AI spend is the line item every finance team is now watching. Agent runs, token bills, and compute for models that scale themselves have made cost overruns a boardroom topic. The reflex has been to hand the problem to IT and finance: set budgets, cap usage, optimize.
That treats the overrun as an efficiency problem. Rein in the spend and move on.
The Overrun Is a Symptom
A surprise AI bill is a story about something doing more than anyone intended. An API key that starts spinning up compute at 3 a.m. An agent stuck in a loop, calling tools and reaching systems far past its assigned task. Shadow AI quietly moving company data through a model no one approved. Cryptojacking operations have appeared in AI infrastructure, where the cost shows up before the intrusion does. Cost is often the loudest signal a quieter problem sends.
Follow the Money to the Behavior
This is why cost overruns belong on the security team's radar, not just finance's. An overrun points to an identity or an agent operating outside its intended scope, and scope is a security question. PeopleBase baselines what normal looks like for the identities and automation in an environment, so activity that deviates surfaces as behavior in the moment, rather than a month later as a charge. Finance sees the number. Security should see the cause.
When the next AI invoice runs higher than expected, the useful question isn't how do we cut it. It's what changed.
See the latest from Abnormal's product and engineering teams.
