FinOps stopped being about cloud. Your biggest line item moved.

FinOps stopped being about cloud. Your biggest line item moved.

Week of 7 September 2026 | Compiled by Team Paringa

Three signals this week that the cost discipline built for EC2 instances is now being pointed at tokens, licences and vendor lock-in, and that most organisations have no meter on the fastest-growing item.

What Happened This Week

🔴 FinOps redefines itself around AI, SaaS and licensing as cloud stops being the whole bill

The State of FinOps 2026 data shows the discipline's scope has broken out of cloud entirely. AI management is now practised by 98% of respondents, up from 63% a year ago. That is close to universal adoption in twelve months, which almost nothing in enterprise IT achieves.

The rest of the expansion is just as telling. 90% now manage SaaS or plan to, up from 65% in 2025. Licensing sits at 64%, up 15 points. Private cloud is at 57%, up 18 points. Data centre is at 48%, up 12 points. Every category that a "cloud cost" team was previously told was out of scope has been pulled in.

The FinOps Foundation has changed its mission wording to match, from advancing the people who manage the value of cloud to advancing the people who manage the value of technology. One word, and the addressable problem roughly triples. FinOps for AI is the top forward-looking priority in the survey and AI cost management is the number one skills gap teams report.

The commercial detail worth noting: practitioners with executive alignment report two to four times more influence over technology selection decisions. Cost data only changes behaviour when it reaches someone with the authority to cancel something.

Sources: FinOps Foundation, FinOps Foundation Insights

The 63% to 98% jump is the number to quote in a CFO conversation. It says AI spend went from a side experiment to a governed line item across the whole market in one year, and your organisation is either in that 98% or explaining why not. The skills gap admission matters more than the adoption figure: teams are being handed AI cost accountability without the tooling or the unit-economics model to do it. Token spend does not behave like compute spend. It is driven by application design choices made by engineers who never see the bill. Start with attribution, not optimisation. You cannot cut what you cannot attribute to a team, a product and a customer outcome.

🟡 Tottenham Hotspur cuts VMware licensing by more than 85% by leaving

Premier League club Tottenham Hotspur has dropped VMware as part of a wider data centre and network refresh at its 63,000-seat stadium, saving north of 85% on licensing, CTO Rob Pickering told The Register on 3 September. The club moved server, storage and networking to HPE GreenLake with OpsRamp and Morpheus VM Essentials, running as a managed hybrid cloud service.

Pickering was direct about the trigger. The issues with the Broadcom takeover of VMware are well known in terms of the commercial changes and how they engage with clients. Since the 2023 acquisition, Broadcom has retired standalone products in favour of bundles that often cost more whether or not you use every component, and has visibly concentrated on its largest 10,000 to 30,000 accounts out of a pre-acquisition base of around 350,000.

The strategic point he made is the one to carry into your own review. He framed virtualisation as a commodity, and said that if it is not built into a broader AI operations stack, the value is lower again. The savings paid for the move. The reason for the move was consolidating fault detection and remediation into one pane of glass for a small technology team.

Nutanix CEO Rajiv Ramaswami, reporting $757 million in Q4 revenue on 27 August, said the company won 3,000 new customers in the year, many as a VMware alternative, and expects to keep winning them for another five years.

Sources: The Register, The Register on Nutanix

An 85% licensing reduction on a named, verifiable UK customer is the most useful negotiating artefact published this quarter. Take it into your renewal. The wider lesson is that licensing has become the cheapest source of savings on the board, because it needs no engineering effort to identify, only the willingness to move. Note also where the money went: Spurs did not bank the saving, they spent it on an AI operations stack that lets a small team run a stadium. That is the pattern to copy. Fund the AI programme from licensing waste rather than from a new budget line, and the business case stops being a debate.

🟡 A stolen API key burned $600,000 of model credits over three weeks, unnoticed

AI evaluation nonprofit METR disclosed on 31 August that an attacker stole an API key in March 2026 and spent roughly three weeks consuming about $600,000 worth of public-model credits. The entry point was a researcher's personal EC2 instance running a vibe-coded app with a fail-open authentication bug, left publicly reachable for several days. The attacker prompted the agent to reveal the model provider API key, added an SSH key for persistence, and started spending.

The detection failure is the part that should worry every finance and platform lead. METR runs token-heavy evaluations routinely, so its people are, in their own words, very acclimated to getting lots of weird rate limit and API errors. Abnormal consumption looked normal. The credits were donated, so no invoice ever arrived to raise a flag. And at the time there was no way to set a spending limit on that class of key.

METR got away with it because the model provider had given it the credits for free. A commercial customer would have received a $600,000 bill. In a second campaign in May, attackers used agents to probe METR's infrastructure with automated vulnerability discovery, credential stuffing and OAuth token grant attempts.

Sources: The Register

Three controls would have caught this and most organisations have none of them: a hard spend cap per API key, an anomaly alert on token consumption rather than on cost, and an inventory of which keys exist and who holds them. Shadow AI is usually discussed as a data leakage risk. This is the financial version, and it is faster. Consumption pricing means an exposed credential converts directly into cash burn at machine speed, with no procurement step to slow it down. Ask your platform team today how many model provider keys are live, which have spend limits, and what the daily ceiling is if every one of them were abused simultaneously. If the answer takes more than an hour to produce, that is the finding.

What FinOps and Platform Teams Are Dealing With

The uncomfortable arithmetic this year is that the two fastest-moving cost lines both sit outside the cloud bill that FinOps tooling was built to read. Licensing renewals arrive as a step change, driven by a vendor's commercial strategy rather than your consumption, and VMware has made that vivid. Token spend arrives as a smooth curve that nobody owns, driven by application design decisions made in sprint planning. Nutanix spent $20 million on its own on-premises cluster specifically because usage of Copilot and Claude exploded and so did costs, and expects to recoup it inside a year. That is a serious company concluding that per-token pricing was structurally unaffordable at its scale.

Meanwhile the hardware floor is rising. Memory prices, the so-called RAMpocalypse, are already delaying purchases and pushing vendors toward Arm and toward tiering data out of DRAM. The result is a squeeze from both directions: infrastructure is getting more expensive per unit at the same time as AI workloads are increasing the number of units. Optimisation alone will not close that gap. Attribution, unit economics and the willingness to change vendor will.

Three Things Worth Watching Next Week

1. Spend caps on model provider API keys - Expect providers to ship per-key spending limits quickly after the METR disclosure. Until they do, this is a manual control you have to build yourself.

2. VMware's vSphere Standard repositioning - Broadcom has signalled a swing back to low-end server virtualisation and says it has corrected the incentives that pushed customers into full private cloud bundles. Watch whether that shows up as better renewal pricing or just better marketing.

3. On-premises AI inference economics - Nutanix claims a one-year payback on a $20 million cluster. If more enterprises publish comparable numbers, the buy-versus-rent calculation for inference reopens, and hyperscaler AI revenue forecasts get harder to defend.

Questions? hello@paringa.ai

Paringa finds the waste that funds your AI programme, across cloud, licensing and token spend, and puts attribution behind it so the savings stick. With Atmoz, we turn cost data into decisions your CFO will sign off. | 7 September 2026 | © Paringa Ltd