CloudSentri — From Observability to Autonomous Operations

01 — The problem

Tools that alert. Humans who still have to act.

Most SMEs run cloud operations on a patchwork: one tool watching cost, another watching uptime, another scanning for security drift, a spreadsheet tracking audit evidence. Each one generates alerts. None of them close the loop — an experienced (and expensive) engineer still has to read the signal, decide what it means, and go fix it by hand.

Cost

Idle resources and oversized instances quietly burn budget between the monthly bill reviews that catch them.

Reliability

Anomalies get noticed after they page someone, not before — root cause analysis starts from zero every incident.

Security

Posture drifts continuously against CIS, SOC 2, ISO 27001, NIST — but is only checked in point-in-time scans.

Compliance

Evidence for auditors is assembled by hand, quarter after quarter, from systems that already hold the answer.

Observability tells you something is wrong. CloudSentri decides what to do about it — and, with approval, does it.

That's the shift this platform is built around: specialized agents that continuously observe, reason over what they see, and act — inside guardrails a human set, with a human in the loop wherever the impact is high.

02 — The architecture

One system, three layers.

Cloud telemetry flows in, gets reasoned over by a set of specialist agents sharing one knowledge base, and comes out the other side as either a proposal or — once policy and a human allow it — a safely executed change.

cloudsentri-platform.arch

Fig. 1 — CloudSentri platform architecture, as designed today.

Cloud environment

AWS, Azure, GCP and Kubernetes stream telemetry, config, logs and events in — and receive remediation and config changes back.

Agentic orchestration

Five agents reason over a shared RAG knowledge base built from logs, IaC, and documentation, then hand off proposed actions.

Governance & actions

Policy-as-Code and IaC integration turn proposals into concrete changes; anything high-impact waits for human approval.

03 — The agents

Five specialists. One brain.

Each agent owns a domain an SME would otherwise need a dedicated hire for. All of them read from the same knowledge base, so a cost decision knows about an open vulnerability, and an incident knows what changed in the last deploy.

FinOps agent

Cost & rightsizing

13 detectors across every FinOps domain.

Detects idle compute (CPU+memory+network+disk), orphaned resources, data transfer egress hotspots
Optimizes storage tiers intelligently, identifies container and database waste
Recommends commitments and flags underutilized RIs / Savings Plans
Tracks budgets, detects anomalies with seasonality awareness, validates tag values
Proposes Terraform-based remediation with policy-gated approval

SRE / SysOps agent

Health & incidents

Catches the anomaly before the page.

Monitors infrastructure health continuously
Detects anomalies and predicts incidents
Assists root cause analysis in real time
Validates deployments, automates remediation via runbooks

SecOps agent

Posture & vulnerabilities

Checks the fence line, all the time.

Checks posture against CIS, SOC 2, ISO 27001, NIST
Detects vulnerabilities and misconfigurations
Monitors IAM risk across accounts and roles
Prioritizes remediation by actual exposure

Compliance agent

Audit & evidence

Audit-ready, every day of the year.

Continuously maps evidence to compliance controls
Cuts the manual effort auditors used to demand
Shares findings directly with the SecOps agent
Turns audit season into a non-event

Knowledge agent

Natural language over your whole estate

The interface to everything the other four know.

It learns your architecture and operational history, so anyone on the team can ask a plain-language question and get a grounded answer — not a dashboard to go interpret themselves.

Why did costs increase last week?

Which security findings need attention right now?

What changed before last night's incident?

04 — Where this stands today

Part of this is already running against a live AWS account.

CloudSentri started as an architecture and a pitch. Since then, the FinOps agent has moved from design to a working, tested implementation — validated end-to-end against multiple real production AWS accounts, not a demo environment. Here's the honest state of all five agents today.

108/108tests passing, CI green 1 of 5agents live and validated 17phase engineering roadmap mapped

FinOps

Live — 13 detectors covering all major FinOps domains: idle compute (multi-metric), orphaned resources, storage lifecycle, commitment coverage, commitment waste, cost anomaly (seasonality-aware), tagging (key + value validation), non-prod scheduling, stale snapshots, data transfer egress, container waste, database idle, budget overspend. Agent layer with tool-use loop via direct API, AWS Bedrock (Anthropic + Converse for any model), GCP Vertex AI, and Azure

Remediation pipeline

Built and tested — Terraform propose → policy-check (built-in rules + OPA/Conftest) → approve (auto for low-risk, human for high-risk) → apply hand-off for EC2 stop/start + S3 lifecycle policies + tagging + scheduling. 16 tests passing

SRE / SysOps

Architecture designed — read/write tool split specified, build not started

SecOps

Planned — posture-check architecture defined, no repo yet

Compliance

Planned — reads SecOps findings by design, no repo yet

Knowledge agent

Planned — the shared RAG layer the other four will read and write through

Proof it works across real accounts

Ran live against two production AWS accounts (041-prod, 041-dev) using live Cost Explorer data. The agent identified $748/mo in savings across 6 findings on 041-prod — $480 from commitment coverage gaps (EC2, RDS, EKS) and $268 from data transfer egress (Route 53, ELB). On 041-dev, it found $44/mo in Route 53 data transfer waste. The idle-compute detector correctly held a "terminate" recommendation to 30% confidence instead of firing a false positive — because a billing-only signal carries no CloudWatch utilization data. Same caution validated for GPU workloads and ordinary production servers. The safety model is enforced by the architecture, not a prompt.

05 — Where this sits in the market

The category doesn't really exist yet.

Across FinOps, SRE/AIOps, CSPM/SecOps, and compliance automation, only two vendors were found even attempting to unify more than one of these domains into a single AI-driven system — and both are enterprise-priced, enterprise-customer platforms. No one identified is building a unified, agentic, SME-priced version of what CloudSentri is.

21companies mapped across 5 categories 2attempt cross-domain unification — both enterprise-only 0found building this for SMEs specifically

vs. point solutions

An SME assembling equivalent coverage today needs a FinOps tool + an SRE tool + a CSPM tool + a compliance tool — none of which share context

vs. enterprise platforms

The only two attempts at cross-domain unification (XenonStack, CoreStack) are enterprise-priced — no one identified is building this for SMEs

vs. detect-and-alert tools

Point solutions across every category mapped mostly alert; CloudSentri's Policy-as-Code + human-approval gate let agents safely execute the fix

06 — Under the hood

Built for safe autonomy, not black-box automation.

Every recommendation is traceable to a source, and every high-impact action passes through the same approval path — the platform is designed to be trusted by the engineers who have to answer for it.

orchestration

Multi-agent orchestration across the five domain agents

retrieval

RAG over cloud inventories, logs, IaC repositories, and documentation

governance

Policy-as-Code for guardrails on what agents may propose or execute

automation

Event-driven automation triggered directly off telemetry and alerts

iac

Native integration with Terraform, Pulumi, and CloudFormation

platform

Kubernetes and cloud-native workload support out of the box

compliance

Continuous evidence collection mapped to audit controls

safety

Human approval workflows gate every high-impact automated action

07 — The opportunity

Every SME needs this team. Almost none can hire it.

A dedicated FinOps analyst, an SRE, and a security engineer is a six-figure-plus hiring problem most SMEs never solve — so they run cloud infrastructure with none of the three, or with one generalist stretched across all of it. CloudSentri is built to close that gap: not another dashboard, but the operations team itself.

01

Lower cloud spend

Continuous rightsizing and waste detection instead of a quarterly bill review.

02

Fewer, shorter incidents

Anomalies caught and remediated before they page a human at 3am.

03

Always audit-ready

Evidence collected continuously, not assembled under deadline.

08 — The ask

Built solo, part-time. Raising to build it out for real.

I've been building CloudSentri part-time alongside my research, because I keep running into the same gap: SMEs are drowning in disconnected cloud tools that alert but never act, and hiring a full FinOps/SRE/security bench isn't realistic for most of them. The FinOps agent is proof the approach works — 13 detectors across all FinOps domains, a remediation pipeline generating Terraform with policy-gated approval, and validated live against multiple production AWS accounts.

I'm raising a pre-seed round to take this from one validated agent to the full five-agent platform — funding the engineering and go-to-market hires it needs, and turning the design-partner conversations already underway into paying pilots.

Open to a conversation about the round, the roadmap, and what it would take to get there.

From observability to autonomous operations.