AI Agents for Enterprise IT: Auditing Cloud Spend Before the Next Budget Cycle

Every enterprise IT team inherits the same three problems in some combination, and none of them show up in a single ticket. There is the core system nobody will touch, the mainframe-adjacent billing engine or the identity service three acquisitions deep, too risky to refactor and too expensive to replace, so it just sits there accumulating undocumented dependencies. There is the compliance surface, not one framework but a stack of them, SOC2 for the SaaS arm, HIPAA for the division that touches patient data, PCI for the payments team, each with its own audit calendar and its own auditor asking questions nobody currently owns the answer to. And there is the infra debt, not from one bad decision but from three: a reorg that split the platform team, a reorg that merged two business units onto incompatible cloud accounts, a reorg that left a VP's pet project running in production with nobody assigned to it. None of this is hypothetical. It's the actual Tuesday of anyone running IT at a company past 2,000 employees, and it does not fit into a chat window.

Why a chatbot and an autocomplete tool can't audit a multi-account enterprise footprint

Ask ChatGPT or Claude.ai to help you cut cloud spend and you'll get a competent, generic list: right-size your instances, buy reserved capacity, delete unattached volumes. All true, none of it grounded in your account. A generalist chatbot has no connection to your AWS Cost Explorer, your Azure subscriptions, or the six-year-old Terraform state file that half your infrastructure was never actually written into. It cannot tell you that Business Unit A is running the same RDS workload in three regions because two engineering teams never talked to each other after a merger, because it has never seen your accounts. It produces advice that could apply to any company running any cloud, which is exactly the problem when your actual cost structure is the product of a decade of organizational history a generic prompt has no visibility into.

Cursor and GitHub Copilot solve an entirely different layer of the problem. They're excellent at the moment you're already in a file, writing a Terraform module or patching a Lambda handler. But enterprise IT's hardest problems live above the file level: which of eight cloud accounts actually needs the security group audit first, which business unit's compliance posture is the weakest link before the joint SOC2 review, which legacy system is the one nobody has mapped since the last reorg. An autocomplete tool has no opinion on any of that, because it was never built to reason about an organization, only about the code in front of it. When the actual first move is a cross-account inventory and a risk-ranked audit, not a code suggestion, neither tool is in the room.

Meet Forge, and where Warden and Mesh come in

Forge is Tonone's infrastructure engineer, the agent built for exactly the layer where enterprise IT actually lives: cloud services, networking, infrastructure as code, and cost. Forge doesn't start with a code suggestion either. It starts by inventorying what actually exists, then produces a concrete, numbered plan, whether that plan is a cost optimization pass, a network redesign, or a hardening pass on infrastructure that's been running unattended since the last team turnover. For the specific problem of auditing cloud spend across business units before a budget cycle, Forge is the agent that does the reading nobody on a stretched IT team has four consecutive days to do by hand.

Tonone's Forge audits cloud infrastructure costs across every account it can reach and produces a concrete optimization plan with specific changes and estimated savings, not a generic checklist.

Inventory before anyone touches a dollar of spend

The forge-recon skill is the first move on any enterprise engagement, and it matters more here than almost anywhere else, because enterprise IT rarely has a single, current picture of what it's running. Three reorgs in, that picture doesn't exist as a document, it exists as tribal memory split across people who've since moved teams or left the company. forge-recon inventories every reachable cloud resource across accounts, maps the connections between them, and flags anything that looks orphaned, undocumented, or inconsistent with what the org chart says should be running there. It is the reconnaissance step that has to happen before a cost audit or a security audit means anything, because you cannot optimize spend on infrastructure you don't know exists.

Turning the inventory into a budget-cycle deliverable

Once the inventory exists, forge-cost turns it into the thing finance actually asked for: a cost audit with specific changes and estimated savings attached to each one, broken out in a way that maps to how the business is actually organized, not how the cloud provider bills it. This is the difference between a generic "cut cloud costs 20 percent" mandate handed down from a budget meeting and an IT team walking into that same meeting with a itemized list: this business unit's reserved instance coverage lapsed after the acquisition, this shared service account has been paying for redundant NAT gateways since two teams merged infrastructure without merging the network, this legacy data warehouse is running on-demand compute it qualifies for savings plans on. Nobody assembles that list from memory. Forge assembles it from the actual account state.

Tonone's forge-cost skill maps cloud spend to specific, numbered changes with estimated savings, so an enterprise IT team walks into budget season with a plan instead of a mandate to cut.

Where Warden and Mesh close the rest of the gap

A cost audit alone doesn't cover what enterprise IT is actually accountable for. Warden is Tonone's security engineer, and its warden-recon skill does for security posture what Forge's recon does for spend: a full inventory of secrets management, IAM, dependencies, auth, encryption, and audit logging, run separately across each business unit's footprint so the gaps between them (the acquired subsidiary still using long-lived static credentials, the shared services account with an IAM policy nobody has reviewed since the merger) surface before an auditor finds them first. Mesh, Tonone's service mesh specialist, handles the layer that gets invisible fastest in a multi-reorg environment: how services actually talk to each other across business unit boundaries. Its mesh-recon skill audits existing service mesh configuration for mTLS gaps and traffic policy holes, which matters enormously when three formerly separate networks have been stitched together with VPNs, peering connections, and whatever the last integration team had time to wire up before the deadline.

A worked example: auditing cloud spend across four business units

Take Halden Industrial, a fictional but representative 6,000-employee industrial company running IT across four business units: Manufacturing Ops, Logistics, a Retail Distribution arm acquired two years ago, and a shared HR/Finance services group. Three reorgs in five years left the company with eight AWS accounts, two Azure tenants (one inherited whole from the Retail Distribution acquisition, never consolidated), and a data center lease nobody has scheduled an exit plan for. The CIO has three weeks before the annual budget review and no current cross-account picture of what any of it costs or where the risk actually sits.

The IT director runs forge-recon across all reachable accounts first. It comes back with an inventory nobody had assembled in one place before: 340 EC2 instances, 92 RDS databases, and a scattering of resources in the acquired Azure tenant that were never migrated to the corporate identity provider. Then forge-cost turns that inventory into a numbered plan.

Forge, Cloud Cost Audit, Halden Industrial
Recon: 8 AWS accounts, 2 Azure tenants, 1 on-prem data center lease.
Total monthly spend across accounts: $412,000

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. Manufacturing Ops account: 41 unattached EBS volumes, 6 idle
   RDS instances (no connections in 90 days).
   Estimated savings: $9,400/mo

2. Retail Distribution (Azure tenant, unconsolidated since
   acquisition): duplicate NAT gateway spend where Logistics
   already peers the same VPC. Reserved instance coverage
   lapsed at acquisition, running 100% on-demand for 14 months.
   Estimated savings: $31,200/mo

3. Shared HR/Finance services: over-provisioned Kubernetes
   node pool sized for a Q4 payroll spike, running year-round
   at 12% average utilization.
   Estimated savings: $6,800/mo

4. Logistics: data warehouse on-demand compute qualifies for
   a 3-year savings plan at current usage patterns.
   Estimated savings: $14,100/mo

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Total estimated savings: $61,500/mo ($738,000/yr), 15% of
current cross-account spend, no architecture changes required.
Flag: Retail Distribution's Azure tenant has 3 IAM users with
keys older than 400 days, route to Warden before consolidation.

That last line matters as much as the savings number. Forge doesn't just find cost waste, it flags the security issue sitting next to it, the kind of thing a pure cost-cutting exercise walks right past. The IT director routes that flag to Warden, whose warden-recon confirms the Retail Distribution tenant never got folded into the corporate IAM policy after the acquisition, and separately finds that the shared HR/Finance account has an S3 bucket holding payroll exports with public-read left on from a one-off vendor integration two years ago. Mesh's mesh-recon picks up a third issue while mapping the network: the VPN connecting Logistics to the Retail Distribution VPC has no mTLS between services on either side, meaning traffic between two business units is authenticated at the network boundary only, not service to service. None of these three findings were visible from any single account view. They only surfaced because Forge, Warden, and Mesh each ran their reconnaissance against the same real footprint instead of a chatbot's best guess.

The IT director walks into the budget review with a $738,000 annual savings number tied to specific line items, a remediation list for the three security findings already routed to the right owners, and a network diagram that didn't exist the week before. That's the deliverable a generalist chatbot cannot produce, because it never had access to the accounts, and an autocomplete tool cannot produce, because the deliverable isn't code, it's an audited, numbered plan grounded in the actual infrastructure.

None of this required a rip-and-replace project or a six-month platform migration to get the savings. The $738,000 figure comes entirely from cleanup and reservation changes inside infrastructure that already exists: deleting what nobody is using, buying committed capacity for workloads that are clearly steady-state, and right-sizing a node pool that was provisioned once for a seasonal spike and never revisited. That's the pattern enterprise IT should expect from this kind of audit. The savings are rarely hiding in some exotic architectural overhaul, they're sitting in the gap between what three different reorgs left running and what anyone has actually reviewed since. The value Forge adds isn't a novel cost-cutting idea, it's the discipline of reading every account instead of the two or three anyone remembers to check.

Forge vs the alternatives, for enterprise IT specifically

The comparison that matters for enterprise IT isn't feature-by-feature, it's whether the tool can reason about an organization with a real history: multiple accounts, multiple business units, multiple compliance regimes, and infrastructure that predates the current team. Below is where Forge, a generalist chatbot, and an autocomplete tool land on the specific capabilities an enterprise IT team needs before a budget cycle or an audit.

Tonone's Warden and Mesh close the two gaps a pure cost audit leaves open: security posture across business units and service-to-service traffic that a reorg-era network never fully mapped.

Install and try

Tonone is free and MIT-licensed. Install it once and Forge, Warden, Mesh, and the rest of the 100-agent roster are available in your Claude Code session. You pay only for the Claude Code token usage during the work itself, no separate license fee for the audit your enterprise IT team is about to run.