Orca Security launches Discovery AI natural-language query agent on Amazon Bedrock
Orca Security worked with AWS to build Discovery AI, which turns natural-language questions into Sonar queries over its security data graph of more than 900 cloud resource models. The system runs a nine-stage pipeline on Amazon Bedrock combining retrieval-augmented generation with schema-aware query construction: Amazon Titan embeddings recall 20 validated examples, Cohere Rerank 3.5 narrows them to five, Anthropic Claude Haiku 4.5 handles model selection and query generation, and Amazon Nova 2 Lite handles guardrails and validation, with generated filters checked statically and against Orca's Sonar API before retries. Orca says that versus an initial baseline that loaded all 900-plus model schemas into one prompt at roughly 2 million input tokens and about 60 seconds end to end, query cost fell 90 percent, input tokens 93 percent and latency 75 percent, while the system now handles thousands of queries per day at about 15 seconds.
It shows a concrete production pattern — splitting work across several right-sized models with retrieval and validation — for teams turning natural language into structured queries over large, complex schemas.
Security analysts need fast answers about their cloud infrastructure without deep familiarity with domain-specific query languages. Orca Security’s tool covers over 900 cloud models (the resource types Sonar tracks, such as an Amazon Elastic Compute Cloud (Amazon EC2) instance or an Amazon Simple Storage Service (Amazon S3) bucket). Querying that data required precise model names, nested relationship navigation, and selection from 18 operators (comparison functions like equals or contains used to filter results).
To solve this, Orca Security partnered with AWS to build Discovery AI, a natural language query agent on Amazon Bedrock. Orca provides context-aware security for cloud, code, and AI, and Sonar is its domain-specific query system where users search, filter, and explore across the entire data graph.
In this post, we share the architecture and results of Discovery AI, which converts a natural language question into a Sonar query. As a result, Orca reduced query costs by 90 percent, input tokens by 93 percent, and latency by 75 percent compared to the initial baseline.
Bridging natural language and structured queries
Orca Security’s Sonar query system supports 900+ cloud infrastructure and application models with complex relationships between them. To query this data, users construct JSON objects that specify exact model names, select from 18 operators, and navigate parent-child hierarchies across cloud providers. Doing this well requires deep familiarity with the Sonar schema.
#Orca Security#Discovery AI#Sonar#Amazon Bedrock#Amazon Web Services#Anthropic Claude Haiku 4.5#Amazon Nova 2 Lite#Amazon Titan Text Embeddings#Cohere Rerank 3.5