By the time the invoice arrives, it’s too late. How we built a cost anomaly detector for Google Cloud
In spring 2026, two companies fell victim to the same class of attack: stolen credentials, someone else’s API keys, and mass Gemini consumption on their bill. The first incident ended with a half-million-euro invoice. The second, two months later, hit an environment already covered by our monitoring and was stopped within hours. This is the...
Paweł Rosada 
Sebastian Górski