Effective FinOps: Moving from Recommendations to Risks

Eric Ethridge
DoiT

FinOps champions crucial cross-departmental collaboration, uniting business, finance, technology and engineering leaders to demystify cloud expenses. Yet, too often, critical cost issues are softened into mere "recommendations" or "insights" — easy to ignore. But what if we adopted security's battle-tested strategy and reframed these as the urgent risks they truly are, demanding immediate action?

This shift isn't just about semantics; it's about survival. Unchecked cloud costs aren't minor annoyances; they're financial liabilities that can shatter a company's foundation. Startups can incinerate their monthly runway in a single day. For mid-market firms, unanticipated or overlooked cloud expenses can obliterate profitability in an instant. This financial bleed doesn't just erode profit; it undermines operational performance and even security.

FinOps teams must treat these financial risks with the same gravity as security threats. Security doesn't offer vague suggestions; it pinpoints specific risks, assigns severity levels and tracks vital metrics like mean time to resolution. By mirroring this approach, FinOps can evolve from passive optimization to a proactive financial defense system that tackles risks head-on. This transforms cloud cost management from an "if time allows" chore into the non-negotiable, timely imperative it must be.

Risks and Responsibilities

Changing the conversation from soft "recommendations" to hard "risks" ignites urgency and breeds accountability. Suddenly, teams aren't just trying to save a buck; they're active guardians of financial stability. Engineers attack cost issues with the same tenacity they apply to critical bugs, and finance teams are right there, collaborating every step of the way.

What do executives get?

Real outcomes measured by clear metrics, not just vague "what-ifs."

FinOps teams must adopt this aggressive mindset and equip themselves with the right tech. A solution's purpose isn't to churn out endless suggestions. It's to sharply identify cost risks, make them actionable and then track how quickly and effectively they're neutralized. This isn't about mere budget tweaking; it's about forging a culture where innovation flourishes alongside strong financial controls.

FinOps: A Force Multiplier for Security

This re-envisioned FinOps isn't just about money; it's a significant boost for security:

  • Shrinking the Attack Surface: FinOps excels at spotting overprovisioned or idle cloud resources. This isn't just cost savings; it's also a direct way to reduce potential targets for attackers and close security holes.
  • Hardwiring Accountability: The core of FinOps is accountability, a principle critical for security. When resources have clear owners, enforcing security policies becomes straightforward. Data breaches can be traced back to unauthorized usage, and better-managed environments drastically cut down on misconfigurations that create vulnerabilities.
  • Building a Security-First Culture: When cost accountability is deeply ingrained, employees at all levels are far more likely to stick to security best practices and proven configurations, knowing they're directly responsible.

Today's tools are powerful allies. The right cost and security monitoring platforms allow for side-by-side evaluation of critical data. Resource tags can simultaneously track both financial and security risks. Budget alerts can even flag potential security breaches by detecting unusual cost spikes caused by malicious activity. And automation can seamlessly integrate FinOps, consistently applying governance across financial and security landscapes.

A Better Picture

The current FinOps approach is falling short for far too many organizations. The deluge of "recommendations" isn't delivering. A radical reframing is desperately needed, one that starts by calling cost issues exactly what they are: actual risks, demanding swift urgency and clear accountability.

True success won't be found in the sheer number of suggestions, but in the critical issues unearthed and definitively resolved — and the speed and thoroughness with which that resolution occurs. This transformative approach doesn't just fix financial leaks; it shatters siloed decision-making, forcing crucial conversations where cost and security are always considered hand-in-hand, painting a far more complete and actionable picture.

Eric Ethridge is Senior Technical Account Manager at DoiT

Related Links

Hot Topics

The Latest

Three Strikes and They're Gone: Why Proactive Operations is Now a Customer Retention Strategy

IT organizations have historically measured success by how quickly they can respond when something goes wrong. The entire discipline of Incident Management has been optimized around mean time to resolution, first-response SLAs and ticket closure rates. But new research suggests that even though this is a well-executed playbook, it's no longer enough to retain customers ...

When the Database Is the Problem, Is APM Enough?

Production incidents rarely announce themselves as database problems. They appear as slow transactions, timeouts, rising response times, or an application struggling under a workload it previously handled. APM provides an essential starting point. It can identify a slow transaction path, highlight an affected service, and show that a database dependency is consuming more time than expected. But identifying the database as part of the problem is not the same as explaining what is happening inside it ...

From Cleanup to Prevention: The Future of Cloud-Native Cost Optimization

Cloud teams are under constant pressure to reduce spend without slowing development or increasing operational risk. They are deploying autoscalers, rightsizing workloads, enforcing resource requests, reviewing utilization dashboards, and building FinOps processes around cloud-native environments. Yet the results often disappoint ...

The Real Enterprise AI Risk Isn't Hallucinations

Ask most IT leaders about their biggest concern with AI and you'll hear the same answer: hallucinations ... Today, however, the conversation has shifted ... As organizations move beyond chatbots and experiments, they are increasingly deploying AI agents that perform multi-step tasks. These systems retrieve documents, query databases, call APIs, generate reports, write code, and make recommendations. The issue is not whether the model can reason. The issue is whether the organization can see, verify, and govern the decisions being made along the way ...

Beyond Buy vs. Build: The New Playbook for Data Pipelines

While organizations want to take control of their telemetry, building telemetry pipelines from scratch can be a very daunting, complicated task, even when leveraging open-source standards like OpenTelemetry. It requires specialized knowledge across distributed systems, data engineering, and security. This fragmented approach across systems causes higher operational costs; it puts a strain on resources and reduces efficiency as teams have to work with different interfaces and processes ...

The Corporate Network Is Fading - Here's What Replaces It

For decades, enterprise networks were designed around a simple assumption: work happened inside the office. Applications lived in centralized data centers, employees connected through internal infrastructure, and security focused on protecting the perimeter that surrounded everything ... But the way organizations operate today bears little resemblance to that environment. Cloud platforms host critical applications, employees connect from homes and airports as often as they do from offices, and partners collaborate through shared systems that exist far beyond corporate walls. In short, the corporate network no longer resembles the environment it was designed to protect ...

IT Leaders Must Establish a Network Data Architecture Practice

As an analyst who researches how IT organizations design, build, and operate their networks, I find that network data is a constant source of pain. Network teams struggle with data quality, fragmentation, authority, access, and trust. And these issues undermine everything they try to do. Here are the numbers: Only 45% of network teams are completely confident in the accuracy of their network source of truth, which documents the intent of their network ...

Data Center Outages Are Decreasing but More Costly

The 2026 Global Data Center Survey from Uptime Institute reveals an industry navigating workforce constraints, escalating outage expenses, even as rising costs remain the top concern for management teams ...

Observability Has a Physical Layer Now: What AI Infrastructure Teaches IT Operations

The next observability gap may not be in the code. It may be under the rack. That sounds strange until you think about how AI incidents actually feel in the middle of an investigation ... The application dashboard may be accurate. It may also be stopping at the wrong boundary. AI systems depend on software, but they also depend on a dense physical stack: racks, power paths, thermal margin, maintenance activity and, in many environments, liquid cooling. Those physical dependencies can change slowly before they look like a software incident ...

TLS Certificate Expiration Is Becoming an Observability Problem

Certificate expiration is the rare outage you can see coming. Every TLS certificate carries the date it stops working, so the moment it will begin breaking connections is knowable in advance. That's what makes an expired certificate such a frustrating way to lose a service. What's changing now is how often that date comes around ...

Effective FinOps: Moving from Recommendations to Risks

Eric Ethridge
DoiT

FinOps champions crucial cross-departmental collaboration, uniting business, finance, technology and engineering leaders to demystify cloud expenses. Yet, too often, critical cost issues are softened into mere "recommendations" or "insights" — easy to ignore. But what if we adopted security's battle-tested strategy and reframed these as the urgent risks they truly are, demanding immediate action?

This shift isn't just about semantics; it's about survival. Unchecked cloud costs aren't minor annoyances; they're financial liabilities that can shatter a company's foundation. Startups can incinerate their monthly runway in a single day. For mid-market firms, unanticipated or overlooked cloud expenses can obliterate profitability in an instant. This financial bleed doesn't just erode profit; it undermines operational performance and even security.

FinOps teams must treat these financial risks with the same gravity as security threats. Security doesn't offer vague suggestions; it pinpoints specific risks, assigns severity levels and tracks vital metrics like mean time to resolution. By mirroring this approach, FinOps can evolve from passive optimization to a proactive financial defense system that tackles risks head-on. This transforms cloud cost management from an "if time allows" chore into the non-negotiable, timely imperative it must be.

Risks and Responsibilities

Changing the conversation from soft "recommendations" to hard "risks" ignites urgency and breeds accountability. Suddenly, teams aren't just trying to save a buck; they're active guardians of financial stability. Engineers attack cost issues with the same tenacity they apply to critical bugs, and finance teams are right there, collaborating every step of the way.

What do executives get?

Real outcomes measured by clear metrics, not just vague "what-ifs."

FinOps teams must adopt this aggressive mindset and equip themselves with the right tech. A solution's purpose isn't to churn out endless suggestions. It's to sharply identify cost risks, make them actionable and then track how quickly and effectively they're neutralized. This isn't about mere budget tweaking; it's about forging a culture where innovation flourishes alongside strong financial controls.

FinOps: A Force Multiplier for Security

This re-envisioned FinOps isn't just about money; it's a significant boost for security:

  • Shrinking the Attack Surface: FinOps excels at spotting overprovisioned or idle cloud resources. This isn't just cost savings; it's also a direct way to reduce potential targets for attackers and close security holes.
  • Hardwiring Accountability: The core of FinOps is accountability, a principle critical for security. When resources have clear owners, enforcing security policies becomes straightforward. Data breaches can be traced back to unauthorized usage, and better-managed environments drastically cut down on misconfigurations that create vulnerabilities.
  • Building a Security-First Culture: When cost accountability is deeply ingrained, employees at all levels are far more likely to stick to security best practices and proven configurations, knowing they're directly responsible.

Today's tools are powerful allies. The right cost and security monitoring platforms allow for side-by-side evaluation of critical data. Resource tags can simultaneously track both financial and security risks. Budget alerts can even flag potential security breaches by detecting unusual cost spikes caused by malicious activity. And automation can seamlessly integrate FinOps, consistently applying governance across financial and security landscapes.

A Better Picture

The current FinOps approach is falling short for far too many organizations. The deluge of "recommendations" isn't delivering. A radical reframing is desperately needed, one that starts by calling cost issues exactly what they are: actual risks, demanding swift urgency and clear accountability.

True success won't be found in the sheer number of suggestions, but in the critical issues unearthed and definitively resolved — and the speed and thoroughness with which that resolution occurs. This transformative approach doesn't just fix financial leaks; it shatters siloed decision-making, forcing crucial conversations where cost and security are always considered hand-in-hand, painting a far more complete and actionable picture.

Eric Ethridge is Senior Technical Account Manager at DoiT

Related Links

Hot Topics

The Latest

Three Strikes and They're Gone: Why Proactive Operations is Now a Customer Retention Strategy

IT organizations have historically measured success by how quickly they can respond when something goes wrong. The entire discipline of Incident Management has been optimized around mean time to resolution, first-response SLAs and ticket closure rates. But new research suggests that even though this is a well-executed playbook, it's no longer enough to retain customers ...

When the Database Is the Problem, Is APM Enough?

Production incidents rarely announce themselves as database problems. They appear as slow transactions, timeouts, rising response times, or an application struggling under a workload it previously handled. APM provides an essential starting point. It can identify a slow transaction path, highlight an affected service, and show that a database dependency is consuming more time than expected. But identifying the database as part of the problem is not the same as explaining what is happening inside it ...

From Cleanup to Prevention: The Future of Cloud-Native Cost Optimization

Cloud teams are under constant pressure to reduce spend without slowing development or increasing operational risk. They are deploying autoscalers, rightsizing workloads, enforcing resource requests, reviewing utilization dashboards, and building FinOps processes around cloud-native environments. Yet the results often disappoint ...

The Real Enterprise AI Risk Isn't Hallucinations

Ask most IT leaders about their biggest concern with AI and you'll hear the same answer: hallucinations ... Today, however, the conversation has shifted ... As organizations move beyond chatbots and experiments, they are increasingly deploying AI agents that perform multi-step tasks. These systems retrieve documents, query databases, call APIs, generate reports, write code, and make recommendations. The issue is not whether the model can reason. The issue is whether the organization can see, verify, and govern the decisions being made along the way ...

Beyond Buy vs. Build: The New Playbook for Data Pipelines

While organizations want to take control of their telemetry, building telemetry pipelines from scratch can be a very daunting, complicated task, even when leveraging open-source standards like OpenTelemetry. It requires specialized knowledge across distributed systems, data engineering, and security. This fragmented approach across systems causes higher operational costs; it puts a strain on resources and reduces efficiency as teams have to work with different interfaces and processes ...

The Corporate Network Is Fading - Here's What Replaces It

For decades, enterprise networks were designed around a simple assumption: work happened inside the office. Applications lived in centralized data centers, employees connected through internal infrastructure, and security focused on protecting the perimeter that surrounded everything ... But the way organizations operate today bears little resemblance to that environment. Cloud platforms host critical applications, employees connect from homes and airports as often as they do from offices, and partners collaborate through shared systems that exist far beyond corporate walls. In short, the corporate network no longer resembles the environment it was designed to protect ...

IT Leaders Must Establish a Network Data Architecture Practice

As an analyst who researches how IT organizations design, build, and operate their networks, I find that network data is a constant source of pain. Network teams struggle with data quality, fragmentation, authority, access, and trust. And these issues undermine everything they try to do. Here are the numbers: Only 45% of network teams are completely confident in the accuracy of their network source of truth, which documents the intent of their network ...

Data Center Outages Are Decreasing but More Costly

The 2026 Global Data Center Survey from Uptime Institute reveals an industry navigating workforce constraints, escalating outage expenses, even as rising costs remain the top concern for management teams ...

Observability Has a Physical Layer Now: What AI Infrastructure Teaches IT Operations

The next observability gap may not be in the code. It may be under the rack. That sounds strange until you think about how AI incidents actually feel in the middle of an investigation ... The application dashboard may be accurate. It may also be stopping at the wrong boundary. AI systems depend on software, but they also depend on a dense physical stack: racks, power paths, thermal margin, maintenance activity and, in many environments, liquid cooling. Those physical dependencies can change slowly before they look like a software incident ...

TLS Certificate Expiration Is Becoming an Observability Problem

Certificate expiration is the rare outage you can see coming. Every TLS certificate carries the date it stops working, so the moment it will begin breaking connections is knowable in advance. That's what makes an expired certificate such a frustrating way to lose a service. What's changing now is how often that date comes around ...