By the time the invoice arrives, it’s too late. How we built a cost anomaly detector for Google Cloud
In spring 2026, two companies fell victim to the same class of attack: stolen credentials, someone else’s API keys, and mass Gemini consumption on their bill. The first incident ended with a half-million-euro invoice. The second, two months later, hit an environment already covered by our monitoring and was stopped within hours. This is the...
Paweł Rosada 
Sebastian Górski
Mariusz Wilczek
FOTC Team
Monika Zając
Beata Socha