2. Cloud spending is visible everywhere but understood nowhere without a layered operating model

The situation

The average enterprise with $5M+ cloud spend uses 3.2 cost management tools (FinOps Foundation 2024). Despite this, 49% cannot forecast next quarter within 10%. The problem is not data. It is architecture.

Most organisations accumulate tools reactively. Someone buys Apptio for finance reporting. The platform team adopts CAST AI for Kubernetes. An engineer sets up Infracost in the CI pipeline. Each tool produces a different number for the same question, and nobody knows which one is right.

The complication

Without deliberate architecture, FinOps tooling grows organically. Each group sees a different version of the truth. Most organisations also confuse provisioning-time controls (Terraform) with runtime controls (autoscaling). Terraform is the plumber who installs the pipes. Runtime tools are the pressure sensors and shut-off valves. You need both, and they work at different times.

The confusion costs real money. An organisation that deploys only Terraform-level controls will prevent some waste at creation time but miss the instance running at 8% CPU for six months. An organisation that deploys only runtime optimisation will catch the idle instance but keep re-creating the same over-provisioned patterns because nothing prevents them at the source.

The five-layer model also clarifies tool procurement decisions. When a vendor pitches their platform, ask which layers it covers. Most will claim all five. Push for specifics: show me the Layer 1 zombie detection, the Layer 2 network analysis, the Layer 3 workload orchestration, the Layer 4 rightsizing automation, and the Layer 5 executive reporting. Most tools are strong in two layers and weak in three. That is normal. The mistake is expecting one tool to cover everything and being surprised when it does not.

The resolution: five layers

Each layer has a distinct owner, cadence, and toolset. Data flows up through the layers. Accountability flows down. The layers are not optional: skip one, and you have a blind spot.

Layer 1: Infrastructure and zombie resources

Zombie resources are the easiest money to recover: unattached EBS volumes, orphaned snapshots, idle load balancers, stopped instances accruing storage. Terraform prevents waste at provisioning time by enforcing tagging and instance size policies. Runtime drift detection catches resources that became idle after provisioning.

One financial services organisation found $340,000 per month in orphaned EBS volumes during their first zombie audit. The volumes had accumulated over 18 months as teams terminated instances without detaching storage. The cleanup took two weeks. The savings recurred monthly.

If advisor flags sit unactioned for 14+ days, the problem is not the tool. It is the operating process that sits between detection and remediation. Most FinOps programmes spend 80% of their energy on detection and 20% on action. Invert that ratio.

Layer 2: Network and data architecture

The NAT gateway trap: at $0.045/hr + $0.045/GB, a single NAT gateway handling 10TB/month costs $480+, mostly eliminable via VPC endpoints. Architectural decisions made early embed network costs for years. A team that deploys services across two regions for redundancy but routes all traffic through a single NAT gateway is paying a hidden tax on every request.

Network costs are the most underestimated category in cloud billing. They rarely appear in forecasts because they depend on traffic patterns that are hard to predict. But they compound: each new microservice that calls another service in a different availability zone adds a small egress charge. Multiply that by thousands of calls per second, and the monthly bill grows without anyone provisioning a new resource.

Layer 3: Workload-specific orchestration

Nerdio auto-scales AVD session hosts based on user login patterns. Karpenter provisions Kubernetes nodes dynamically based on pod scheduling requirements. ParkMyCloud schedules start/stop for non-production environments. These tools operate in real-time. FinOps sets the policies; automation operates within them.

The common mistake is treating workload orchestration as a one-time configuration. A Karpenter setup that worked when the cluster had 50 nodes may not work at 500. Autoscaler thresholds need quarterly review against actual utilisation data. The second most common mistake is applying production-grade orchestration to development environments that should simply be turned off.

Layer 4: Cost optimisation and right-sizing

Rightsizing targets resources below 40% CPU utilisation over 14 days. Rate optimisation commits to reserved instances, Savings Plans, or committed use discounts for stable workloads. Gartner estimates 20-30% reduction from combining rightsizing, rate optimisation, and waste elimination. The FinOps Foundation reports that 52% of recommendations go unactioned.

The 52% figure is the most damning statistic in FinOps. It means that more than half of all identified savings never materialise because nobody converts the recommendation into engineering work. This is not a tooling problem. It is a workflow problem. The fix is discussed in Section 5 (visibility-to-action bridge vendors) and Section 11 (recommendation 9).

Layer 5: Governance and reporting

Only 43% track at unit economics level (Gartner 2025). Executive packs should answer three questions: what is cloud spend as a percentage of revenue, what direction is the trend moving, and what commitment risk exists in the next 90 days. Two pages maximum. If the governance pack is longer than two pages, nobody will read it. If nobody reads it, the governance is decorative.

The distinction between showback and chargeback matters here. Showback makes costs visible without financial consequences. Chargeback allocates costs to P&L. Start with showback. If you deploy chargeback before teams trust the data, you will spend more time arbitrating disputes than reducing costs.

The governance pack itself requires discipline. Too many organisations produce 20-page monthly reports with every metric available. Nobody reads them. The effective governance pack contains five elements on two pages: total spend with trend, spend by business unit with month-over-month delta, commitment coverage with risk assessment, top 10 anomalies or cost increases, and three actions for the coming month. Everything else belongs in a drill-down dashboard for the FinOps team, not in the executive pack.

Unit economics at Layer 5 is the difference between mature and immature governance. Reporting total cloud spend is accounting. Reporting cloud cost as a percentage of revenue, or cost per transaction, or cost per active customer, is unit economics. The first tells you what you spent. The second tells you whether what you spent was efficient. A $2M monthly cloud bill that supports $200M in monthly revenue (1% cost ratio) is efficient. A $2M monthly cloud bill that supports $20M in monthly revenue (10% cost ratio) needs investigation. The absolute number is identical. The unit economics tell different stories.