The system of record for storage access
One telemetry layer: S3 server access logs, S3 Inventory, and network metadata. reCost turns them into a queryable record of every request, attributed to an identity and a client, retained for years.
What the engine produces
Identity attribution
Every request resolved to its principal: role, assumed-role session, IAM user, external account, or anonymous. Credential type classified, long-lived keys separated from temporary STS sessions.
SDK and runtime fingerprints, with support status and CVE severity per identity.
Client fingerprinting
Every request carries a user agent. reCost parses it to the SDK, runtime, version, and operating system, then tracks that fingerprint per identity over time. End-of-life versions are flagged against vendor support dates, known CVEs matched to detected versions with severity, and a fingerprint change on an established identity surfaces as its own signal.
Access classification
Every identity and user agent pair assigned an access class: application, data platform, ETL, backup, CDN, IaC, human console, AI agent, external crawler, and more.
Behavioral baselines
Volume, operation mix, timing, and asset set learned per identity. This is what the detections measure against.
Network context
Source IP, subnet, and region for every request, with internal and external traffic separated.
Object lineage
Supply a key, a date, an IAM identity, a role, an agent, or a service, and receive every touch on it, going back as far as your retention runs.
What reCost deliberately does not do
No blocking
reCost observes. Your enforcement stack acts on what it finds.
No content reads
Metadata only. Objects are never opened, never sampled, never classified.
No sampling
Every request, every object. Not a percentage, not a scan window.
No agents
Nothing deployed in your environment. A read-only role and nothing else.
The tributary,
not the river.
Storage access logs are too voluminous to put in a SIEM. reCost processes them outside it, at object level, and sends only what matters downstream.
Start with proof,
not a pitch.
Scoped read-only role, 30-day lookback, results in 48 hours.