As a fully managed cloud data warehouse, Snowflake delivers elastic compute and near-unlimited scalability. However, its consumption-based pricing model means that unexpected spikes in daily credit usage can quickly drive up costs. 

These cost anomalies (which are sudden deviations from normal spending patterns) often indicate inefficient queries, misconfigured workloads, or uncontrolled resource usage. To address this challenge, Snowflake introduced Cost Anomalies capability which became generally available on December 10, 2025

This feature monitors usage trends and flags irregular spending patterns across warehouses, accounts, and workloads. By replacing manual cost tracking with automated detection, organizations gain faster visibility into unusual activity.

Basic cost anomaly detection alone is not enough for sustainable cost governance. True optimization requires visibility, context, and intelligent automation. 

Drawing from official Snowflake documentation and platform capabilities, in this blog we cover how Snowflake’s cost anomaly detection works, and how AI-powered Data Observability enhances proactive cost management to strengthen financial oversight.

Understanding Cost Anomalies in Snowflake

Cost anomalies in Snowflake refer to instances where daily consumption (measured either in Snowflake credits or currency) deviates from the expected range based on historical patterns.

Note

Snowflake's built-in algorithm analyzes at least 30 days of prior consumption data to establish baselines. If recent usage (over seven days) is below 10 credits, minor fluctuations aren't flagged to avoid false positives. This automated detection simplifies identifying spikes or dips.


Anomalies are categorized at two levels: 

Account-level:
Account-level anomalies focus on a single account's deviations, such as a sudden increase in compute credits from a rogue workload. 

Organization-level:
Organizational anomalies aggregate data across all accounts in an organization, flagging overall irregularities. 

For example, a spike in one account might be offset by a dip in another, so no organization-wide alert triggers. However, Snowflake provides tools to drill down into contributing accounts with the largest changes. 

This granularity is essential for large enterprises managing multiple accounts.

Data is accessible via views in Snowflake's schemas. These views include daily consumption metrics, anomaly status, and tools for root cause analysis, like identifying top contributors to spikes.

SchemaView
ANOMALIES_DAILYShows credit-based anomalies for the current account
ANOMALIES_IN_CURRENCY_DAILYShows currency-based organization-wide insights


However, access to currency views requires specific roles (tying directly into access control mechanisms).

The Role of Access Control in Managing Cost Anomalies

Access control is the gatekeeper for cost anomaly features in Snowflake, ensuring sensitive financial data is viewed and managed only by authorized users. 

Prior to enhancements announced on November 17, 2025, only system administrators could access these insights. Now, application roles within the Snowflake application democratize access, allowing finer-grained permissions without compromising security.

System Roles Permission Granted
ACCOUNTADMIN Account-level tasks
GLOBALORGADMIN Organization-wide oversight
Non-Admin Roles
APP_USAGE_VIEWER Grants viewing privileges
APP_USAGE_ADMIN Includes configuration capabilities


Organization-level access requires combining these with:

  1. ORGANIZATION_BILLING_VIEWER (for organization accounts)
  2. APP_ORGANIZATION_BILLING_VIEWER (for ORGADMIN-enabled accounts), unlocking currency views and cross-account visibility.

Granting access is straightforward via SQL.


For configuration, swap in APP_USAGE_ADMIN. In real-time scenarios, this means finance teams can monitor without full admin rights, while admins configure alerts to flag issues instantly via email, reducing response times from days to hours.

Access control integrates seamlessly with data observability, ensuring AI-driven insights are delivered securely to the right stakeholders, fostering a collaborative approach to cost management.

Data Observability Powered by Agentic AI: Changing The Game With AI Observability

At the heart of Snowflake's anomaly detection is AI-powered data observability, which uses agentic AI solutions to monitor data flows and usage patterns to uncover hidden issues. 

Snowflake’s built-in cost anomaly detection uses a machine learning algorithmic approach for time-series analysis. The ANOMALY_DETECTION function employs a Gradient Boosting Machine (GBM) algorithm (a form of machine learning) to train models on historical data, which forecasts expected values and flags outliers.

To forecast and detect cost anomalies in Snowflake, prepare time-series data (e.g. daily credits spent) with optional exogenous variables.

Then train a model using:CREATE SNOWFLAKE.ML.ANOMALY_DETECTIONWhich automatically handles trends, seasonality, and lags.

After training, use:DETECT_ANOMALIESon new data to obtain forecasts.


In the wake of this more traditional approach to monitoring cloud data costs and performance, AI-powered observability handles complex, multi-series data (e.g., per-warehouse costs) without manual tuning, or intervention. In other words, the Agentic AII layer addresses issues in real-time by enabling continuous monitoring.  

Agentic AI complements the native cost anomaly monitoring and detection exercise by offering customizable, and deeper insights such as feature importance to pinpoint why costs spiked (e.g., due to specific lags or external factors).

Scalability For Large Enterprises: Revefi Data Cost Optimization

Revefi' serves as an autonomous, zero-touch solution that significantly enhances Snowflake cost anomaly management and real-time issue mitigation. 

Unlike Snowflake's native tools (which only provides algorithmic detection of daily anomalies), Revefi delivers observability solutions for cost, performance, data quality, and usage patterns across Snowflake environments.

The Revefi solution continuously monitors for pressing cost anomalies, such as:

  • Workload spikes
  • Inefficient queries (e.g., excessive SELECT * or bad joins)
  • Failed queries that waste Snowflake credits
  • Idle warehouses

And it goes beyond mere detection by implementing preventative measures automatically, like: 

a) Right-sizing warehouses

b) Auto-pausing idle resources

c) Optimizing query patterns

Verisk logo

By implementing Revefi's AI Agent for Cloud Cost Optimization, Verisk reduced Snowflake warehouse costs by over 60% and boosted operational efficiency by 10x.

Read the full case study


By integrating automated FinOps, DataOps, and Data Observability, Revefi unifies cost and performance workflows by flagging anomalies tied to data quality issues  that indirectly inflate costs, predicts spending trends, and enforces governance without manual intervention (e.g., schema changes that are breaking pipelines). 

Revefi also complements Snowflake's access controls mechanisms by providing role-appropriate alerts and recommendations, enabling faster root-cause analysis and resolution (often within minutes).

With the implementation of Revefi’s AI observability solutions across native Snowflake monitoring tools, businesses can transform cost management from a reactive measure to a more proactive function.

Article written by
Nikhil Menon
Content Marketer, Revefi
Nikhil Menon is a B2B Content Marketer with 6+ years of experience and published articles covering topics across domains like Blockchain, Cybersecurity, AI-ML-NLP, Big Data, Cloud Computing, and FinTech.
Blog FAQs
What are Snowflake cost anomalies and how does detection work?
Snowflake cost anomalies are sudden, unexpected spikes in daily credit or currency consumption that deviate from established historical patterns. As of December 10, 2025, Snowflake’s built-in detection uses a Gradient Boosting Machine (GBM) algorithm to analyze at least 30 days of prior usage. The system establishes a baseline and flags outliers, helping organizations identify inefficient queries or misconfigured workloads before they impact the bottom line.
What is the difference between Account-level and Organization-level cost anomalies?
Snowflake categorizes anomalies at two distinct granularities: Account-level: Focuses on deviations within a single account, such as a rogue workload or a specific warehouse spike. Organization-level: Aggregates data across all accounts in an organization. This is crucial for large enterprises, as a spike in one account might be balanced by a dip in another, requiring a high-level view to determine if total spending is truly irregular.
How do I use SQL to detect cost anomalies in Snowflake?
To proactively monitor costs, users can utilize Snowflake’s ML functions. First, prepare your time-series data (daily credits spent) and train a model using the command CREATE SNOWFLAKE.ML.ANOMALY_DETECTION. Once the model is trained, use the DETECT_ANOMALIES function on new data. This process automatically accounts for seasonality, trends, and lags to provide accurate forecasting and outlier detection.
What is "Agentic AI" in the context of Snowflake cost optimization?
Agentic AI refers to autonomous AI solutions that do more than just monitor data; they act on it. In Snowflake environments, Agentic AI layers provide continuous, zero-touch monitoring. They can pinpoint "feature importance"—identifying exactly which external factor or query lag caused a cost surge—and can even automate preventative measures like right-sizing warehouses or pausing idle resources.
How does Revefi enhance Snowflake’s native cost monitoring tools?
While Snowflake provides the algorithmic foundation for detection, Revefi acts as an autonomous, zero-touch observability layer. It bridges the gap between detection and resolution by: Identifying inefficient joins and "bad" queries that waste credits. Automating the pausing of idle warehouses. Providing role-appropriate alerts that reduce root-cause analysis from days to minutes. Unifying FinOps and DataOps to predict spending trends and enforce governance automatically.