What Does an AI Investigation Actually Cost? (2026)

Key Takeaways

• Every vendor bills in a different unit, which is why nobody can compare them. AWS DevOps Agent charges "$0.0083 per agent-second". Azure SRE Agent charges Azure Agent Units with a mandatory always-on floor. Datadog charges non-rolling AI Credits. Cleric is the only vendor publishing a straight per-investigation price: $20 per issue.
• The derivable cost of one investigation ranges from about $1.17 to about $20 across vendors that publish enough to calculate it. Rootly, incident.io, PagerDuty and Google publish nothing you can derive a per-investigation figure from.
• Azure's own two pages disagree by 4.2x on how an investigation is metered. The product page says "0.25 Azure Agent Units per second" while the billing docs meter active flow per token. A 10-minute investigation is $15.00 under one reading and $3.53 under the other.
• The biggest hidden cost is not the agent, it is the queries the agent runs. AWS states you also pay for "Amazon CloudWatch Logs Insights queries or trace retrievals." At AWS's published $0.005 per GB scanned, ten queries against a 500 GB log group is $25, against a $3.98 agent fee.
• Azure bills you for an agent that is doing nothing. Always-on is "4 AAUs per agent-hour" and continues "from agent creation until the agent is deleted," so a stopped agent still bills roughly $292/month at $0.10/AAU before a single investigation. AWS, by contrast: "There are no upfront commitments or charges for when the agent is idle."
• More spending does not buy more accuracy. Two independent 2026 evaluations found the same thing. SREGym: "the marginal token does not buy additional success." Artificial Analysis: "longer trajectories do not translate to higher accuracy."
• Retire the $5,600-per-minute downtime figure. It traces to a 2014 Gartner blog post that no longer resolves. Use the 2026 PagerDuty/Wakefield distribution instead.

An AI investigation costs between roughly $1 and $20 in vendor charges as of July 2026, but the observability queries the agent runs during that investigation can cost several times more than the agent itself. Almost no published comparison exists, because each vendor bills in an incompatible unit and two of the largest do not publish a per-investigation figure at all. This post derives what is derivable, shows the arithmetic, and names what cannot be derived.

Every price below was checked on July 28, 2026 against the live vendor page or, where a vendor renders prices client-side, its official pricing API. Where a vendor does not publish, we say so rather than estimating.

Why can't you just compare AI SRE pricing?

Because the billing units are not commensurable. This table is the actual problem.

Vendor	Billing unit	Published rate	Idle charge?
AWS DevOps Agent	Wall-clock agent-second	"$0.0083 per agent-second"	No
Azure SRE Agent	Azure Agent Unit (AAU)	"4 AAUs per agent-hour" always-on + active flow	Yes
Datadog Bits Investigation	AI Credit	"$500 per 500 credits/month (billed annually) or $1.30 per credit on-demand"	No
Cleric	Investigated issue	"1 Issue 10 credits $20"	Platform floor
Rootly	Seat	AI SRE: "Contact us"	n/a
incident.io	Seat	AI bundled into Pro "$25/user/month"	n/a
PagerDuty	AI Action	"1,000 one-time AI Actions" on Professional	n/a
Gemini Cloud Assist	Licence	Free during preview, Premium Support gated	n/a
Aurora (self-hosted)	Your own LLM tokens	Your provider's list price	No

Wall-clock seconds, tokens, credits, issues, and seats are five different things. A vendor billing agent-seconds is incentivised to answer fast; a vendor billing tokens is not. That is worth knowing before you sign.

What does one investigation cost, vendor by vendor?

Here is every figure that can be honestly derived, with the assumption stated. Where the multiplication is ours rather than the vendor's, we say so.

AWS DevOps Agent: about $3.98. AWS publishes the rate and an eight-minute example but never the per-investigation price. The arithmetic: 8 min x 60 s x $0.0083 = $3.98. Cross-check against their own published $39.84 for ten investigations, which divides to $3.984. Customers on paid Support plans also receive monthly DevOps Agent credits worth a percentage of the prior month's AWS Support charge, "100% for Unified Operations", 75% for Enterprise and 30% for Business Support+, and those credits expire at the end of each month.

Azure SRE Agent: $3.53 or $15.00, depending which Microsoft page you believe. The docs give a worked example of 35.3 AAU for an incident investigation on Claude Opus 4.6. At $0.10/AAU that is $3.53. On GPT 5.3 Codex the same example is 11.7 AAU, or $1.17. But the product page states each task is billed "at an additional 0.25 Azure Agent Units per second," which for a 10-minute investigation gives 600 x 0.25 x $0.10 = $15.00. Those are incompatible billing models from the same vendor, and the gap is 4.2x.

The USD figure needs a caveat: Azure's public pricing page renders literal $- placeholders, so the price is only obtainable from the Retail Prices API. The reproducible query:

GET https://prices.azure.com/api/retail/prices?api-version=2023-01-01-preview
    &$filter=contains(meterName,'Agent Unit')

That returns 22 regional meters named SRE Agent Unit under serviceName: "Foundry Tools", at $0.10/AAU in five US regions, $0.11 in thirteen others, $0.118 in uaecentral, and $0.12 in westeurope, southeastasia and brazilsouth.

Datadog Bits Investigation: $6.50 committed, $8.45 on-demand. Datadog publishes an average of "~6.5 credits" for an autonomous investigation. Committed credits work out to $1.00 each, so 6.5 x $1.00 = $6.50; at the on-demand rate of $1.30 it is $8.45. Datadog explicitly disclaims the average: "Actual consumption for any single request may vary with task complexity and the amount of context the model processes."

Cleric: $20, published directly. No derivation needed, and credit where it is due, because they are the only vendor in the category who states it: "1 Issue 10 credits $20," where "An Issue is a defined operational problem Cleric takes end to end." Note the platform floor of $2,000/month billed annually.

Not derivable, and you should ask why. Rootly's AI SRE is "Contact us." incident.io bundles AI into a Pro seat with no per-investigation unit. PagerDuty grants "1,000 one-time AI Actions" with no published dollar value per Action and no published refill price. Gemini Cloud Assist Investigations is free during preview but gated to Premium Support customers.

What does it cost if you bring your own LLM key?

This is Aurora's model, so treat the following as an interested party showing its arithmetic rather than a neutral finding.

Published token counts for agent investigations come from SREGym, which measures tokens per run. Stratus on Sonnet-4.6 without injected noise used about 812K tokens; Claude Code used 1.47M; Codex used about 1.98M. SREGym publishes tokens only, and no dollar figures, so any currency number here is our calculation, not theirs.

It also publishes only totals, with no input/output split, so a point estimate would be false precision. Bounding it against Anthropic's list prices for Sonnet-4.6 at $3/MTok input and $15/MTok output, 812K tokens is $2.44 if every token were input and $12.18 if every token were output. Real agent traffic is heavily input-weighted, so the realistic range is roughly $2.50 to $3.50.

That method reproduces a published figure when tested against one, which is the only reason to trust it. Coroot published a split of 9,800 input and 1,000 output tokens on Opus 4.8 at $5/$25, and states a real per-incident price of $0.0743. The same arithmetic gives 0.0098 x 5 + 0.001 x 25 = $0.074. Two caveats on that comparison, though, and they matter: Coroot's number covers a single scenario with, in their words, "No tools, no agent loop," over pre-correlated findings, so it is not measuring the same work as a multi-step agent investigation. And Coroot lists AI-powered root cause analysis under its paid tier at "$1 per monitored CPU core/month" rather than among the free Community edition's core features.

Current list prices, for your own modelling:

Provider	Model	Input /MTok	Output /MTok
Anthropic	Claude Opus 5 / 4.8 / 4.7 / 4.6	$5	$25
Anthropic	Claude Sonnet 4.6	$3	$15
Anthropic	Claude Haiku 4.5	$1	$5
OpenAI	gpt-5.6-sol	$5.00	$30.00
OpenAI	gpt-5.6-terra	$2.50	$15.00
OpenAI	gpt-5.4-mini	$0.75	$4.50
Google	Gemini 3.1 Pro Preview	$2.00 (<=200k)	$12.00
Google	Gemini 3.6 Flash	$1.50	$7.50

Two timing details that change the maths in 2026: Claude Sonnet 5's introductory pricing expires August 31, 2026, and Anthropic models from 4.7 onward use a tokenizer that produces roughly 30% more tokens for the same text, which changes effective cost independently of the sticker rate.

Model routing is the cheapest lever here and it is worth stating that Aurora defaults to it: RCA runs on Haiku unless you turn cost optimisation off, guardrail checks run on a cheaper model still, and the stable system prompt carries an Anthropic cache breakpoint so later turns bill at cache-read rates. Aurora also persists tokens, latency and cost per LLM call and surfaces total cost per investigation, which is the number this whole post is about.

The hidden bill: what the agent's queries cost

This is the finding that should change how you budget, and almost nobody writes about it.

AWS says it plainly on its own pricing page: "You are responsible for fees incurred for other AWS services... for example, Amazon CloudWatch Logs Insights queries or trace retrievals." AWS's published price list puts Logs Insights at $0.005 per GB of log data scanned.

Work that through. Scanning a 500 GB log group costs $2.50 per query. An investigation that runs ten such queries costs $25 in scanning, against a $3.98 agent fee. The observability bill is 6x the agent bill, and it is billed by a different team's budget.

The corollary: cost scales with how many times the agent looks, not with what the vendor charges per second. An agent that runs one well-targeted query is dramatically cheaper than one that greps everything twice, even if the second agent finishes faster.

Other costs buyers miss, each from the vendor's own terms:

• Non-rolling credits. Datadog: "AI Credits reset on the first day of each calendar month. Unused credits do not roll over to the next month," and overages "billed automatically at the On-Demand rate," a 30% premium. Cleric is more generous: credits "roll over for one month, up to 2x your monthly amount."
• Rehydration. Datadog charges "$0.10 per compressed GB of log data that is scanned" to rehydrate archived logs. An agent investigating anything older than your index window triggers this.
• Always-on floors. Azure's always-on charge "continues from agent creation until the agent is deleted," and a stopped agent "still incurs the fixed always-on cost."
• Annual-commitment penalties, category-wide: roughly 16% at PagerDuty ($25 monthly versus $21 annual) and 30% on Datadog AI credits ($1.30 on-demand versus $1.00 committed).
• Tail risk. Ask for a p99 rather than a mean. Published eval data in this category shows per-test costs where the worst single run is more than an order of magnitude above the average, so an average tells you very little about the run that scans everything.
• Runaway loops. incident.io's engineering team wrote that Investigations are "much more (100x) as expensive when compared to our existing AI features, with greater potential for runaway costs," and their controls are per-project billing limits and daily spend reports.

Does spending more get you a better answer?

No, and two independent 2026 evaluations reached that conclusion separately, which makes it the most robust finding in this post.

SREGym concluded that "the marginal token does not buy additional success." Artificial Analysis, running IBM's ITBench task set, found that "longer trajectories do not translate to higher accuracy," and their per-task cost data inverts the ranking outright: Gemma 4 31B scored about 37% at $0.14 per task while Gemini 3.1 Pro Preview scored about 30% at $2.23 per task, and Claude Opus 4.7 led at about 47% but cost $5.38 per task. Those figures are Artificial Analysis's, published in their May 27, 2026 launch article, not IBM's; IBM publishes no cost column.

Artificial Analysis also observed why the expensive runs fail: "Models that over-investigate tend to surface upstream fault-injection mechanisms or co-occurring symptoms as false positives." Over-investigation costs money and buys wrong answers. We cover what the accuracy numbers actually support in AI SRE accuracy: what the benchmarks show.

What is the real cost of downtime in 2026?

You need this number to justify any of the above, and the one everybody quotes is unusable.

Retire "$5,600 per minute." It traces to a 2014 Gartner blog post that no longer resolves, was never accompanied by a published methodology, and now circulates only through vendor pages citing each other. The same applies to the "$9,000 per minute" variant, which is really Ponemon's 2016 mean of $8,851 from 63 data centres, measuring facility outages rather than software incidents.

Use this instead, from PagerDuty's 2026 research fielded by Wakefield Research, N=1,000 director-level-and-above decision makers:

"Some organizations (8%) lose more than $1 million per hour, 34% lose at least $500,000 per hour, and more than two thirds (68%) lose more than $300,000 per hour during IT incidents."

It is per-hour, which is the only unit that converts against investigation time; it is ungated at the primary source with the methodology published; and it is a distribution rather than a single false-precision average. Disclose the obvious limitation when you cite it: it is vendor-commissioned and self-reported.

For triangulation from a different population and method, Splunk and Oxford Economics (May 19, 2026, N=2,000 Global 2000 executives, hybrid CATI and online across 20 countries) put it at "$95 million in lost revenue annually" per company.

One number to avoid even though it is tempting: PagerDuty's own "$793,957 per incident" figure is undated, its source whitepaper publishes no methodology, and the arithmetic does not check out (4,537 x 175 = 793,975).

What does self-hosting actually cost?

If you run an open-source agent yourself, the honest split is that the stack is cheap and the model is not.

Component (AWS rates are us-east-1 on-demand)	Published price
EKS or GKE control plane	"$0.10 per cluster per hour" (~$73/mo)
Compute node, m7i.xlarge (4 vCPU / 16 GiB)	$0.2016/hr (~$147/mo)
RDS Postgres db.m7g.large Single-AZ	$0.168/hr (~$123/mo)
ElastiCache m7g.large running Valkey	"$0.1264 per Gen Purpose m7g.large node hour" (~$92/mo)
S3 Standard, first 50 TB	$0.023 per GB-month
GPU for open-weight serving, p5.48xlarge (8xH100)	$55.04/hr (~$40,179/mo)

The non-GPU stack lands under $500/month, line by line. Serving your own frontier-class model on demand is roughly 80x that. This is the honest argument for bring-your-own-key rather than self-hosted inference, and it is why Aurora supports both cloud providers and Ollama for air-gapped deployments but does not pretend local inference is the cheap option.

A pricing-page footnote worth knowing: in ElastiCache, Valkey is priced 20% below Redis OSS, $0.1264 versus $0.158 per m7g.large node hour, which is open source showing up directly on an invoice.

The buyer's checklist

Five questions that get you a real number instead of a rate card:

1. What is the unit, and does it bill when idle? Azure's always-on floor is roughly $292/month per agent before any work. AWS charges nothing idle. At ten investigations a month, Azure's fixed cost is 8x its variable cost.
2. What do the agent's queries cost, and whose budget pays? Get the vendor to state whether observability query and rehydration fees are included. At AWS's rates the query bill can exceed the agent bill several times over.
3. Do credits expire, and what is the overage rate? Non-rolling credits plus a 30% on-demand premium is a materially different price than the headline.
4. What is the worst single investigation, not the average? Ask for a p99, not a mean. Vendors publish averages; the tail is where the budget breaks.
5. What caps exist? Ask specifically whether there is a hard per-investigation or per-month spend ceiling, and who gets paged when it is hit. Aurora is honest about its own limit here: it tracks and reports cost per investigation, and exposes hooks a host can use to enforce limits, but it does not ship a built-in hard budget cap.

Measure your own number instead of trusting ours

The only per-investigation cost figure worth planning against is one from your own incidents, your own model choice and your own alert volume. With bring-your-own-key, the LLM spend lands on your provider bill where you can read it directly:

git clone https://github.com/arvo-ai/aurora.git && cd aurora

make init                # generates secrets, copies .env.example to .env
nano .env                # add OPENROUTER_API_KEY, OPENAI_API_KEY or ANTHROPIC_API_KEY
make prod-prebuilt       # pulls prebuilt images and starts

Open http://localhost:3000 and register; the first user becomes admin. Aurora persists per-call token, latency and cost and rolls it up per investigation, so after a dozen real alerts you have a distribution rather than a vendor average, including the p99 that item 4 above tells you to ask for.

Three settings in .env.example move the number materially:

# Background RCA on claude-haiku-4.5 instead of claude-opus-4.6
RCA_OPTIMIZE_COSTS=true

# Off by default: skips the periodic and final LLM extraction for the infra graph
VISUALIZATION_ENABLED=false

# Caps auto-loaded integration skill context during background RCA (defaults to 12000)
RCA_SKILLS_TOKEN_BUDGET=12000

Two honest caveats on the self-hosted path. There is no built-in hard budget cap, per item 5 above. And the stack itself has a floor: Postgres, Memgraph, Weaviate and Redis are real infrastructure, which is the sub-$500/month line-item table earlier in this post. The hosted tier avoids that floor if you only want a per-investigation cost baseline.

• Start free: aurora-ai.net (hosted, no infrastructure to run)
• GitHub: github.com/Arvo-AI/aurora
• Related guides: AI SRE Accuracy: What the Benchmarks Show · How to Evaluate an AI SRE Platform · Self-Hosted AI SRE · Azure SRE Agent Alternative

All vendor prices verified July 28, 2026 against the live vendor pricing page, the Azure Retail Prices API for Azure Agent Units, or the AWS Price List API for AWS rates that the pricing pages render client-side. Derived per-investigation figures show their arithmetic and state their assumption. Where a vendor does not publish a price, this post says so instead of estimating. Prices change; re-check before quoting.