A cost explanation people can inspect.
One example of my investigation work, within a broader AWS consulting practice. It shows how I frame a cost question, test an explanation, record uncertainty, and hand the evidence to leadership and engineering. Every account, amount, and resource below is synthetic.
The scenario uses a fake account. The technical appendix illustrates the shape of a Kulshan report and was authored by hand, not emitted by the tool. It is not a customer result or a claim about savings.
Why did network-related spend move?
Decision at stake
Whether the platform team should prioritize a network architecture review before the next finance forecast is approved.
Executive conclusion
The synthetic evidence supports increased NAT Gateway processing as the main contributor. It does not yet prove which application flow created the traffic.
Materiality
The movement is concentrated enough to investigate, but this sample intentionally avoids a savings claim. Remediation value depends on traffic path and workload requirements.
Evidence Contract
Analyst interpretation, written by hand. The same six fields appear in the executive memo and the full report.
Question or hypothesis: Why did network-related spend increase 34% month over month in the platform account? Working hypothesis: NAT Gateway data processing is the main contributor.
Supporting evidence: The Cost Explorer service and usage-type breakdown isolates the increase to NAT Gateway data processing (NatGateway-Bytes), not an across-the-board EC2 increase. Kulshan's statistical anomaly check flags the movement (z-score 2.7), and AWS Cost Anomaly Detection independently flags the same movement (AnomalyOverlap-0001).
Contradicting evidence: None identified within the evidence reviewed: the Cost Explorer breakdown, the cost, sweep and topo findings, and AWS Cost Anomaly Detection for June 2026. The concurrent Amazon RDS movement (z-score 2.1) was checked and does not weaken the hypothesis, because it is in a different service, not network spend. The review did not include flow logs or workload data, so it could not surface every kind of counter-evidence.
Missing evidence: No VPC Flow Logs for the platform VPC, so the source workload, the destination, and whether the path is intra-region or cross-AZ are unknown. No tag-based ownership for the NAT Gateway ENI. No confirmation from the platform owner on whether the transfer was expected.
Confidence and limits: Strong for the cost driver: two independent detections point to NAT Gateway processing. Low for cause and ownership: the evidence does not establish which workload generated the traffic or whether it is avoidable. Untested alternative explanations include S3 or DynamoDB traffic routed through NAT without gateway endpoints, cross-AZ routing, a new or changed workload, and expected growth. No savings estimate is made.
Recommended next decision: Hold the network architecture review decision until the traffic is attributed. Enable VPC Flow Logs on the platform VPC, reconcile the NAT Gateway ENI to subnet and workload, then re-run and test the alternatives above.
How this investigation moved
- Cost Explorer flagged a 34% month-over-month increase concentrated in one account.
- Service breakdown isolated NAT Gateway data processing as the primary contributor.
- Usage-type anomaly detection confirmed the movement was statistically significant (z-score 2.7).
- Looked for contradicting evidence: none identified within the evidence reviewed. The concurrent RDS movement was checked; it is a different service and does not bear on network spend.
- Recorded the missing evidence: no VPC Flow Logs and no tag-based ownership, so whether the transfer is intra-region or cross-AZ cannot be confirmed.
- Recommended next step: enable VPC Flow Logs, reconcile the NAT Gateway ENI to subnet and workload, then re-run.
The investigation stopped at the boundary of available evidence rather than guessing past it.
Report preview
This card is hand-authored in the shape of a Kulshan report. Kulshan supplies evidence: findings, provenance, and a human-review flag. In my work, the question, the conclusion, what contradicts it, what is missing, and the next step are written by me, not generated by the tool. The full interactive version opens in a new tab below.
AWS Cost Investigation: Network Spend Movement
Question or hypothesis
Why did network-related spend rise 34% month over month? Hypothesis: NAT Gateway data processing is the main contributor.
Supporting evidence
Usage-type breakdown isolates NAT Gateway data processing. Kulshan (z-score 2.7) and AWS Cost Anomaly Detection both flag the same movement.
Contradicting evidence
None identified in the billing and anomaly evidence reviewed. The concurrent RDS movement is a different service and does not weaken the hypothesis.
Missing evidence
No VPC Flow Logs, so source, destination and path are unknown. No tag-based ownership for the NAT Gateway ENI.
Confidence and limits
Strong on the cost driver. Low on cause and ownership. Alternatives (missing endpoints, cross-AZ routing, a new workload) are untested.
Recommended next decision
Hold architecture changes. Enable VPC Flow Logs, attribute the traffic to a workload, then re-run.
Open the full interactive report · All values are synthetic. This is not a customer result.
Open the full report.
The full interactive artifact is a separate page (it needs more room than fits inline here). It opens in a new tab so you keep this page open.
Open the full interactive report ↗
Technical appendix: that report is built from synthetic fixture data. It demonstrates the evidence inventory available to an investigator; human interpretation turns that inventory into a decision record. The same evidence is also in the JSON fixture and the report-preview card above, if you would rather not leave this page.
Want this shape for your own problem?
An investigation ends in a written answer with this structure: the question or hypothesis, supporting evidence, contradicting evidence, missing evidence, confidence and limits, and the recommended next decision. It starts with a free 20-minute call; the scope and fee are agreed in writing before any work begins.