Skip to content

BuildNot yet confirmed elsewhere1 publisher2 min readPublished

Orca's 90% query cost cut is measured against a prompt holding 900-plus Sonar models

Orca Security cut query cost 90%, input tokens 93% and latency 75% in Discovery AI, its natural-language agent for Sonar queries on Amazon Bedrock. The baseline was a one-prompt proof of concept, so the savings transfer only to teams that start from one.

The Engineer · Build desk

How we use AISend a correction

Illustration accompanying Orca's 90% query cost cut is measured against a prompt holding 900-plus Sonar models
Generated illustration
Each workload's tokens and wait time fall Input tokens and response time per workload: Orca's proof of concept against the deployed system, per the AWS Machine Learning blog post.

Orca's proof of concept used roughly 2 million input tokens per workload; about 140,000 would remain if the 93% input-token reduction applies. Response time was around 60 seconds per workload in the proof of concept and 15 seconds in the deployed system.

Each workload's tokens and wait time fall
FigureValueNoteClaim
Proof-of-concept input tokens per workload, roughly2,000,000 tokens3
Input tokens left per workload, about140,000 tokensif the 93% cut applies to 2 million9
PoC response, around60 seconds3
Deployed response time15 seconds5

What happened

  • Each proof-of-concept workload took about 60 seconds end to end and roughly 2 million input tokens.
  • Accuracy fell short on complex queries spanning several models, since queries with nested relationships or multiple conditions frequently had to be refined further.
  • The production design is a nine-stage pipeline that combines retrieval-augmented generation with schema-aware query construction, with a Bedrock model matched to each stage.
  • Orca says the deployed system handles thousands of queries per day at 15-second response times.

Why it matters

  • cost Cost fell 3 points less than input tokens: 10% of baseline cost remains against 7% of baseline tokens. The post does not itemise the gap, so output tokens and the added calls of a nine-stage pipeline are where we'd look first, and we'd plan from the 90%.
  • capability Because Bedrock exposes many models through one API, Orca could assign a different model to each stage and swap in newer versions without rearchitecting the pipeline, according to the post.
  • constraint The three headline reductions cover cost, tokens and latency. The text we reviewed puts no percentage on accuracy, the third baseline problem the post names.

Every percentage here is relative to the first version, which put the full Sonar schema into one prompt on the largest available model: 900-plus model definitions, every relationship type and a generous set of example queries [2]. It worked. Design partners and internal users responded positively to the output quality [13]. The AWS post measures all three reductions against that starting point [12].

The figures are consistent with each other. A 75% cut from about 60 seconds is 15 seconds [10], and the post reports 15-second responses in production [5]. If the 93% applies to the 2 million input tokens per workload, each workload now sends about 140,000 [9].

For the numbers to transfer, your starting point has to resemble theirs. It sends the whole schema on every request, to the largest model, over a schema where most of what is sent is irrelevant to any one question. Orca's schema is that large: 900-plus models and 18 operators to choose from [1]. A team that already retrieves schema fragments, or already runs a mid-size model, begins nearer the floor and should expect a smaller gain.

The best piece of engineering in the excerpt is the second stage. The Quick Deterministic Matcher uses regex and rule-based matching to detect high-confidence patterns: IP addresses and URLs, CVEs, file hashes, alert IDs, and cloud resource identifiers such as ARNs, EC2 IDs, Amazon Machine Image IDs and Oracle Cloud Identifiers [7]. Each of those strings has a fixed format that regex can match. The portion of the post we reviewed ends mid-description of that stage, so what happens after a match, and what the later stages do, is not visible to us.

In our view this is the right design for a schema of this size. Nine stages is a lot of machinery to maintain [6], and a schema that fits comfortably in one prompt would not repay the maintenance.

What to watch

  • A stage-by-stage cost breakdown that separates input tokens, output tokens and extra model calls would explain why cost fell 90% while input tokens fell 93%.
  • An accuracy figure for complex multi-model queries in production would show whether the pipeline fixed the problem the proof of concept had.
  • A comparison against a baseline that already retrieves schema fragments would show how much of the 90% survives outside a full-schema prompt.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence40
Adoption35
Hype gap+30
Incentives70
Confidence60
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Orca's tool covers over 900 cloud models, and querying that data required selecting from 18 operators.

    ReportedSupportedSource: AWS Machine Learning blog post on Orca Security's Discovery AIView cited source
  2. [2]

    Orca's initial proof of concept loaded the full Sonar schema into a single prompt on the largest available model, including over 900 model definitions, every relationship type, and a generous set of example queries.

    ReportedSupportedSource: AWS Machine Learning blog post on Orca Security's Discovery AIView cited source
  3. [3]

    The proof of concept consumed roughly 2 million input tokens per workload, with end-to-end response times of around 60 seconds per workload.

    ReportedSupportedSource: AWS Machine Learning blog post on Orca Security's Discovery AIView cited source

Sources

1 independent publisher whose own reporting we read for this story.

  1. aws.amazon.com

    1 article · October 13, 2026

    Natural language security queries at Orca Security using Amazon Bedrock

Share your take

Let Clarity write the post for you.

Signed-in readers get a short post drafted on this story in the register they choose — narrative, analytical, or a direct position — editable to the last word before it goes anywhere. The share buttons at the top of this story work without an account.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Entities

Loading related stories