BuildNot yet confirmed elsewhere1 publisher2 min readPublished
Orca's 90% query cost cut is measured against a prompt holding 900-plus Sonar models
Orca Security cut query cost 90%, input tokens 93% and latency 75% in Discovery AI, its natural-language agent for Sonar queries on Amazon Bedrock. The baseline was a one-prompt proof of concept, so the savings transfer only to teams that start from one.
The Engineer · Build desk

Orca's proof of concept used roughly 2 million input tokens per workload; about 140,000 would remain if the 93% input-token reduction applies. Response time was around 60 seconds per workload in the proof of concept and 15 seconds in the deployed system.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Proof-of-concept input tokens per workload, roughly | 2,000,000 tokens | 3 | |
| Input tokens left per workload, about | 140,000 tokens | if the 93% cut applies to 2 million | 9 |
| PoC response, around | 60 seconds | 3 | |
| Deployed response time | 15 seconds | 5 |
What happened
- Each proof-of-concept workload took about 60 seconds end to end and roughly 2 million input tokens.
- Accuracy fell short on complex queries spanning several models, since queries with nested relationships or multiple conditions frequently had to be refined further.
- The production design is a nine-stage pipeline that combines retrieval-augmented generation with schema-aware query construction, with a Bedrock model matched to each stage.
- Orca says the deployed system handles thousands of queries per day at 15-second response times.
Why it matters
- cost Cost fell 3 points less than input tokens: 10% of baseline cost remains against 7% of baseline tokens. The post does not itemise the gap, so output tokens and the added calls of a nine-stage pipeline are where we'd look first, and we'd plan from the 90%.
- capability Because Bedrock exposes many models through one API, Orca could assign a different model to each stage and swap in newer versions without rearchitecting the pipeline, according to the post.
- constraint The three headline reductions cover cost, tokens and latency. The text we reviewed puts no percentage on accuracy, the third baseline problem the post names.
Every percentage here is relative to the first version, which put the full Sonar schema into one prompt on the largest available model: 900-plus model definitions, every relationship type and a generous set of example queries [2]. It worked. Design partners and internal users responded positively to the output quality [13]. The AWS post measures all three reductions against that starting point [12].
The figures are consistent with each other. A 75% cut from about 60 seconds is 15 seconds [10], and the post reports 15-second responses in production [5]. If the 93% applies to the 2 million input tokens per workload, each workload now sends about 140,000 [9].
For the numbers to transfer, your starting point has to resemble theirs. It sends the whole schema on every request, to the largest model, over a schema where most of what is sent is irrelevant to any one question. Orca's schema is that large: 900-plus models and 18 operators to choose from [1]. A team that already retrieves schema fragments, or already runs a mid-size model, begins nearer the floor and should expect a smaller gain.
The best piece of engineering in the excerpt is the second stage. The Quick Deterministic Matcher uses regex and rule-based matching to detect high-confidence patterns: IP addresses and URLs, CVEs, file hashes, alert IDs, and cloud resource identifiers such as ARNs, EC2 IDs, Amazon Machine Image IDs and Oracle Cloud Identifiers [7]. Each of those strings has a fixed format that regex can match. The portion of the post we reviewed ends mid-description of that stage, so what happens after a match, and what the later stages do, is not visible to us.
In our view this is the right design for a schema of this size. Nine stages is a lot of machinery to maintain [6], and a schema that fits comfortably in one prompt would not repay the maintenance.
What to watch
- A stage-by-stage cost breakdown that separates input tokens, output tokens and extra model calls would explain why cost fell 90% while input tokens fell 93%.
- An accuracy figure for complex multi-model queries in production would show whether the pipeline fixed the problem the proof of concept had.
- A comparison against a baseline that already retrieves schema fragments would show how much of the 90% survives outside a full-schema prompt.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption35
- Hype gap+30
- Incentives70
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Orca's tool covers over 900 cloud models, and querying that data required selecting from 18 operators.
ReportedSupportedSource: AWS Machine Learning blog post on Orca Security's Discovery AIView cited source - [2]
Orca's initial proof of concept loaded the full Sonar schema into a single prompt on the largest available model, including over 900 model definitions, every relationship type, and a generous set of example queries.
ReportedSupportedSource: AWS Machine Learning blog post on Orca Security's Discovery AIView cited source - [3]
The proof of concept consumed roughly 2 million input tokens per workload, with end-to-end response times of around 60 seconds per workload.
ReportedSupportedSource: AWS Machine Learning blog post on Orca Security's Discovery AIView cited source - [4]
Accuracy of the proof of concept on complex, multi-model queries was limited because nested relationships and multi-condition queries often required additional refinement.
ReportedSupportedSource: AWS Machine Learning blog post on Orca Security's Discovery AIView cited source - [5]
The deployed solution handles thousands of queries per day at 15-second response times using Amazon Bedrock.
ReportedSupportedSource: AWS Machine Learning blog post on Orca Security's Discovery AIView cited source - [6]
Discovery AI is a hybrid solution on Amazon Bedrock combining Retrieval Augmented Generation with schema-aware query construction, run as a nine-stage pipeline with each stage matched to the most appropriate Amazon Bedrock model.
ReportedSupportedSource: AWS Machine Learning blog post on Orca Security's Discovery AIView cited source - [7]
The pipeline's second step, the Quick Deterministic Matcher, uses regex and rule-based matching to detect high-confidence patterns such as IP addresses, CVEs, ARNs, file hashes, Amazon Machine Image IDs, Oracle Cloud Identifiers, EC2 IDs, URLs, and alert IDs.
ReportedSupportedSource: AWS Machine Learning blog post on Orca Security's Discovery AIView cited source - [8]
Amazon Bedrock provides multi-model access through a single API, letting the team allocate different foundation models to each pipeline stage, and the model-agnostic architecture let the team swap in newer model versions without rearchitecting the pipeline.
ReportedSupportedSource: AWS Machine Learning blog post on Orca Security's Discovery AIView cited source - [9]
If the 93% input-token reduction applies to the roughly 2 million input tokens per workload, about 140,000 input tokens per workload remain.
- [10]
A 75% latency reduction from about 60 seconds is 15 seconds, which matches the 15-second production response time the post reports.
- [11]
After the reductions, 10% of baseline cost remains against 7% of baseline input tokens, a ratio of about 1.4, so cost fell 3 percentage points less than input tokens.
- [12]
Orca reduced query costs by 90 percent, input tokens by 93 percent, and latency by 75 percent compared to the initial baseline.
ReportedContestedSource: AWS Machine Learning blog post on Orca Security's Discovery AIView cited source - [13]
The proof of concept's output quality was strong, and design partners and internal users responded positively.
ReportedInsufficientSource: AWS Machine Learning blog post on Orca Security's Discovery AIView cited source
Sources
1 independent publisher whose own reporting we read for this story.
- aws.amazon.comNatural language security queries at Orca Security using Amazon Bedrock
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Natural-language query generationFollow
- Retrieval-Augmented GenerationFollow
- Cloud SecurityFollow
- LLM Cost OptimizationFollow
Entities
- Orca SecurityFollow
- Amazon BedrockFollow
- Amazon Web ServicesFollow
- Discovery AIFollow
- Cohere Rerank 3.5Follow
- Amazon Titan Text EmbeddingsFollow