Learned baseline
Anomaly detection
Per-customer time-series models learn what normal load and spend look like for that estate specifically, so a deviation means something for them rather than tripping a generic threshold.
AI decision engine
A dashboard hands you the metrics and leaves the judgement to you. Cloud Dongle scores every finding by dollar impact and blast radius, then writes the advisory: what to change, what it affects, what it risks.
30 / 60 / 90 day
Spend forecasting
Projects forward cost alongside the optimised counterfactual — the bill you are heading for, next to the bill you could have.
Rightsizing engine
Recommends CPU and memory targets per workload from observed utilisation, not from the request values someone guessed at during the first deploy.
Not CVSS alone
Risk scoring
Ranks security findings by exploitability and blast radius. A vulnerability behind a public ingress is not the same finding as the same CVE on an internal-only service.
Ask in English
Infra Copilot
Natural-language questions over the estate, answered with the number and the cluster it came from — not a link to a dashboard you then have to read.
Infra CopilotDemo estate
$7,135
combined monthly spend across 2 tenants
Halverson Freight runs $3,160 and Meridian Health $3,975 a month. Halverson is the smaller estate but the more wasteful one — most of its spend is recoverable, while Meridian's is largely committed to workloads that are actually using what they request.
10 clusters · AWS, Azure and GCP · demo estate
Operating constraints
What makes an advisory safe to act on
The engine is autonomous in what it concludes and deliberately powerless in what it can do. These four constraints are why a wrong recommendation stays a wrong recommendation instead of becoming an incident.
- 01
Every advisory carries its evidence
An advisory states what was observed, over what window, and on which workload. A recommendation you cannot audit is a recommendation nobody will action in production.
- 02
Baselines are per-estate
Anomaly detection learns what normal looks like for your workloads specifically. A generic threshold fires on every batch job and teaches the team to mute the channel.
- 03
Ranking accounts for reachability
A finding behind a public ingress and the same finding on an internal-only service are ranked differently, because they are different risks wearing the same CVE number.
- 04
The engine proposes; you dispose
Output is an advisory, not an action. Read-only access means the model can be wrong without production being wrong — which is the property that makes an autonomous recommendation safe to run at all.
Questions
What people ask about the engine
Does it change anything in my cluster?
No. The integration has no write permission of any kind — it cannot schedule, evict, scale, or delete. Every output is a recommendation you apply through your own change process.
How is rightsizing different from what my cloud console suggests?
Provider tooling generally reasons about instances. The engine reasons about workloads: it compares what a pod requests against what it observably consumes, then sizes to the observed profile rather than to the request value someone guessed at during the first deploy.
What does the copilot do that a dashboard does not?
It answers in a sentence and shows the cluster the number came from. A dashboard hands you the metric and leaves the judgement to you; the point of the engine is that the judgement is the product.
Start here
Point it at one cluster and see what it finds
The sandbox runs on demo data, so you can look before you connect anything. When you are ready, access is read-only and nothing changes without your approval.
Built by Anto and Edwin · Jacav