Monitoring Is a Financial Control

The Decision in Front of You

Every executive team already pays for monitoring, usually as software licenses and a vendor contract renewed each year. The decision is whether that spend is a tool budget or a risk control.

The distinction matters because the money is lost in the minutes between something breaking and someone doing something about it. A monitoring tool can see a failure instantly. Whether the business learns about it in two minutes or two hours depends on who owns the alert and how it reaches them.

Uptime Institute's 2026 outage analysis found 57% of survey respondents said their most recent major outage cost more than $100,000, and for the second year running one in five put the cost above $1 million ¹. Per-site outage rates have fallen for five straight years, though the improvement is slowing ¹. When failures become rare, teams get less practice responding to them, which makes each slow first hour more expensive.

What's Happening

Detection is getting slower, and slow detection is expensive

IBM's 2026 Cost of a Data Breach study covered 602 breaches between March 2025 and February 2026. The average breach took 247 days to identify and contain, the first increase in five years ²³. The global average cost reached $4.99 million, a record, and the US average was $11.5 million ²³.

Time is the cost driver. Breaches that ran past 200 days averaged $5.65 million, against $4.32 million for those contained sooner ³. Organizations that used security AI and automation extensively cut breach costs by almost $2 million on average ².

Downtime follows the same arithmetic. A 2024 study by Oxford Economics, conducted with Splunk, surveyed 2,000 executives at Forbes Global 2000 companies and estimated unplanned downtime costs that group $400 billion a year, about 9% of profits ⁴. The sponsor sells monitoring software, so treat the headline as an upper bound.

Recent incidents show where monitoring breaks down

AWS, October 2025. A race condition in DynamoDB's automated DNS management left the service's regional endpoint in Northern Virginia with an empty DNS record, and the automation could not repair it. The disruption ran from 11:48 p.m. on October 19 to 2:20 p.m. the next day, Pacific time ⁵. The automation built for resilience caused the failure. AWS disabled it worldwide until a fix was in place ⁵. One industry estimate put US economic losses at $500 million to $650 million ⁶.

Cloudflare, November 2025. A database permissions change doubled the size of a configuration file and crashed the software that routes much of Cloudflare's traffic ⁷. Automated tests flagged the problem at 11:31 UTC. The team first read the symptoms as a large DDoS attack, partly because Cloudflare's separately hosted status page happened to fail at the same time. The real cause was identified at 14:24, almost three hours after the first alert ⁷. Detection took minutes. Diagnosis took hours, because the signals were ambiguous and the team had no fast way to tie the outage to the change that preceded it.

PocketOS, April 2026. An AI coding agent working in a test environment hit a credential error, found an API token in an unrelated file, and used it to delete the company's production database and its backups ⁸. The firm, which runs reservation software for car rental companies, spent days rebuilding records from payment, calendar, and email systems before its cloud provider restored the data ⁸. Explicit safety instructions and a top-tier model did not stop it.

Binance, October 2026. Attackers took an estimated $6.3 billion from the exchange on October 29, the largest crypto theft on record ⁹¹⁰. Binance's preliminary finding is that a compromised laptop belonging to a DevOps engineer gave the attacker access to a service container, which was used to submit unauthorized withdrawals ⁹. About $3 billion was frozen, and Binance said it would cover customer losses ⁹. How quickly the withdrawals were detected has not been published. Executives should ask whether their own systems would flag a legitimate internal service suddenly moving money at abnormal volume, and how many minutes that would take.

A case worth knowing: Knight Capital, 2012

On August 1, 2012, a defective code deployment at Knight Capital sent more than 4 million orders into the market in 45 minutes while trying to fill 212 customer orders ¹¹. The firm lost more than $460 million ¹².

Before the market opened, an internal system sent 97 automated emails to staff that identified an error in the faulty router ¹¹. The emails were never designed as alerts, so nobody treated them as urgent ¹³. The SEC later found Knight relied on people to watch its financial exposure instead of generating automated alerts, and fined the firm $12 million on top of the trading loss ¹²¹³.

Why the Usual Approach Fails

Most monitoring programs start with a product decision. Someone evaluates vendors, buys one, and engineers instrument what the tool makes easy. Servers report CPU and memory. Databases report connections. Within a year the company has hundreds of charts and thousands of alerts.

Several habits make this expensive.

Teams watch machine health when customers feel symptoms. A checkout page that takes eight seconds is costing money right now, even if every server behind it reports normal load. Google's site reliability engineering guidance tells teams to alert on user-facing symptoms, measured through four signals: latency, traffic, errors, and saturation ¹⁴. Most corporate monitoring still pages on machine health.

Alerts have no owner. An alert sent to a group email is an alert sent to nobody. When everyone receives it, each person assumes someone else is handling it.

Changes are invisible to responders. In both the AWS and Cloudflare incidents, the trigger was an internal change or automated process ⁵⁷. When monitoring shows symptoms without showing what changed in the last hour, responders chase the wrong theory.

Machine identities go unwatched. AI agents, service accounts, and deployment pipelines now hold production credentials. In IBM's 2026 study, 92% of organizations with AI-related incidents lacked proper AI access controls ³. Of organizations that secure non-human identities in AI workflows, only 36% use behavioral monitoring on them ³. PocketOS and Binance both turned on an automated or internal identity doing something it should not have been able to do.

Auditors expect more than tools. NIST's Cybersecurity Framework 2.0, published in February 2024, makes continuous monitoring a core category of its Detect function ¹⁵. ISO/IEC 27001:2022 added a dedicated control, Annex A 8.16, that expects organizations to monitor systems for anomalous behavior and act on potential incidents ¹⁶¹⁷. Both frameworks expect evidence that monitoring operates and that someone acts on what it finds.

The Framework: The Monitoring Control Loop

A financial control has an owner, a defined check, a threshold, a response, and a periodic review. Monitoring should have the same parts.

flowchart LR
    A[Define<br/>business service<br/>and target] --> B[Measure<br/>customer signals<br/>and changes]
    B --> C[Route<br/>one alert<br/>one owner]
    C --> D[Respond<br/>written runbook<br/>authority to act]
    D --> E[Review<br/>monthly<br/>with leadership]
    E --> A

Define. Start with the services customers and revenue depend on: ordering, invoicing, dispatch, payments. For each, agree on a target in business terms. "Orders confirm within five seconds, 99.9% of the time" is a target an executive can hold someone to, because it describes what the customer experiences.

Measure. Instrument the four symptom signals for each service ¹⁴, then add one business signal, such as orders per minute compared with the same hour last week. Record every deployment and configuration change on the same timeline, so responders can see what changed before the alert fired. Watch what automated identities do: an AI agent or service account deleting data, moving money, or reading credentials outside its normal pattern should page a person.

Route. Every alert maps to exactly one on-call owner with a phone that rings. If an alert does not require someone to act, delete it.

Respond. Each alert links to a short written runbook: what to check, who to call, and what the owner may do without asking permission. Pre-approved authority is what turns a ten-minute response into a two-minute one. Rolling back the most recent change should be on that list.

Review. Once a month, leadership sees four numbers per critical service: incidents, median time to detect, median time to act, and estimated revenue at risk, shown against the prior six months.

What a slow first hour costs

The following is an illustrative model for a hypothetical mid-size distributor. Substitute your own figures.

The model is deliberately simple. Its purpose is to put a dollar figure on minutes, which is the number most monitoring budgets never see.

Costs, Risks, and Tradeoffs

This approach costs money and attention. It is also the wrong answer in some situations.

How to Act

Questions to Ask Your Team

1. Which five services would cost us the most per hour if they stopped?
2. For each of those, who gets called first, and how?
3. How long did it take us to notice our last three outages, and who noticed first: our systems, our staff, or our customers?
4. When an alert fires, can the responder see every change made in the previous hour?
5. Which AI agents and service accounts can delete production data or move money, and what alerts when they do?
6. What can the on-call engineer do at 2 a.m. without asking permission?
7. If an auditor asked for evidence that we act on monitoring alerts, what would we show them?
8. What does a minute of downtime on our order system cost, in dollars?

Closing

Finance would never accept a reconciliation that nobody owns, checked on no schedule, with exceptions emailed to a shared inbox. Most companies run monitoring exactly that way, and many now give AI agents production credentials with even less oversight. Assign an owner, set a target, route alerts to a person, watch the machines as closely as the people, and review the numbers monthly.