Meet Finout’s Investigation Agent: Cloud and AI Cost RCA in Minutes

Finout's Investigation Agent turns hours of cloud cost root cause analysis into minutes, explaining why each Finding happened, what it's really worth and who owns it.

At a Glance

• What launched: the Investigation Agent, the second of the Finout Agents, now in Beta.
• What it does: investigates every Finding and writes up the case: the evidence, the savings, and the owner.
• Why it's different: it reasons over your real bill and your business context, and never invents data it doesn't have.
• What it doesn't touch: your environment. The Investigation Agent is read-only.

The Finout Investigation Agent is an AI agent for FinOps that does the root cause analysis behind every cost-saving opportunity. When the Detection Agent creates a Finding, the Investigation Agent works out why it fired and pulls in who owns the resource. Your team gets a case it can act on, with your unique business context baked in.

Why It Matters

Spotting a savings opportunity is the easy part. "This database looks oversized" is where the real work starts.

Before anyone changes a production resource, someone has to answer a string of questions:

• Is it really waste? A low average can hide a nightly peak. One missing metric can turn a safe change into an outage.
• What is it actually worth? Theoretical list-price savings don't match what finance sees on the bill.
• Who owns it? Tags are missing, teams have changed, and the person who launched it left last year.

Today, a FinOps practitioner answers those by hand, across consoles, dashboards and Slack threads. It can take hours per recommendation. Multiply that by hundreds of Findings and most of them never get the attention they need. And when an engineer gets a recommendation with no evidence behind it, the first answer is usually no.

What We Built

We built the Investigation Agent to do that root cause analysis for you. It's now available in Beta for rightsizing and idle Findings across AWS, Azure and Google Cloud.

Every investigation opens with a short, plain-language explanation that always covers six things:

1. What was investigated
2. What was found
3. The key data points that support it
4. The estimated cost impact
5. The owner
6. Anything you should validate before acting

Below that sit the recommended action (for example, current instance type to recommended instance type) and the potential savings, calculated on your account's default cost type and labeled with it, so finance sees the same number the bill does.

Then the agent prepares the handoff. A Share with Owner message explains the case in plain words, and a View Ticket Draft lays out the summary, changes, justification, implementation steps and risks, ready to paste into Jira or ServiceNow. You review it and send it. Nothing goes out on its own (until the Orchestration Agent comes into play…coming soon).

What makes this trustworthy is what the Investigator won't do. It reasons only over the cost, usage and metadata Finout already has for that resource. If a data point is missing, such as memory utilization or a confirmed owner, it says so instead of guessing.

How It Works

1. A Finding arrives. The Detection Agent flags a resource based on the rules you configured, such as an idle instance or an oversized database.
2. The Investigator checks the evidence. It looks at the resource's utilization over time, not just the average, so peaks and gaps don't get lost.
3. It sizes the savings from your real bill. The estimate comes from what the resource actually costs you in MegaBill, after discounts and commitments.
4. It adds your business context. Virtual Tags supply the owner, team, environment and anything else you've mapped.
5. It hands you the case. You get the reasoning, the recommendation, the savings and a ready-to-send message and ticket. Want to dig deeper? Ask Billy follow-up questions about the resource.

A quick example. A Detector flagged a production PostgreSQL database averaging 9% CPU. A generic tool would say "downsize." The Investigation Agent found a nightly batch peak that the average hid, rejected instance types that couldn't handle it, recommended one that could, and called out a missing metric to validate first. Read the full walkthrough.

Where It Fits: Closing the Loop

The Investigation Agent is the middle of a loop. The Detector finds the waste, the Investigator explains it and finds the owner, and the Orchestration Agent gets that owner to act until the savings are recorded (or acts for you with customizable automation).

Any tool can open a ticket. Only Finout knows what it costs, why it moved and who owns it. That's why the case your engineers get is one they can trust and act on, and why your FinOps team can keep up with growing cloud and AI spend while staying lean.