Stopping a Compromised Key Before It Drains Your Budget

I. The gap a monthly budget can't see

A budget answers a cost question: is this key on pace to spend more than it should this month. A stolen key making cost-normal calls from a new location for a while wouldn't trip a spend anomaly at all — it would look exactly like the key behaving as it always has, right up until the moment it doesn't. The failure mode this report is built around is specific and recurring: a compromised credential gets used to run image or video generation at scale, and the bill — sometimes five or six figures — only surfaces after the damage is done, because nothing was watching for the shift in who and what was calling, only for how much it cost. Closing that gap means watching identity and behavior as a signal independent of cost, not as a delayed proxy for it.

II. Two signals that watch behavior, not spend

Compromise Risk runs alongside spend-based anomaly detection as a second, independent detector. Instead of watching for a spike, it watches for a proxy key suddenly being used in a way it never has before, on two dimensions tracked per key rather than per account: a new source IP the key has never been called from, and a new model family it has never been called with. Model names are bucketed into families for this check — gpt, claude, gemini, mistral, llama, embedding, and separately openai-image / google-image for image-generation models — so a chat-only key suddenly calling an image model is flagged as a new family, not just a new model name. That distinction matters because it is deliberately the same shape of signal that would have caught the image-generation billing spike this feature was built in response to, had it been running through a proxy at the time.

Neither signal fires on a brand-new key's first calls. Without an established baseline — a minimum number of prior calls already recorded under some other value in that dimension — every value looks “new” simply because there is no history yet to compare against, and every signup would generate a false alarm. A signal only fires once a key has a real pattern for the current call to genuinely depart from.

Severity determines what happens next. A new source IP, and most new model families, are medium severity: they alert and nothing more. A key's first-ever image-generation call is high severity — the one case eligible for automatic freeze, and only if that option has been explicitly turned on. Every other case stays a Slack alert an operator reviews and, if it was a legitimate change like a new region deploy, dismisses — dismissal is pure list hygiene and never feeds back into detection.

III. The actual stop: Emergency Freeze

A signal is only useful if there is something faster than a support ticket to act on it with. Emergency Freeze is a hard stop, not a threshold: every proxied call for the account is rejected with an HTTP 403 the moment it is triggered, regardless of what any budget, plan, or enforcement mode says, and with no limit that has to be reached first. That is the deliberate difference from a block-mode budget, which only stops calls once a specific dollar figure is hit — Emergency Freeze exists for “stop right now while I investigate,” not for ongoing enforcement. It is available on every plan, including Free, because whether a security incident can be stopped immediately isn't something that should depend on a pricing tier.

Freezing is self-service in both directions: one click in Settings freezes every process serving the account's traffic within about 10 seconds, and the same panel — or a banner shown across the entire dashboard while frozen — unfreezes it just as fast, with no support-mediated waiting period on either side. Historical data, dashboards, budgets, and settings are untouched; freezing only blocks new calls going forward.

By default, none of this happens automatically — Cognocient alerts on a compromise signal, a spend-velocity spike, or a shadow-spend gap, but never freezes on its own, deliberately, since an automatic hard stop should never surprise an account that never asked for one. Turning on Auto-freeze on high-risk signals changes that for three specific triggers:

The token-velocity circuit breaker referenced in the first row is the same rate-based check covered in depth elsewhere: a per-key, per-minute token-rate guard on a sliding 60-second window that trips at roughly 10× a key's established baseline, with a fixed cold-start ceiling protecting keys that don't have a baseline yet. It is what makes a dollar-denominated velocity spike detectable within the same minute it starts, rather than hours later. One boundary matters here: Emergency Freeze only blocks calls that go through Cognocient's proxy. A raw provider key called directly, or a compromised provider account acting outside Cognocient entirely, is invisible to it — which is exactly the gap the next layer exists to close.

IV. Closing the loop: reconciling what never touched the proxy

Every layer above — budgets, velocity, Compromise Risk, Emergency Freeze — runs inline on traffic that actually reaches the proxy. None of it can see traffic that doesn't: a compromised provider account, a raw API key called directly, or a call site nobody ever routed through Cognocient in the first place. Shadow Spend Reconciliation is the layer built for exactly that blind spot. It compares what a provider actually billed for a period against what the proxy actually observed for that same customer, provider, and period, and alerts when the two don't match:

An alert requires the gap to clear both a $25 dollar floor and a 15% percentage floor by default, so a trivial gap on a small account doesn't page anyone over noise — except when proxy-observed spend is exactly $0 against real reported spend, which always alerts regardless of the percentage floor, since that ratio can't be computed and it is the clearest possible signal that all of a provider's spend bypassed the proxy entirely. A gap running the other direction — the proxy having observed more than the provider reported — never alerts; it almost always just means the provider's bill for that period hasn't posted yet, not a security signal in either direction.

For OpenAI and Anthropic, this doesn't require manual entry: on the Growth plan and above, connecting an admin key lets Cognocient pull the provider's actual daily cost automatically every day and reconcile it without anyone typing in a number. Google Cloud, Azure, Bedrock, and other providers have no live billing connection yet, so a snapshot — entered by hand or uploaded as a CSV of provider, period, and reported amount — is the mechanism there. Either path closes the same loop: confirming that what the bill says matches what the proxy actually saw.

V. Provider caps are real progress, and still not enough

It would be dishonest to write this report as though providers have done nothing here. Between April and July 2026, Google, OpenAI, and Anthropic each shipped some form of their own account- or workspace-wide hard spend cap — a real, overdue fix worth acknowledging rather than ignoring.

None of these give a per-feature or per-team ceiling, none work across providers — a Gemini cap does nothing for OpenAI spend running on the same team — and hitting one stops everything under that account at once, with no graceful degrade for legitimate workloads sharing it. They are a real backstop. They are not a substitute for atomic reservation before the call, scoped to a feature, department, or key, across every provider in use, with a manual override that still works even if a provider's own cap setting is what gets misconfigured or reset by the same compromise that triggered the incident.

VI. The three layers, together

Compromise Risk answers “does this look like someone other than the usual caller.” Emergency Freeze answers “how fast can everything stop once the answer is yes.” Shadow Spend Reconciliation answers “did anything happen that neither of the first two could have possibly seen.” None of the three substitutes for the others — a behavioral signal with no fast stop just documents an incident in progress; a fast stop with no behavioral signal only ever gets triggered by a human noticing something is wrong, hours after it started; and neither one, however fast, can see spend that was never routed through the proxy at all. Run together, as one chain evaluated continuously rather than checked after the invoice arrives, they close the gap a monthly budget was never built to see.