Platform Prevent Autopilot Compliance Trust How it works Compare About Run a free scan → Book a demo
The agentic, human-approved governance control plane

Cut cloud waste and misconfigurations.
You stay in control.

AIFog finds the waste and the security risks across your clouds, drafts the fix, and routes it through one policy gate you approve. Cost and risk are scored as a single decision, savings are measured against the bill, and every step is on the audit trail.

ISO/IEC 27001:2022 certified · Read-only to scan · Free plan, no card · Connect a cloud in minutes
AWSAzureGoogle CloudKubernetesDatabricks
Terraform / Pulumi CI / CD pipelines Cloud console CLI / SDK AiFog GATE BLOCKEDPublic S3 · encryption off FLAGGEDGPU · no justification ALLOWEDTLS 1.3 · compliant
Inbound · every change, every source One gate · cost + security scored together Real-time · block · flag · allow
Product tour · 2½ minutes

The whole platform in two and a half minutes.

Inform spend · allocation · data trust Optimize recommendations · verified savings Prevent policy · AI & agent posture Autopilot governed remediation

Recorded on the live platform in sample-data mode. The figures are illustrative; the workflow is the one your team will use.

For FinOps · every dollar in focus

See the spend. Cut the waste. Prove the savings.

MONTHLY CLOUD SPEND AWS Azure GCP −22% after AiFog 28% REALIZED VERIFIED /mofrom the bill WASTE FOUNDidle · orphaned
Unified · AWS · Azure · GCP · K8s Realized · measured from your bill, not estimated
Depth most tools never reach

Most tools stop at VMs and disks.
We read the meter on every service.

Rightsizing a VM is table stakes. The real waste hides in PaaS, serverless, storage, data pipelines and AI, where each service bills on meters an instance scanner never sees. AIFog reads spend at that level across Azure, AWS and GCP and turns each finding into a specific, gated fix.

Compute & containers

Container AppsAKS/EKS/GKEFargateApp Service
Idle capacity billing, always-on min-replicas, and serverless-container hours priced for bursts, not steady load.

Serverless

FunctionsLambdaCloud Run
Pre-warmed capacity you pay for at zero traffic: provisioned concurrency and minimum instances left on.

Storage

Blob/S3/GCSRegistriesSnapshots
Dormant accounts nobody reads, cold data in hot tiers, image sprawl, and geo-redundant surcharges.

Databases & cache

SQL/RDSCosmos/SpannerRedis
Provisioned RU/s · DTU · vCore billed 24/7, oversized cache tiers, and non-prod DBs that never pause.

Data & ETL

DatabricksGlueSnowflakeBigQuery
Interactive vs job clusters, warehouse auto-suspend, and bytes-scanned on on-demand query.

AI & ML

OpenAI/BedrockVertexSageMaker
Token spend by model, prompt caching, and always-on inference endpoints that autoscale to zero.

Networking

NATEgressLoad balancersPublic IPs
NAT data-processing, idle IPs, cross-region egress, and fleets of lightly-used load balancers.

Integration & search

API MgmtEvent Hub/KinesisOpenSearch
Dedicated tiers where consumption is cheaper, and provisioned search/streaming units billed around the clock.
One engine reads them all. Every finding becomes a one-click, policy-gated fix.
30–40%
of cloud spend goes to idle, oversized and orphaned resources.
~6%
of CVEs are ever exploited. AIFog ranks those first, by exploitability and cost.
0
changes made to your cloud without a human approving them at the gate.
One control plane · FinOps · Observability · Governance

A policy gate, and an agent that only acts through it.

The gate scores cost and risk as one decision. Autopilot drafts the fix and can only execute through that gate, on your approval. The clouds' own advisors feed in as sensors, deduped into one view. Everything else on the platform runs through the same loop.

See how AIFog compares →

Autopilot

Agentic action, human-approved

Agents find waste and misconfigurations, draft the fix and route it through the gate. On your approval they execute, then verify the saving against the bill. A closed loop, not a chatbot.

Prevent

Shift-left guardrails

A policy gate that scores every proposed change for security and cost, then blocks, flags or allows it before it reaches production. It is what makes agentic action safe to switch on.

Inform

Cost visibility & unit economics

Every dollar across AWS, Azure, GCP, Kubernetes and Databricks. Allocation, unit economics and AI spend, reconciled to the provider bill with a trust score finance can stand behind.

Optimize

Waste & rate reduction

Rightsizing, idle and orphan discovery down to abandoned key vaults and idle HSM pools, plus commitment planning. Savings are tracked as realized, not estimated, and each cloud's own advisor is folded into one list.

Operate

Win the approval argument

Every recommendation carries its evidence: utilization provenance, blast radius, the policy that applies and your measured realization rate. When an owner pushes back, the agent answers from that evidence, or concedes and offers a smaller, reversible step. Budgets, alerts and chargeback reporting round it out.

Intelligence

AI copilots & briefings

Ask anything about spend, run investigations and get executive briefings grounded in your data. Headline figures come from a reviewed metric layer, not SQL a model improvises, in your billing currency as of the last settled day.

Enterprise · security · trust

Built to be trusted with your cloud

Connections are read-only to scan and remediation is opt-in. SSO with enforced MFA, seven scoped roles, row-level tenant isolation, credentials encrypted in a key vault, and a private-by-default platform with no public data plane. ISO/IEC 27001:2022 certified, with SOC 2 controls mapped to the same evidence. Trust Center →

The Prevent module

Guardrails that block the change, not just report it.

CSPM tells you what is already broken. AIFog's gate stops a risky change at deploy time, scoring security and cost in one decision.

  • ✓Security and cost in one gate. Public buckets and open SSH sit beside untagged spend and oversized GPUs. One engine, one verdict.
  • ✓Native enforcement. On Azure the gate publishes real Azure Policy deny rules, so the portal, CLI, ARM and Terraform all refuse the change before it exists. AWS and GCP get pre-deploy CI blocks and audit-log detection today, native blocks next.
  • ✓Live posture on your real accounts. Every finding is labelled either blocked at the gate or detected after the fact. The two are never blurred.
  • ✓A waiver on every block. Each denial carries a signed break-glass link to request a time-boxed exception. No dead ends, full trail.
  • ✓Identity and AI posture. Entra ID via Graph: PIM gaps, over-privileged service principals, stale secrets, guest sprawl. Azure OpenAI, Bedrock, SageMaker and Vertex in one registry: sanctioned models, key auth, content filters, encryption and spend. Guardrails it could not check are listed, never counted as passing.
  • ✓Agent posture. Every agent on Azure AI Foundry, Amazon Bedrock and AgentCore, and Vertex AI Agent Engine: the identity it runs as, the tools and MCP servers it can call, its guardrails, tracing and cost, scored against OWASP Agentic and MCP controls. Fixes go through the same gate.
  • ✓Fix-first ranking. EPSS exploit probability and the CISA KEV catalog, weighed with cost, so the few findings likely to be exploited on expensive resources come first.
  • ✓Your own rules. A validated rule builder, plus policies the AI proposes from your live risk.
150+ out-of-box policies
AWS-S01S3: block all public accessENFORCE
AZ-S07NSG: no internet to SSH/RDPENFORCE
GCP-S02GCS: no public bucketENFORCE
K8S-01No privileged containersENFORCE
FIN-01Mandatory cost-allocation tagsENFORCE
AI-S01Azure OpenAI: no public networkENFORCE
FIN-02GPU instances need justificationMONITOR
AWS-C01EBS: gp3, not gp2MONITOR

AWS, Azure, GCP and Kubernetes. Curated from CIS Benchmarks, NIST, AWS Well-Architected and the FinOps Foundation.

The Autopilot module

AI that acts, and proves it worked.

Every proposed action passes through the same Prevent gate, waits for a human, executes, and reports savings measured from the bill rather than estimated.

CLOSED LOOP 1Detect 2Draft 3Gate 4Approve 5Execute 6Verify
$128k
Realized / mo
3.4h
Mean time to fix
94%
Gate pass rate
COST × RISK TOXIC COST → RISK ↑ → one-click gated fix
  • ◆Agentic remediation. Rightsizing, idle cleanup and misconfiguration fixes, drafted and gated, one click from done.
  • ◆The case, not just the number. Each ask arrives with its evidence and provenance, so when the app owner asks why, you have an answer instead of an estimate.
  • ◆Change management for agents. Every action becomes an ITIL change, classified, CAB-approved and window-aware, on a hash-chained audit trail your GRC team can verify and pushed to ServiceNow, Jira SM or Splunk.
  • ◆Predictive forecast & tokenomics. Spikes flagged before they land; real cost-per-1M-tokens for AI spend.
  • ◆Sensor bus. Absorbs the clouds' own advisors, deduped, and shows what is genuinely new.
Inside the platform

Cost and risk on one screen.

Connect read-only and the first screen already answers the two questions nobody can answer today: what am I wasting, and what is actually dangerous.

app.aifog.ai/dashboard
Monthly spend
$48,210
across 3 clouds
Addressable waste
$9,640
20.0% of spend
Open risks
37
6 high · 19 med · 12 low
Verified savings
$5,180
executed & measured
Spend & waste trendlast 90 days
guardrails on 90d ago 60d today waste −34% since gate
Top recommendationsopen
Idle GPU node pool aks-train-02$1,840/mo
Unattached disks ×14 prod-eu$1,210/mo
Oversized RDS billing-db$940/mo
gp2 → gp3 migration ×62$610/mo
Stale snapshots > 90d ×210$385/mo
BLOCKED public S3 bucket at deploygate

Cost + risk in one graph

Every resource as a node. Size is spend, colour is risk, edges are blast radius. The expensive thing that is also exposed stops hiding between two tools.

$4.2k $2.1k
high risk medium clean blast radius

Fix-first, not severity-first

Only about 6% of CVEs are ever exploited. AIFog fuses EPSS probability and the CISA KEV catalog with blast radius and cost, so the few that matter surface first.

1,240 findings raw scanner output 312 with known CVEs enriched 18 exploited (KEV/EPSS) 3 fix first
EPSS exploit probability·CISA KEV·blast radius × cost
Controls mapped to frameworks

Map every guardrail to the frameworks you answer to.

Filter and report your controls by the obligations that matter, from federal to healthcare to payments. About 110 framework guardrails ship built in and re-sync as the benchmarks change. AIFog maps your controls for reporting; it is not an auditor or a certification body.

Control domainCISSOC 2NIST 800-53ISO 27001PCI-DSSHIPAA
Identity & access
Network exposure
Data protection
Logging & audit
AI posture
mapped partial not a named obligation
CIS BenchmarksPCI-DSSHIPAASOC 2NIST 800-53 FedRAMPStateRAMPISO 27001GDPRCSA CCMCMMCAWS Well-ArchitectedFinOps

Framework names denote control coverage for your reporting, not certifications held by AIFog.

How it works

Live in three steps.

AWS Azure GCP · K8s read only 1 · Connect analyse 2 · See policy gate your approval execute verify 3 · Automate verified savings
1

Connect

Link your cloud accounts, audit streams and CI/CD in minutes. AIFog verifies each connection live against AWS STS, Azure ARM and GCP IAM.

2

See

Unified cost, usage, and posture across every cloud. Unit economics, anomalies, and optimization opportunities surface automatically.

3

Prevent & automate

Turn on guardrails to block waste and misconfigurations at the gate, then let Autopilot draft and execute the fixes, with verified savings and a full audit trail.

Early access

Built in the open, with our first design partners.

AIFog is founder-led and self-funded, so there is no borrowed logo wall. We are onboarding design partners and building for the teams who feel the cost-versus-risk split most. Read the F.O.G vision →

Built for teams like these
S
Multi-cloud SaaS
₿
Fintech & payments
+
Healthcare & data
AI
AI-native startups
▲
Digital retail
◆
Platform teams
~18%
of spend surfaced as addressable waste in the first pass
Example · 3-cloud SaaS
1 gate
cost and security in one policy engine, with native enforcement live on Azure and AWS
Example · fintech
Token-level
AI/LLM spend tracked as unit cost, not a mystery line item
Example · AI-native
Questions

Frequently asked questions

The things teams ask us before they connect a cloud account.

Which clouds does AIFog support?
AWS, Azure and Google Cloud, plus Kubernetes and Databricks, in one control plane for both cost and security.
Is the free scan really read-only?
Yes. The initial connection is read-only, so AIFog finds waste and misconfigurations without changing anything. Remediation only runs after you approve it through the policy gate.
What does the free scan show me?
Your addressable cloud waste, your open security misconfigurations, and your spend across the connected clouds. Real numbers, in minutes, with no obligation.
How does AIFog keep my data secure?
Private by default: read-only access, enforced multi-factor authentication via SSO, row-level tenant isolation, and encryption in transit and at rest. AIFog is ISO/IEC 27001:2022 certified; SOC 2 controls are mapped to the same evidence. See the Trust Center.
How is AIFog different from a CSPM or a FinOps tool?
AIFog covers both cloud cost and cloud security, and adds agentic remediation: it drafts a fix, gates it through policy, waits for your approval, then executes and verifies the outcome. One control plane instead of four toolchains.
Does AIFog change anything in my cloud automatically?
No. Every action is gated by policy and requires human approval before it executes. After it runs, the result is verified and logged in a full audit trail.
How does AIFog decide what to fix first?
It combines EPSS scores and the CISA KEV catalog with each resource's blast radius and cost, so you fix what is both most dangerous and most expensive first.
What does AIFog cost?
There is a free plan and a free read-only scan to start. Paid plans scale with the size of your cloud estate.
See it for yourself

Let AI run your cloud. Safely, and on the numbers.

Explore the live demo: the Prevent gate, Autopilot, the cost and risk graph and forecasting, populated with realistic multi-cloud data.

Screens and figures on this page are illustrative sample data, not customer results.