How do I catch AI spend that bypassed the proxy entirely?
Shadow Spend Reconciliation compares what your provider actually billed against what Cognocient's proxy observed for the same period, and alerts on the gap — the only way to catch spend that never touched the proxy at all.
Every other protection in Cognocient — budgets, velocity limits, anomaly detection, Compromise Risk — runs inline on traffic that passes through the proxy. Shadow Spend Reconciliation exists for the traffic that doesn't: a compromised provider account, a raw API key called directly, or a call site that was never routed through Cognocient in the first place. It compares what your provider actually billed against what the proxy actually saw, for the same period, and alerts on the gap.
This is the feature built directly for the incident class behind Emergency Freeze: a stolen Google Cloud credential ran Gemini image generation across multiple projects, entirely outside any proxy. No inline check — Cognocient's or anyone else's — can see traffic that never reaches it. The only way to catch it is from the outside, by comparing the bill to what was observed.
How reconciliation works
- You give Cognocient a provider's reported spend for a period — provider, start/end dates, and the dollar amount from your billing dashboard or invoice.
- Cognocient sums its own proxy-observed spend for that same customer, provider, and period (live proxy traffic only — imported historical data is never blended into this comparison).
- If
reported − observedclears both a dollar floor and a percentage floor, an alert is raised.
Entering a snapshot
From Shadow Spend Reconciliation, either:
- Add entry — provider, period, and the dollar amount from your provider's billing dashboard, one at a time
- Upload CSV — columns
provider, period_start, period_end, reported_spend_usd, notes(notes optional), for reconciling several periods or providers at once
Manual and CSV only today
There is no live connection to GCP Cloud Billing, the OpenAI Costs API, or Anthropic's Admin usage API yet — reported spend only ever comes from what you enter or upload. Treat this as a periodic check (e.g. against your monthly provider invoice) rather than a real-time feed until an automatic pull is added.
Alert thresholds
An alert only fires when the gap clears both:
| Threshold | Default | Why |
|---|---|---|
| Dollar floor | $25.00 | A $3 gap on a tiny account isn't worth paging anyone, even if it's a large percentage |
| Percentage floor | 15% | A $30 gap on an account spending $50,000/month isn't meaningfully unexplained |
Proxy-observed spend of $0 against real reported spend always alerts regardless of the percentage floor — that ratio can't be computed, and it's the clearest possible signal that 100% of that provider's spend bypassed the proxy.
A gap in the other direction — the proxy observed more than the provider reported — never alerts. That almost always just means the provider's bill for the period hasn't posted yet.
Automatic freeze
An unexplained-spend alert can automatically freeze your account, same as a compromise-risk signal or a velocity spike — but only if you've opted in via Auto-freeze on high-risk signals in Settings. Off by default.
Frequently asked questions
Related articles