The Cost and Usage Report (CUR) is a detailed export of cloud billing and usage data. It records resource consumption, account identifiers, tags, credits, taxes, and other fields that let teams reconcile what ran in the cloud with what was charged. Compared with a dashboard or forecast, CUR is the more authoritative dataset for audits and chargeback analysis.
In cyber security, CUR matters because cost data can reveal abuse, misconfiguration, and stealthy activity. Sudden spikes in compute, storage, or data transfer may indicate cryptomining, log exfiltration, or runaway automation. Defenders also use CUR to validate alerts, investigate suspicious spend, and separate real billing impact from noisy estimates. During incidents, it helps answer a basic question: did the workload truly change, or did the reporting layer glitch? For that reason, CUR is often used as a backstop when cost dashboards produce extreme or inconsistent numbers.