Resources
How we think about the cloud — and what we're shipping.
Our point of view on the future of cloud — strong opinions on cost, security, observability, operations, and where agentic infrastructure is headed.
Discovery should be a byproduct, not a phase
The most expensive step in every cloud engagement — figuring out what's wrong — should be continuous and automatic, generated from ground truth, not reconstructed one question at a time.
Read →The Forward-Deployed Engineer Is the New Shape of Building
AWS put $1B behind forward-deployed engineers. The real story isn't staffing — it's that AI collapsed product and engineering into one seat. And it's exactly the gap we built Sherpa to close.
Read →We build a tool that finds waste. Then we found a pile of it in our own agent.
A FinOps tool that isn't ruthless about its own efficiency hasn't earned your bill. What 22MB of dead weight in our own stack taught us.
Read →Deep dives, how-tos, and announcements on running your AWS cloud.
Who can get into your AWS account: the entry points a user list doesn't show
Your IAM user list is not your access list. Roles can trust an identity provider, another AWS account, a build pipeline or a third-party tool — and unlike people, none of those offboard. Here's how to inventory the ways in.
Read →What your SBOM generator misses: writing custom detection for Amazon Inspector
Vulnerability scanning runs off a component list. Anything the SBOM generator did not detect is never scanned, and nothing tells you it was skipped. This explains how Amazon Inspector's new Lua plugins let you add detection for ecosystems it does not support out of the box.
Read →Savings Plans coverage vs utilization: the two numbers that decide what you're actually saving
AWS Savings Plans discount up to 72%, but the plan that pays the most is the least flexible. This explains the four plan types, what the commitment actually locks, and why coverage and utilization are different numbers that fail in opposite directions.
Read →How to tell if an AI agent is actually good at your cloud (and what AWS's aws-bench measures)
An AI agent gives a confident answer whether it's right or wrong. This explains how AWS's aws-bench tests AI agents against a known correct answer, why the verified answer is the hard part, and what to check when you evaluate an AI tool for your AWS environment.
Read →AWS IAM privilege escalation paths, explained: why reading policies isn't enough
An IAM role with no administrator permissions can still reach administrator. Here's how permissions compose into escalation paths, why reachability decides what matters, and how to audit paths instead of policies.
Read →Sherpa Agent on AWS Marketplace: one AI agent for AWS cost, security, and observability
Sherpa Agent is live on AWS Marketplace. Talk to your AWS cloud: cost, security, observability, and operations in one conversation, grounded in one connected Knowledge Graph.
Read →AWS Security Hub Network Scanning explained: config-based exposure vs. actual internet reachability
A plain-English guide to AWS Security Hub Network Scanning: what it does, how active probing differs from configuration analysis, what it discovers, and how the two layers of exposure detection fit together.
Read →Least Privilege for AI Agents on AWS: How Cedar Stops Authorization Scope Creep
When AI agents delegate to other agents, authorization scope can silently expand beyond what the original user authorized — even when every individual agent has the right IAM role. AWS published a Cedar pattern on July 6, 2026 to stop it. Here is how it works.
Read →The most expensive part of a cloud project happens before any work starts
In cloud consulting and assessments, the costliest phase is discovery — figuring out what's actually wrong. Here's why it's so expensive, what a grounded report replaces it with, and how that changes the economics.
Read →What 'Forward-Deployed Engineering' Really Means in the AI Era
AWS just put $1B behind forward-deployed engineers and demand for the role grew 42x in two years. Here's what it actually is, and why AI is collapsing product and engineering into one seat.
Read →AWS Lambda MicroVMs explained: safely running untrusted and AI-generated code
A plain-English guide to AWS Lambda MicroVMs: the problem they solve, how they differ from Lambda and containers, what you can build, and the limits at launch.
Read →AWS DevOps Agent vs Sherpa: we ran both on the same account
AWS's DevOps Agent investigates autonomously but reads what AWS already has — X-Ray, CloudWatch, control-plane APIs, live, one domain. Sherpa owns the collection path: it sees the OTel traces and Lambda telemetry the agent can't, in seconds, across domains. We ran both on the same account. Here is what we measured.
Read →Observability Feedback Loop: How One Quietly Burned $750/Day in Our Own Infra
An observability feedback loop quietly burned $750/day in our own infrastructure. What it is, why it is so hard to root-cause, and how we broke it in a day.
Read →AWS has a FinOps, Security, and DevOps agent. The hard problems live between them.
At AWS Summit NY 2026, AWS shipped a Security Agent and a DevOps Agent alongside the FinOps Agent — one agent per domain. The costliest cloud problems are cross-domain, where a single-domain agent can't see.
Read →AWS FinOps Agent vs Sherpa: what a cost-only agent can't see
We ran AWS's new FinOps Agent and Sherpa on the same AWS account. Where AWS has a recommendation, Sherpa matches it — then finds the idle infrastructure, commitment risk, and security exposure a cost-only agent has no category for.
Read →An AI agent for your AWS cloud: cost, security, and observability in one place
Sherpa is an AI agent for AWS that unifies cost, security, observability, and inventory — talk to it, use it as a dashboard, or let it act with your approval.
Read →Webinars, talks, and conferences — see Sherpa live.
Nothing published here yet — check back soon.
How teams put Sherpa to work — real, approved customer outcomes.
Nothing published here yet — check back soon.