reCost.io - Object-Level Threat Detection for Amazon S3

When an identity, an AI agent, or a stolen credential calls the Amazon S3 API directly, the request never crosses a workload. There is no process to instrument and no network path to inspect. Runtime and posture tools have nothing to observe. The only evidence is the S3 server access log, and most organizations never ingest those logs because the volume makes SIEM ingestion uneconomical. The result is an entire access layer that goes unmonitored.

reCost.io turns those logs into a queryable, object-level record of who and what read, listed, wrote, or deleted every object, and when. Every request is attributed to an IAM identity and user agent through assume-role chains. Each identity is baselined so that deviations in volume, operation mix, timing, and assets touched become findings rather than noise. The record supports investigation years after the fact: supply an object key or a date and receive the complete access history.

The platform is built for the agentic era. reCost.io identifies AI agents, MCP clients, and external crawlers touching your storage, including the read-only and consent flags they actually operated with. It surfaces agents performing writes where they were assumed read-only, roles declared read-only attempting to copy or delete, and the true consumer behind a presigned URL when the signing role masks the reader.

Detections span destructive and evasive behavior that only appears in access logs: encryption-based ransomware patterns, bulk deletions and delete-marker floods, lifecycle rules scheduling silent data deletion, versioning or object-lock changes that remove recovery, logging configuration changes, and denied writes from AWS logging services that quietly break log integrity. It also covers enumerate-then-retrieve sequences, dormant prefixes suddenly read, cross-account and cross-region copies, anonymous requests, end-of-life SDKs with known CVEs, and direct object reads that bypass Iceberg, Delta Lake, or Hudi catalogs.

Deployment takes under an hour with a scoped read-only role. No agents, no per-bucket connectors, no code changes, no CloudTrail data-event costs, and object contents are never read. Curated findings route into your existing SIEM, SOC, or ticketing workflow while billions of log lines remain in your own account. reCost.io operates at hundreds of billions of objects and roughly 100 billion requests per month, with retention long enough to support audit and investigation.