Every trading desk learns this eventually: the most honest data in the building is the tape you are already paying to print.
Why Your LLM Bill Matters Now
Security teams hunting shadow AI keep reaching for new instrumentation — browser extensions, egress inspection, OAuth audits. Meanwhile, finance already runs a sensor with near-perfect coverage of every sanctioned AI platform in the tenant: the bill. Anthropic, OpenAI, Microsoft, and Google all meter consumption per user, per key, per agent, per model. That metering exists to settle invoices. Read it as telemetry instead, and it becomes one of the cleanest unauthorized-usage signals you have.
The reason this matters now is coverage math. Ospiri’s research puts 88% of agent activity outside the view of existing security tooling, and IBM’s Cost of a Data Breach research has repeatedly found that incidents involving unmanaged, “shadow” data cost meaningfully more and take longer to contain than incidents inside governed systems. The billing meter doesn’t close that gap by itself — but it is a detection surface you already own, already pay for, and almost certainly aren’t reading.
| Figure | What it says |
|---|---|
| 88% | Share of agent activity invisible to existing security tooling (Ospiri research) |
| +$670K | Incremental cost when an incident involves ungoverned AI activity (Ospiri research) |
| 12–18 months | Window before endpoint incumbents ship bolt-on agent modules (Ospiri thesis) |
The desks that mark positions daily catch drift early. The desks that reconcile quarterly discover blowups. Your token meter updates daily. Most security teams reconcile it never.
The Meter vs. Every Other Discovery Surface
Each shadow-AI discovery surface trades coverage against fidelity. The meter’s edge is that it is computed by the vendor, per identity, with no deployment cost — it can’t be uninstalled by the user and it doesn’t care whether the client was a browser, a CLI, or a cron job.
| Surface | What it sees | Blind spot | Latency |
|---|---|---|---|
| OAuth / app inventory | Grants and sign-ups | Usage after the grant; API keys | At grant time only |
| Proxy / egress logs | Domains and volumes | Encrypted payloads; local stdio MCP traffic | Near real time |
| EDR process telemetry | Process launches | Which model, which identity, what data | Real time, noisy |
| API security / DSPM | Monitored system-to-system calls | The known-knowns trap — unmonitored systems | After the fact |
| Billing / token telemetry | Per-identity, per-model draw across every client | What the agent touched | Daily, clean |
Notice what the meter uniquely answers: which identity is consuming inference, on which model, at what rate. A dormant service account that starts drawing tokens overnight is an agent nobody registered — and it shows up on the meter before it ever appears in an OAuth log, because an API key never generates a grant event.
Five Billing Anomalies That Are Really Security Signals
Let’s step back. On a trading floor, the risk desk doesn’t read every ticket — it watches for position changes that don’t match the trader’s mandate. Token telemetry works the same way. Five patterns are worth alerting on from day one:
- Dormancy break. An identity with near-zero historical draw suddenly consumes at scale. The classic signature of an unregistered agent wired to a forgotten service account.
- Off-hours draw on a human seat. A named user’s key burning tokens at 3am on a schedule is not a person — it’s automation running under a human identity.
- Model drift. An identity that has only ever called one model starts drawing against a new endpoint or a frontier model. Someone — or something — changed the configuration.
- Payload inflation. Sustained growth in context size per call suggests an agent is being fed progressively larger slices of the estate — files, repos, exports.
- The unmapped steady state. A low, constant draw that reconciles to no registered agent in your inventory. Small positions still carry tail risk; this one is unhedged by definition.
The Shadow-Usage Score
To make this operational rather than anecdotal, score each identity the way a risk desk scores a book:
Shadow-Usage Score = (Draw Deviation × Off-Hours Ratio) + (Identity Dormancy × Model Drift)
| Factor | Definition | Source |
|---|---|---|
| Draw Deviation | Current draw vs. trailing 30-day baseline, in standard deviations | Billing export |
| Off-Hours Ratio | Share of tokens consumed outside the identity’s working window | Billing export + directory |
| Identity Dormancy | Days since last interactive sign-in for the consuming identity | IdP logs |
| Model Drift | New models or endpoints called vs. the identity’s history | Billing export |
Rank the tenant weekly. The top decile is your shadow-agent shortlist — generated entirely from data finance already receives, with zero endpoint deployment.
Where the Meter Stops
Here’s the honest limit: consumption tells you that an agent is busy, not what it touched. The meter is a volume instrument, not a position report. It cannot distinguish an agent summarizing public docs from one reasoning over the payroll repo — both burn tokens the same way.
| Question | The meter answers | The kernel answers |
|---|---|---|
| Is an unregistered agent running? | Yes — dormancy breaks, unmapped draw | Yes — process-level inventory |
| Which identity does it bill to? | Yes | Resolved to device and process |
| What files did it open? | No | Yes — with evidence artifacts |
| Can you stop it mid-action? | No | Yes — inline enforcement |
That’s why the meter pairs with endpoint ground truth rather than replacing it. Agent observability turns the billing signal into a ranked inventory; an agent firewall closes the loop by proving — and constraining — what each flagged agent actually does on disk. The meter finds the position; the kernel marks it to market.
What CISOs Should Do This Quarter
| Step | Action | Output | Effort |
|---|---|---|---|
| 1 | Pull 90 days of billing exports from every AI vendor, per identity and model | Baseline draw curves | Days |
| 2 | Stand up the four score factors and rank identities weekly | Shadow-agent shortlist | 1–2 weeks |
| 3 | Reconcile the shortlist against your registered agent inventory | Gap report: unmapped consumers | 1 week |
| 4 | Pair the top-decile identities with endpoint-level observability and enforcement | Kernel ground truth on the riskiest draw | Quarter |
The Bottom Line
Your LLM bill is the cheapest shadow-AI sensor you will ever deploy, because you already deployed it — the only missing step is reading it as telemetry instead of filing it as a cost line. It finds unregistered agents that OAuth audits and proxies structurally miss, and it does so with data that updates daily and can’t be evaded by a local client. What it cannot do is tell you what those agents touched, which is why the meter is the screen and the kernel is the trade confirm. If your team is sizing this for next quarter’s budget cycle, request a working session. We will walk through your environment, build the shadow-usage ranking from your own billing exports, and scope a deployment. Plan for 90 minutes.