CDCR. Continuous Detection,
Continuous Remediation.

CI/CD did this for code. CDCR does it for the cloud.

CI/CD took software deployment from "click buttons in Jenkins and hope" to a continuous, automated loop that runs on every commit. Drift between intent and reality used to be the norm. Now it is the exception.

Cloud cost management is still in the pre-CI/CD era. Teams detect waste, then click through cloud consoles to fix it. The fixes hold for a week. Then the drift comes back. The FinOps Foundation's 2025 State of FinOps survey puts the waste rate at 27 to 32 percent. Flexera's 2024 State of the Cloud report agrees. The figure has not moved in three years.

This brief introduces CDCR: Continuous Detection, Continuous Remediation. It is the category of platform that runs the same kind of automated loop CI/CD pipelines run, but for cloud cost state. CDCR detects cost drift continuously, classifies findings by dollar impact and severity, remediates the safe classes automatically, and verifies every action with a full audit trail.

CDCR is the action layer inside FinOps. It does not replace the Inform layer (cost dashboards) or the Optimize layer (recommendations). It executes them.

$830B in spend. 27–32% of it is drift.

Worldwide public cloud spend will cross $830 billion in 2026 (Gartner, IDC). Wasted spend is 27 to 32 percent of that (Flexera, FinOps Foundation). The waste rate has been stable for three years despite measurable growth in FinOps tools, certified practitioners, and dedicated teams.

Cost drift is the more useful frame than cost waste. Cost waste is a snapshot. Drift is the continuous motion that produces the waste. Resources get oversized. Tags fall off. Schedules expire. Idle resources accumulate. Anomalies happen. Each one is small. The cumulative effect is the 27 to 32 percent.

A representative cost drift inventory from a mid-sized cloud estate:

Every line in this table is detectable today. The persistence of the drift across all of them is the same: detection without continuous remediation produces reports, not lower bills.

Inform is solved. Optimize is solved. Operate isn’t.

The FinOps Foundation framework has three phases: Inform, Optimize, Operate.

Inform

Visibility, allocation, chargeback. The major platforms (CloudHealth, Apptio Cloudability, CloudZero, Vantage, Anodot) ship reliable dashboards. Phase 1 is solved.

Optimize

Recommendations. The same platforms produce accurate right-sizing, commitment, and idle-resource recommendations. Native cloud advisors (AWS Trusted Advisor, GCP Active Assist, Azure Advisor) supplement them. Phase 2 is largely solved.

Operate

Execute change. The 2025 FinOps Foundation State of FinOps survey ranks "getting engineers to take action on recommendations" as the top reported challenge for the fourth consecutive year. The reasons are structural, not cultural.

A mid-sized cloud estate produces 800 to 2,000 recommendations per month. Manual action at that scale requires either a dedicated remediation team or a heavy ticketing process. Most organizations action 5 to 15 percent of recommendations. The rest age out.

Cost dashboards generate recommendations they do not execute. Executing carries blast radius they do not own. The Operate phase has historically depended on engineering teams to do the executing. That dependency is the bottleneck.

A continuous loop for the Operate phase.

Continuous Detection, Continuous Remediation (CDCR) is the category of platform that runs an automated detect-classify-remediate-verify loop across cloud cost state. The loop runs continuously, not on a scan schedule. Every action it takes is logged. Every action it takes can be rolled back.

The clearest analogy is CI/CD. Before continuous integration, teams ran tests manually and deployed weekly. Most software production was drift management: code in production diverged from main, fixes regressed, releases broke. CI/CD did not change the discipline of testing or deploying. It changed the execution model — from manual-on-schedule to automated-on-event.

CDCR does the same thing for the cloud cost Operate phase. It does not change the FinOps framework. It changes the execution model. The loop runs on events, not on schedule.

The working definition

A CDCR platform must run all four functions of the loop:

1. Detect cost drift continuously across the cloud estate
2. Classify findings by severity and projected dollar impact
3. Remediate safe classes automatically and guide humans through the rest
4. Verify every action in an audit trail that meets compliance evidence requirements

Platforms that do (1) only are cost dashboards. Platforms that do (1), (2), and partial (3) without (4) are recommendation engines. CDCR requires all four.

Detect · Classify · Remediate · Verify.

┌────────────────────────────┐    ┌────────────────────────────┐
│  ◼  DETECT                 │    │  ◼  CLASSIFY               │
│  Cost drift                │────│  Severity + dollar         │
│  K8s · schedules · tags    │    │  450+ audit rules          │
└────────────────────────────┘    └────────────────────────────┘
              │                                │
              │            ┌──────────────┐    │
              └────────────┤     LOOP     ├────┘
                           │    ACTIVE    │
              ┌────────────┤              ├────┐
              │            └──────────────┘    │
              │                                │
┌──────────────────────────────┐    ┌────────────────────────────┐
│  ◼  REMEDIATE              │    │  ◼  VERIFY                 │
│  Certified or guided       │────│  Audit log                 │
│  scoped · logged           │    │  actor · timestamp · delta │
└────────────────────────────┘    └────────────────────────────┘

Detect, continuously

Cost drift detection runs at minute-level granularity. The signals collected go wider than the cloud bill itself.

Anomaly detection runs across five dimensions — org, cloud account, resource group, resource, and team. A spike that hides at the org level often shows up at the resource group level. The five-dimension scan catches the spikes that single-dimension anomaly tools miss.

Other detection signals: drift on Kubernetes clusters, expired schedule overrides, newly untagged resources, idle resource accumulation, storage class regression, and compliance gaps that quietly reopened after a prior fix.

Sample rate matters. A platform that polls every 15 minutes will miss anomalies that a platform polling every 60 seconds catches.

Classify, by impact

A flat list of 2,000 findings is unworkable. A classified queue is. CDCR platforms apply rule libraries that score every finding by severity and projected dollar impact. ZopNight runs 450+ audit rules across AWS, GCP, and Azure.

Classification sets the work order. Drift on a production resource ranks above an idle dev box. A $2,000/month anomaly ranks above a $30/month one. The queue reflects the actual stakes, not just the rule count. Without classification, a CDCR platform reduces to a noisy alert system.

Remediate, continuously

Remediation is two-tier.

Auto-remediate

For the safe classes: tag application from accepted Tagger predictions, schedule enforcement, idle resources stopped, scale-to-zero on certified workloads, pause on certified service-tier targets. These run without human approval because the actions are reversible, the blast radius is bounded, and the policy is explicit.

Guided remediation

For the rest. Each guided action carries a confidence score (how sure the platform is that this is the right fix) and a complexity score (how risky the action is to execute). The human approves; the platform executes.

Production writes are admin-gated, scoped to the resources covered by the policy, and fully logged. Customer databases are explicitly excluded from mutation. This is a design choice, not a limitation. The platform refuses to touch state that should never be auto-touched.

Verify, every action

Every action the platform takes lands in the audit trail. The record includes actor (platform or human), timestamp, the policy that triggered the action, the resources affected, and the dollar delta where applicable.

Quarterly reviews read measurable outcomes, not forecasts. "We saved $312K this quarter on these 1,400 actions" is a different conversation from "we estimate we could save $400K if we acted on these recommendations."

Verification is also the layer that satisfies SOC 2 Type II and ISO 27001 evidence requirements. Without it, CDCR is unusable in regulated industries.

Watch one finding move through the loop.

The clearest way to understand the loop is to watch one finding move through it. Three composite examples below.

Action 1 · Idle development cluster (auto-remediated)

Action 2 · Oversized production RDS (guided remediation)

Action 3 · Customer database, oversized (rejected)

The seven questions a buyer should ask.

CDCR is an early category. Most vendors making the claim do not yet pass the four-function test in section 5. A buyer evaluating the space should ask:

1. Does the platform poll continuously, or scan on schedule?
2. How are findings classified by impact, and on what rule base?
3. Are remediation actions executed by the platform, or generated as recommendations for a human to apply?
4. What is the maximum blast radius the platform accepts under policy without human approval?
5. What resource classes does the platform refuse to touch, by design?
6. What does the audit log show? Does it meet SOC 2 Type II evidence?
7. Does coverage extend across AWS, GCP, and Azure, or only one cloud?

A read of the current market (May 2026, expect movement)

Crawl, Walk, Run, Fly.

The FinOps Foundation’s Crawl-Walk-Run model maps onto CDCR adoption.

Crawl · 18% of organizations

Cost reviews are quarterly. Allocation is partial. No automation.

Walk · 54% of organizations

A cost dashboard is in place. Allocation and chargeback work for most spend. The team acts on top recommendations each month. No continuous remediation. This is the industry’s largest stuck point.

Run · 22% of organizations

Continuous remediation is in place for predictable drift classes (non-production scheduling, snapshot lifecycle, storage class migration). Right-sizing and orphan cleanup are automated under policy.

Fly · 6% of organizations

The cost estate self-optimizes against explicit policy. Humans approve only high-blast-radius decisions.

Three estates. Three outcomes. One pattern.

Pattern A · Mid-stage SaaS, $180K/month AWS

A Series B SaaS company with eight engineers and a Notion-based FinOps practice. Existing recommendations were reviewed monthly and rarely executed. CDCR adoption began with non-production scheduling, unattached EBS cleanup, gp2 to gp3 migration, and RDS right-sizing.

After 90 days the bill was $124K/month, a 31% reduction. Engineering hours on cost work dropped from roughly 6/week to under 1.

Pattern B · Late-stage consumer, $2.4M/month across AWS and GCP

A Series D consumer company with a four-person FinOps team and custom Looker dashboards. Despite mature Inform-layer tooling, the team estimated $600K/month of recoverable waste. CDCR adoption added Event Readiness automation for product launches, autoscaling policies, snapshot lifecycle rules, and Auto Tagging for cross-team chargeback.

After six months the bill was $1.78M/month, a 26% reduction.

Pattern C · Regulated financial services, $5.1M/month

A US financial services firm with strict change management. Every cost optimization required a CAB ticket. The team executed roughly 3 cost actions per quarter. CDCR adoption inverted the CAB process: the CAB pre-approved the policy, and the platform executed within it with full audit logging.

After 12 months the bill was $3.9M/month, a 23% reduction. Action velocity moved from 3/quarter to ~400/month.

The 90-day adoption path

Cross-customer pattern: 23 to 31% bill reduction within 6 to 12 months. Variance correlates with how aggressively the team trusts policy-driven automation.

Four predictions for the next 24 months.

CDCR is the working name for what the next decade of cloud cost operations will run on. A few predictions for the next 24 months.

1 · The Inform-layer vendors will consolidate

Cost dashboards will buy or build CDCR capability, or they will lose ground to platforms that already run the full loop. At least two acquisitions in the category are probable by mid-2027.

2 · The category will deepen in cost before it widens

Expect richer policy languages, better confidence and complexity scoring on guided actions, and more resource classes safely covered by auto-remediation. The bar for "what the platform will run without human approval" will rise as track records accumulate.

3 · The FinOps Foundation framework will evolve

The Operate phase, historically the least defined of the three, will get explicit tooling capability requirements. The next FinOps Framework revision (expected late 2026) is likely to include automation maturity as a first-class evaluation dimension.

4 · The CI/CD analogy holds up here too

In 2010, "we deploy weekly via SSH scripts" was acceptable. By 2018, it was a competitive liability. The same arc applies to cloud cost. Teams that still run quarterly reviews against a cloud that drifts daily are operating on the wrong cadence.