Skip to content

Spend Monitor

You can monitor spending on cloud environments to quickly identify unauthorized usage and control cloud infrastructure costs.

Unusual increases in spending on your environments can indicate security incidents, for example denial of wallet attacks. You can monitor spending regularly across multiple cloud platforms and environments, and set thresholds to receive alerts when unusual spending occurs.


Spend monitoring data isn't available in Sophos Cloud Optix for Microsoft Azure subscriptions billed through Microsoft Cloud Solution Provider (CSP) plans.

For GCP, AWS, and Microsoft Azure environments, click Spend Monitor > Overview to see the following:

  • Total spend by provider, for the current calendar month.
  • A table showing the environments contributing most to your cloud spend, and the top spending services for those environments, for the current calendar month.
  • A graph of total daily spend across AWS, Microsoft Azure, and GCP environments. You can see your daily spend for all environments, or select a specific environment. Click the graph to see the top environments by spend on any day.
  • A graph of monthly spend. Click the graph to see the top environments by spend in any month.

For AWS and Microsoft Azure environments you can see additional spending information and recommendations to control your cloud infrastructure costs. In Spend Monitor, click AWS or Azure to switch between results for those services.

Click Daily to view your spend for individual AWS or Microsoft Azure services each day, for the previous 90 days. You can compare graphs for different services side-by-side, and enlarge each service graph. You can filter to show data for specific regions, services, and individual environments or groups of environments.

Click Monthly to see the same data for each month, for the previous 12 months. You can also see monthly costs for each service in a table, and export the data in CSV format.

Click Exec Summary for an overview of your spending for the last full calendar month compared with the previous full calendar month. You can easily see the top services that have increased and decreased in cost.

Click Recommendations to see the results of checks that Sophos Cloud Optix runs. These help you reduce your spending on AWS and Microsoft Azure. For example Sophos Cloud Optix can identify unassociated infrastructure such as Elastic IPs that incur costs even when not in use, and report on the most expensive compute and database instances across your cloud environments.

Sophos Cloud Optix integrates with AWS Trusted Advisor and Microsoft Azure Advisor services to show cost recommendations from these services alongside Sophos Cloud Optix recommendations. Recommendations raise alerts in Sophos Cloud Optix, enabling you to manage them alongside security alerts. For example using Sophos Cloud Optix integrations with Jira, Slack, Teams, and so on. You can also suppress spend alerts.

To turn off recommendation checks, click Policies > Out of the Box Policies and turn off Spend Monitoring Recommendations.


Cost recommendations from AWS Trusted Advisor require a Business or Enterprise AWS Support plan. Recommendations from Sophos Cloud Optix for AWS don't require this.