Ranked by dollar, not percent

A later run of the tool against the same anonymized workforce-scheduling SaaS company's org introduced a small but deliberate change to how findings get ranked: a "Top priorities" list that merges cost jumps, forecasted jumps, and on-demand contract exposure into one ranking, sorted by raw dollar amount instead of percent change — with a simple ASCII bar per row so the size difference is visible at a glance, not just implied by two numbers next to each other.

#1  ████████████ $977.49  infra_container_excl_agent
#2  ██████░░░░░░ $540.00  apm_host
#3  █████░░░░░░░ $426.70  logs_indexed_30day
#4  ███░░░░░░░░░ $260.01  synthetics_browser_checks
...
#8  ░░░░░░░░░░░░  $21.30  logs_ingested

The problem this fixes

Percent change is a genuinely useful signal, and most of what we've written about on this site leans on it — a 234% throughput spike, a 43% cost jump, a filter matching 100% of something. But percent has a blind spot baked into how it's computed: it tells you nothing about the size of the thing it's a percent of. A product family that jumps from $10 to $30 a month posts a 200% increase. A product family sitting at $977.49 in uncommitted on-demand spend over five months, with a steady, unremarkable monthly pattern, might not post any dramatic percentage at all — nothing jumped, nothing spiked, it's just been quietly expensive the whole time.

Sort a report by percent change and the second finding loses to the first, every time, regardless of which one is actually worth more of your attention. That's not a hypothetical: in the same run that introduced this ranking, infra_container_excl_agent's $977.49 in on-demand exposure was the single largest dollar finding in the entire report, and it would have shown up as a footnote in a contract-analysis appendix rather than the #1 line item, if the report had sorted everything else — cost jumps, forecasts — by percentage first and left contract exposure in its own separately-ranked section.

We'd already run into this exact tension once

This isn't a new realization for us. A previous post on this site covered a case where a product family's monthly cost fell 44% while its daily usage spiked 234% inside that same month — two percentages, both real, pointing in opposite directions, from the same underlying data. That post's conclusion was that percent alone is a slippery signal precisely because it's relative to a baseline that can itself be moving, shrinking, or otherwise unstable. Dollar-ranking at the report's top-line summary level is the same lesson applied one layer up: instead of asking every finding to compete on percent, ask each one what it's actually worth in absolute terms, and let that number do the sorting.

Why merge three different kinds of finding into one list

Cost jumps, forecasted jumps, and on-demand contract exposure are detected by three different checks, looking at three different kinds of data — historical month-over-month comparison, a linear projection of the current in-progress month, and a comparison against contract terms. Keeping them in three separate sections made a certain structural sense, but it also meant a reader had to manually cross-reference three lists to figure out which single thing was worth acting on first. Merging them into one ranking, sorted the same way regardless of which check produced the finding, answers the only question that actually matters when you've got limited time: what's the single biggest opportunity in this report, full stop, not "what's the biggest opportunity within its own category."

The ASCII bar is a small addition on top of that, and mostly the point of it is that "$977.49 vs $21.30" reads as two numbers you have to compare, while a bar at 100% length next to a bar at roughly 2% length reads as a size difference immediately, without doing the arithmetic yourself.