Skip to main content
Your progress
0 of 4 lessons complete0%
T0 / M0.6 / L2 OF 4 / Operator TIER / 10 min

The cost of detect-only: case study

Outcome

By the end of this lesson, you will be able to quantify the cost of detect-only operation and present the business case for closing the loop.


TierOperator
JTBD”Show the CFO the number that justifies investment in CDCR.”
PersonasFinOps Analyst · Engineering Leader · Finance Partner
PrerequisitesL1
Time10 minutes
Bloom verbQuantify (Apply) and Present (Create)

1. Concept

Finding waste and not fixing it is not free.

This lesson calls that way of working detect-only: the tool finds things and stops there, and a person is left to do something about it eventually.

Between the day a finding appears and the day somebody acts on it, the waste keeps billing. Nobody sends you an invoice for that delay, which is exactly why almost nobody measures it. On a normal estate it is a large number.

Working it out

For any single finding:

Terminal window
COST OF DETECT-ONLY (per finding)
= monthly savings if remediated × (time-to-remediation in months)

For 100 findings averaging $300/month potential savings with a 45-day average time-to-remediation:

Terminal window
Avoided monthly savings: 100 × $300 = $30,000
Time-to-remediation: 45 days = 1.5 months
Cost of the 45-day delay: 100 × $300 × 1.5 = $45,000
Over a year, 8 such rounds: $45,000 × 8 = ~$360,000

Careful assumptions still produce a six-figure annual number, entirely from delay. The company is paying for waste it has already found.

The case study

A real customer, anonymised. An 800-person software company, $2.1M of cloud spend a month, three years of FinOps practice, sitting at the Walk stage of the three maturity stages from M0.2.

Before CDCR (pure report-and-ticket):

Terminal window
DETECTION
Recommendations surfaced per month: ~250
Median savings per recommendation: $180/mo
Total potential monthly savings detected: $45,000
REMEDIATION
Median time from surfaced → remediated: 38 days
Share actually acted on: 47%
(53% closed as "won't fix")
WHAT THAT WAS WORTH
If everything were fixed on day one: $45,000/mo
What actually landed: $11,200/mo (25% of the total)
The gap, which is the cost of delay: $33,800/mo (75% of the total)
OVER A YEAR $405,600

After 90 days of CDCR rollout:

Terminal window
DETECTION (unchanged: same detection engine)
Recommendations surfaced per month: ~250
Median savings per recommendation: $180/mo
Total potential monthly savings detected: $45,000
REMEDIATION
Safe findings, fixed automatically: under 30 min
Findings needing a yes from somebody: 12 hours
Findings only a person can do: still 38 days, but only ~30 of them
Share actually acted on: 89%
WHAT THAT WAS WORTH
If everything were fixed on day one: $45,000/mo
What actually landed: $37,800/mo (84% of the total)
The remaining gap: $7,200/mo (16% of the total)
OVER A YEAR $86,400
(down from $405,600)

The result: $319,200 a year, found by closing the gap between finding and fixing. No new detection, no price change, nobody hired.

Where the money goes

Three things drive that gap.

1. Delay. Every day a finding waits, it costs its own monthly value divided by thirty. Automatic action takes that from 38 days to 30 minutes, and the waste that would have billed in between is the saving.

2. Findings that die in the queue. In the detect-only world, 53% of findings were closed as “won’t fix”. Very few were wrong. By the time anybody looked at them the situation had changed, the team had moved on, and the item had sunk in the backlog. Closing the loop quickly means the finding is still relevant when it is acted on.

3. Compounding, in both directions. A team clearing 250 findings a month has the room to spot the next 250. A team clearing 50 of 250 falls further behind each month. The same effect works for you or against you depending on whether the loop is open.

The argument that doesn’t work

A common objection: “Just hire more people.” If the bottleneck is ticket throughput, more engineers can close more tickets, right?

The numbers say otherwise. Three FinOps people clearing 250 tickets a month at $180 each produce $45K of savings a month. Three people cost the company $300K to $450K a year once salary, benefits and overhead are counted. So the team pays for itself only well above 250 tickets a month, and few teams hold that rate for long: people get pulled onto other work, priorities are argued over, and some changes need a conversation with another team before they can happen.

CDCR avoids the question. The safe findings close themselves, and people spend their attention on the roughly 10% that genuinely need a judgement call.

When detect-only is the right answer

Two scenarios:

  1. Very small estates, under $10K a month. What CDCR would save does not cover the effort of setting it up and running it. Read the bill weekly and fix things by hand.
  2. Regulated places where every change needs sign-off. If a board has to approve each cloud action, the automatic path is not available to you. The approval path still helps, though you are back to waiting weeks.

Above $50K a month, detect-only stops making sense: the delay costs more than closing the loop would.


2. Demo

The same case study, presented as a chart:

Terminal window
COST OF DELAY: pre-CDCR vs post-CDCR
$45K ┤ ──────── Detected potential
│
│ ── ── ──
$35K ┤ Post-CDCR realized
│
│
│
$11K ┤ ● ● ● ● ● Pre-CDCR realized
│
$0 ┴─────────────────────────────────────────
Jan Feb Mar Apr May Jun
(CDCR rollout)
ANNUALIZED IMPROVEMENT: $319,200

The numbers presented this way settle the business case. The improvement is not from detecting more: it is from acting faster on the same detections.


3. Hands-on (6 min)

For your own organization:

Terminal window
1. How many recommendations does your current tool surface per month?
N = __________
2. Median monthly savings per recommendation:
$S = __________
3. Total monthly potential:
$P = N × $S = __________
4. Median time from surfaced to remediated:
T = __________ days
5. Pickup rate (what % actually get acted on):
R = __________ %
6. Current realized savings:
$R = $P × R% × (time-decay factor, assume 0.7)
= __________
7. Cost of detect-only:
$D = $P − $R = __________ per month
8. Annualized:
__________ per year

The annualized cost of detect-only is the business case for CDCR investment.


4. Knowledge check

Q1

A team detects $40K/month in potential savings but only realizes $9K/month. The cost of detect-only operation is:

A. $9K/month
B. $40K/month: the full potential
C. $31K/month: the gap between detected potential and realized savings
D. $0, since they are already realizing all that they possibly can

Show answer

Correct: C. The cost is the gap, not the realized or the potential. The gap is what CDCR closes.

Q2

A common objection to CDCR is “we just need more FinOps headcount to close tickets faster.” Most defensible counter-argument:

A. Headcount is expensive, so the tool has to pay for itself first
B. The math doesn’t work: a FinOps engineer fully-loaded costs $150K+
C. Engineers are scarce
D. CDCR is a buzzword

Show answer

Correct: B. Closing 250 tickets per month at $180 average savings produces $45K realized, less than the headcount cost. CDCR closes the loop without adding people; people focus on the ~10% requiring judgment. The math is the argument. Scaling FinOps by headcount alone hits diminishing returns fast. CDCR scales the act layer without scaling people.

Q3

A team is at <$10K/month total cloud spend. The defensible posture is:

A. Implement CDCR immediately
B. Hire a FinOps consultant
C. Manual cost review weekly
D. Switch clouds

Show answer

Correct: C. Plain reading-and-acting is fine CDCR’s operational overhead is not paid back at small scale. Honesty about scale. CDCR is a great fit above ~$50K/month. Below that, the discipline matters more than the tooling.


5. Apply

ZopNight’s Recommendations page tracks both detected and remediated savings. The summary card shows:

  • Total Open Recommendations (detected potential, not yet realized)
  • Total Applied Recommendations (realized savings, last 30 days)
  • Auto-Remediation Coverage % (the percentage of safe-class findings that auto-remediate vs. await approval)

These three numbers are the input to the cost-of-detect-only conversation. Track them weekly. The annualized gap is the business case.


Glossary terms touched

Cost of detect-only · Time-decay · Won’t-fix attrition · Pickup rate


Start with the bill.

Foundations takes about five hours. The first lesson is nine minutes.

Open curriculum. No login. No paywall. 290 lessons across 7 courses, three publicly verifiable credentials. Read it on the train, take the exam on a Saturday, list the credential on your résumé Monday.

5h median time to finish Foundations
0 logins, paywalls, or marketing forms
open curriculum, public credential verifier
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·