Orca details nine-stage Bedrock agent for cloud-security queries

AWS and Orca Security have detailed Discovery AI, a production agent that converts natural-language cloud-security questions into validated filters for Orca’s Sonar query system. The companies said the system has processed thousands of production queries per day since March 2026.

For comparable workloads, AWS and Orca said the deployed design cut end-to-end response time from about 60 seconds to 15 seconds, lowered input-token use from about 2 million to 140,000 and reduced overall query cost by 90% compared with Orca’s initial proof of concept. The companies did not release the underlying test set, raw results or absolute cost figures, and they did not disclose a numerical accuracy rate.

Sonar is Orca’s domain-specific cloud-security query system, covering more than 900 infrastructure and application models, relationships among those models and 18 filtering operators. The initial proof of concept placed the full schema and examples into a single prompt for the largest available model, but AWS and Orca said that approach consumed roughly 2 million input tokens per comparable workload and struggled with some complex queries spanning multiple models.

The production system divides the work into nine stages. First, it combines a request with organization, connected-cloud-provider and request metadata. A deterministic matcher then uses regular expressions and rules to detect structured values such as IP addresses, CVEs, ARNs, file hashes and resource IDs; high-confidence matches can bypass model inference and use a predefined filter. A guardrail checks safety, relevance, technical scope, prompt injection and supported input.

For requests that continue through the model path, Amazon Titan Text Embeddings retrieves the 20 closest previously validated examples. Cohere Rerank 3.5 on Amazon Bedrock narrows those to five, with exact or high-confidence matches eligible to reuse a known-good filter. The sixth stage selects the small subset of Sonar models relevant to the request and provides compact or detailed schema representations to the generator.

A tool-augmented agent then constructs and refines the filter using the selected schemas, examples and user context. Static syntax and semantic checks precede validation against Orca’s Sonar API. If the API identifies a faulty element, the error returns to the generator for a bounded retry; exhausted retries produce an invalid-filter response. The final stage post-processes valid filters produced by the deterministic, known-example or agentic paths.

AWS and Orca said Anthropic Claude Haiku 4.5 handles model selection and generation, while Amazon Nova 2 Lite performs guardrail and validator work. Titan supplies embeddings and Cohere Rerank 3.5 reranks retrieved examples. The companies said Orca chose Amazon Bedrock for access to several models through one API, AWS controls including IAM, VPC endpoints and CloudTrail, and the ability to change model versions without redesigning the pipeline.

Orca evaluates changes with a curated internal dataset spanning production question types, model families and complexity levels, according to the companies. They said an LLM-as-judge layer scores correctness, completeness and semantic equivalence, while product managers, support engineers and security researchers can flag queries and add corrected outputs to the example bank. Low-confidence production queries are routed to domain experts for daily labeling.

AWS and Orca said the system improved accuracy on complex, multi-model queries, but their account provides no accuracy baseline, rate or delta. Orca’s current cloud-security posture management page separately describes the ability to ask natural-language questions about a cloud environment, while its 2022 description of the Discovery query builder documents the earlier guided interface and Sonar product lineage.