Field notes from the enterprise front lines.

Days 1–30 are almost never about detection. They are about baselining, capturing enough clean signal from endpoints, identity, network flows and cloud audit logs that behavioural models have something meaningful to compare against. Skip this and you build a very expensive alert firehose.

By day 60, prioritization has to shift from 'triage every alert' to 'triage every alert the model can't explain'. AMSTAG SOCs write disposition rules the same way our architects write runbooks: version-controlled, peer-reviewed, and re-validated each sprint.

Day 90 is where the payoff shows up. Playbooks that were manual in week one, credential-stuffing response, ransomware isolation, insider-anomaly review, run as AI-augmented workflows with a human review gate. Mean-time-to-contain drops, and so does analyst fatigue.

Indian enterprise cloud bills rarely fail because of headline pricing. They fail in the seams, non-production workloads running 24×7, snapshots retained beyond any recovery policy, egress from workloads that could have been co-located, and orphaned load balancers no service still routes to.

An AI-driven FinOps loop treats these leaks as anomalies, not line items. Once the model has 30 days of usage telemetry it can flag drift in per-team unit economics well before the invoice arrives, usually inside the sprint the drift began.

The behavioural difference matters as much as the tooling: reviewing spend weekly with an owner named per workload turns cloud finance from a quarterly firefight into a boring, predictable meeting. That is the goal.

The 47-point checklist grew out of three consecutive RBI audit cycles at a mid-sized NBFC. What made it hold up wasn't length, it was the continuous evidence layer behind each control, so auditors could walk from policy to configuration to log in under a minute.

AI helps most in evidence collection: pulling endpoint posture, identity conditional-access rules, network segmentation state and cloud key-management logs into a single, timestamped view. Screenshots become a fallback, not the primary artifact.

Two of the three cycles closed with zero findings. The third had two findings, both procedural. The tooling was the same in all three; the difference was runbook rehearsal, which is why we rehearse them quarterly by default.