Orca Security’s Discovery AI translates plain-language requests into validated Sonar filters, and AWS reports lower token use, cost and latency.
Orca Security has deployed Discovery AI, a natural-language agent that turns security questions into structured filters for its Sonar query system. In an AWS Machine Learning post published October 13, 2026, the companies said the production system handles thousands of queries daily and has been in use since March 2026.
AWS reports that, compared with Orca’s initial prototype, the deployed approach reduced input tokens by 93%, from about 2 million to 140,000 per comparable workload. Query costs fell 90%, while end-to-end response time declined 75%, from roughly 60 seconds to 15 seconds. The post says accuracy on complex, multi-model questions also improved, though it does not give a specific accuracy percentage.
The system addresses a schema challenge: Sonar covers more than 900 cloud infrastructure and application models, and its queries rely on precise model names, relationships and 18 operators. Rather than include the full schema in every prompt, Discovery AI retrieves relevant examples, selects only the models needed for a request, and generates a filter that is checked for syntax and meaning, including against Orca’s Sonar API.
Its nine-stage pipeline combines deterministic matching for recognizable identifiers with model-based screening, retrieval and generation. Amazon Titan embeddings retrieve 20 candidate examples, which Cohere Rerank 3.5 narrows to five. Anthropic Claude Haiku 4.5 powers model selection and filter generation; Amazon Nova 2 Lite handles guardrail screening and validation. AWS says the architecture also uses Bedrock governance features including IAM, VPC endpoints and CloudTrail.
Orca’s continuous evaluation harness checks changes to prompts, models and retrieval settings before release. A human review workflow lets domain experts correct low-confidence results and add examples to the retrieval bank, so later queries can use the corrections without a separate deployment. The reported improvements are comparisons with Orca’s own initial baseline, rather than a general benchmark of security-query systems.