Resources
How we think about the cloud — and what we're shipping.
Our point of view on the future of cloud — strong opinions on cost, security, observability, operations, and where agentic infrastructure is headed.
Discovery should be a byproduct, not a phase
The most expensive step in every cloud engagement — figuring out what's wrong — should be continuous and automatic, generated from ground truth, not reconstructed one question at a time.
Read →The Forward-Deployed Engineer Is the New Shape of Building
AWS put $1B behind forward-deployed engineers. The real story isn't staffing — it's that AI collapsed product and engineering into one seat. And it's exactly the gap we built Sherpa to close.
Read →We build a platform that finds waste. Then we found a pile of it in our own agent.
A FinOps platform that isn't ruthless about its own efficiency hasn't earned your bill. What 22MB of dead weight in our own stack taught us.
Read →Deep dives, how-tos, and announcements on running your AWS cloud.
Who can get into your AWS account: the entry points a user list doesn't show
Your IAM user list is not your access list. Roles can trust an identity provider, another AWS account, a build pipeline or a third-party tool — and unlike people, none of those offboard. Here's how to inventory the ways in.
Read →What your SBOM generator misses: writing custom detection for Amazon Inspector
Vulnerability scanning runs off a component list. Anything the SBOM generator did not detect is never scanned, and nothing tells you it was skipped. This explains how Amazon Inspector's new Lua plugins let you add detection for ecosystems it does not support out of the box.
Read →Savings Plans coverage vs utilization: the two numbers that decide what you're actually saving
AWS Savings Plans discount up to 72%, but the plan that pays the most is the least flexible. This explains the four plan types, what the commitment actually locks, and why coverage and utilization are different numbers that fail in opposite directions.
Read →How to tell if an AI agent is actually good at your cloud (and what AWS's aws-bench measures)
An AI agent gives a confident answer whether it's right or wrong. This explains how AWS's aws-bench tests AI agents against a known correct answer, why the verified answer is the hard part, and what to check when you evaluate an AI tool for your AWS environment.
Read →AWS IAM privilege escalation paths, explained: why reading policies isn't enough
An IAM role with no administrator permissions can still reach administrator. Here's how permissions compose into escalation paths, why reachability decides what matters, and how to audit paths instead of policies.
Read →AWS Security Hub Network Scanning explained: config-based exposure vs. actual internet reachability
A plain-English guide to AWS Security Hub Network Scanning: what it does, how active probing differs from configuration analysis, what it discovers, and how the two layers of exposure detection fit together.
Read →Least Privilege for AI Agents on AWS: How Cedar Stops Authorization Scope Creep
When AI agents delegate to other agents, authorization scope can silently expand beyond what the original user authorized — even when every individual agent has the right IAM role. AWS published a Cedar pattern on July 6, 2026 to stop it. Here is how it works.
Read →The most expensive part of a cloud project happens before any work starts
In cloud consulting and assessments, the costliest phase is discovery — figuring out what's actually wrong. Here's why it's so expensive, what a grounded report replaces it with, and how that changes the economics.
Read →What 'Forward-Deployed Engineering' Really Means in the AI Era
AWS just put $1B behind forward-deployed engineers and demand for the role grew 42x in two years. Here's what it actually is, and why AI is collapsing product and engineering into one seat.
Read →AWS Lambda MicroVMs explained: safely running untrusted and AI-generated code
A plain-English guide to AWS Lambda MicroVMs: the problem they solve, how they differ from Lambda and containers, what you can build, and the limits at launch.
Read →AWS DevOps Agent vs Sherpa: we ran both on the same account
AWS's DevOps Agent investigates incidents using what AWS already collects: X-Ray, CloudWatch and control-plane APIs, one domain at a time. Sherpa also reads the OpenTelemetry traces and Lambda telemetry you send it, across cost, security and observability. We ran both on the same account. Here is what we measured.
Read →Observability Feedback Loop: How One Quietly Burned $750/Day in Our Own Infra
An observability feedback loop quietly burned $750/day in our own infrastructure. What it is, why it is so hard to root-cause, and how we broke it in a day.
Read →AWS has a FinOps, Security, and DevOps agent. The hard problems live between them.
At AWS Summit NY 2026, AWS shipped a Security Agent and a DevOps Agent alongside the FinOps Agent — one agent per domain. The costliest cloud problems are cross-domain, where a single-domain agent can't see.
Read →AWS FinOps Agent vs Sherpa: what a cost-only agent can't see
We ran AWS's new FinOps Agent and Sherpa on the same AWS account. Sherpa found the idle infrastructure, commitment risk and security exposure a cost-only agent has no category for.
Read →An AI agent for your AWS cloud: cost, security, and observability in one place
Sherpa is an AI agent for AWS. Ask about your cost, security, observability and inventory, see it in dashboards, and get a plan to fix it that your team applies.
Read →