Orca Security Builds Discovery AI on Amazon Bedrock
Orca Security has launched Discovery AI, a natural language query agent built on Amazon Bedrock designed to translate plain-English security questions into precise Sonar queries.
Radwan AbdulhadiEditor and technology writer
Bridging Natural Language and Cloud Security
Security analysts often require rapid insights into their cloud infrastructure without needing deep familiarity with domain-specific query languages. The Sonar query system at Orca Security covers over 900 cloud models, including resource types such as Amazon Elastic Compute Cloud instances and Amazon Simple Storage Service buckets. Querying this data traditionally demanded precise model names, nested relationship navigation, and the selection of specific operators from a set of 18 comparison functions.
To address these complexities, the team at Orca Security partnered with AWS to develop a natural language interface that converts plain text into valid queries. Their initial proof of concept loaded the full Sonar schema into a single prompt on a large model, which yielded strong output quality but encountered operational hurdles at production scale.
Overcoming Production-Scale Limitations
While the initial proof of concept demonstrated that the concept worked, three major drawbacks emerged during testing. Token consumption reached roughly 2 million input tokens per workload, driving up operational expenses. Furthermore, end-to-end response times averaged around 60 seconds per workload, and accuracy on complex, multi-model queries required additional refinement.
To make the solution cost-effective, fast, and accurate enough for production, the engineering team designed a hybrid solution capable of handling thousands of queries daily with 15-second response times.
The Multi-Stage Pipeline Architecture
Discovery AI utilizes a hybrid architecture on Amazon Bedrock that integrates Retrieval Augmented Generation with schema-aware query construction. The system processes requests through a multi-stage pipeline, allocating the most appropriate foundation model to each specific stage without requiring separate integrations.
The pipeline begins with request entry and context setup, followed by a quick deterministic matcher that identifies structured inputs like IP addresses, CVEs, ARNs, and alert IDs using regex and rule-based matching. An LLM guardrail screening component then checks the request for safety, relevance, and prompt injection attempts before semantic candidate recall retrieves relevant validated queries.
Semantic Reranking and Agentic Generation
Retrieved candidates undergo neural relevance reranking using embedding models to identify the highest-signal examples for the current request. Model selection then narrows down the extensive list of Sonar models to a small set relevant to the user request, utilizing compact schemas to reduce unnecessary context.
Following model selection, a tool-augmented agentic filter generator constructs the final query. This agent reasons over the selected model schemas, retrieved examples, user context, and available tools, iteratively refining the filter until it accurately represents the user request.
Validation and Performance Results
Before execution, generated filters pass through static and API-backed validation steps to check for syntactic and semantic correctness against the Sonar API. If validation fails, the error is returned for correction, ensuring that only valid queries are executed against the underlying infrastructure.
Through this optimized multi-stage architecture on Amazon Bedrock, Orca Security achieved significant performance improvements compared to its initial baseline. The company reported a 90 percent reduction in query costs, a 93 percent decrease in input tokens, and a 75 percent drop in latency.
Sources
- AWS Machine Learning BlogNatural language security queries at Orca Security using Amazon Bedrock
Continue chronologically
Related entity coverage
Related stories
Tamnoon Builds AI Cloud Remediation With Amazon Bedrock
Learn how Tamnoon built Tami, an agentic cloud remediation orchestrator on Amazon Bedrock to investigate and fix security findings.
Building Agentic Retrieval on Amazon Bedrock with AWS CDK
Learn how to build enterprise agentic retrieval on a Managed Amazon Bedrock Knowledge Base using the AWS CDK and Amazon Bedrock AgentCore.
Circle K Cuts DevOps Incident Triage Times With Amazon Bedrock
Circle K's DevOps team accelerated incident triage from up to 60 minutes down to under 15 minutes by implementing an agentic AI system on Amazon Bedrock.
Managing Amazon Bedrock Costs: A FinOps Playbook
Explore an end-to-end operational model for FinOps and platform teams to manage, attribute, and optimize Amazon Bedrock generative AI costs.
