? - Any overrides (temporary exceptions to a schedule) expiring this week?
4. Anomaly review (5 min) - Last week's anomalies, status check - Any unresolved root causes?
5. Open items + parking lot (5 min)─────────────────────────────────────────────────────────Thirty minutes per week. The same five sections. The same five KPIs. The discipline is the cadence, not the agenda.
3. Hands-on (6 min)
Design your own weekly cadence. Fill in:
1. WHO is in the room? FinOps lead: ____________ Eng rep(s): ____________ Finance: ____________ (monthly, not weekly)
2. WHEN does it happen? Day / time: ____________ Duration: ____________
3. WHAT is reviewed every week? KPI 1: ____________ KPI 2: ____________ KPI 3: ____________ KPI 4: ____________ KPI 5: ____________
4. WHAT decisions can be made in the room? ____________ (list 3: these are the decisions that make the meeting worth holding)
5. WHO owns the runbook (the document that says how to run the meeting)? ____________If items 1, 2, and 5 are not concrete people and times, the cadence does not yet exist. Operate without a calendared meeting is wishful thinking.
4. Knowledge check
Q1
A team ran a successful FinOps sprint and saved $30K monthly. Six months later, the savings are partially gone. Best diagnosis:
A. The savings were over-claimed
B. Without an Operate cadence, schedules drifted, recommendations went unreviewed, and the estate evolved without checks
C. The cloud provider raised its prices partway through the period, which wiped out the gains from the sprint
D. The team got bigger
Show answer
Correct: B. The fix is Operate, not another sprint. Sprint-driven savings decay without Operate. The corrective action is the recurring cadence, not another sprint that will also decay.
Q2
“FinOps owns the operate cadence and the per-team numbers.” This statement most directly violates:
A. Principle 1 (collaborate)
B. Principle 6 (variable cost)
C. Principle 3 (ownership)
D. Principle 4 (data accessible, timely, accurate)
Show answer
Correct: C. Central owns the cadence and the tooling. Each team owns its own per-team numbers and per-team actions. The principle is “centrally enabled, locally owned” (principle 5), and “ownership lives with the user” (principle 3).
Q3
The five Operate KPIs are designed to be reviewed:
A. Annually at a strategic offsite
B. Daily for engineering and monthly for the finance team
C. Whenever someone asks
D. Weekly, with monthly and quarterly deeper cuts on the same set
Show answer
Correct: D. Weekly cadence is what makes Operate compound. Monthly and quarterly are deeper passes on the same KPIs, not a separate set.
5. Apply
ZopNight, the cloud cost product taught from Track 1, supports Operate with:
- Recommendations queue with weekly digest email → drives weekly triage
- Schedules and Overrides pages show what is scheduled and which overrides are active → drives weekly health review
- Cost anomaly detection, run once a day → drives weekly review
- Budget thresholds with notifications → drives monthly variance conversation
- Costs → Reports → Summary, whose cost trend chart shows spend over the period → drives monthly KPI read
- MCP (the standard way AI assistants such as Cursor or Claude Code call a product’s functions) for self-serve KPI queries → makes the weekly meeting prep one prompt
The five Operate KPIs each have a home in ZopNight:
| KPI | Where |
|---|---|
| Avoidable spend % | Recommendations → “Potential Savings” card, divided by the Costs → Reports → Summary total |
| Tag coverage % | Cost Reports → Tags, Tag Coverage card |
| Open recommendations $ | Recommendations summary card |
| Commitment coverage / utilization | Costs → Flow, with a layout that includes Purchase |
| Unit economics trend | Costs → Unit Economics |
Open ZopNight Dashboards → FinOps (deep link)
Related lessons
Glossary terms touched
FinOps lifecycle · Operate cadence · Avoidable spend · Utilization