AWS Releases Discovery AI: A Natural Language Security Query System Powered by Amazon Bedrock

Summary:AWS, in collaboration with Orca Security, has launched Discovery AI, a natural language query agent built on Amazon Bedrock that converts plain-English questions into Sonar queries. The system features a multi-stage architecture that achieves a 90% reduction in query costs, a 93% decrease in input tokens, and a 75% improvement in latency compared to the initial baseline. Discovery AI leverages Retrieval Augmented Generation (RAG) and schema-aware query construction, utilizing various Amazon Bedr

---

Core Breakthrough

AWS, in collaboration with Orca Security, has launched Discovery AI, a natural language query agent built on Amazon Bedrock. This system aims to address the complexity of querying in cloud security analysis by converting plain-language questions into Sonar queries, thereby significantly enhancing query efficiency and lowering the barrier to entry for users.

Technical Mechanism Analysis

Discovery AI employs a multi-stage architecture that combines Retrieval Augmented Generation (RAG) with schema-aware query construction. The core process involves the following nine steps:

1. Request Entry and Context Setup: Combines the user's natural language request with relevant context, such as organizational information and connected cloud providers, to help the system accurately interpret the request.
2. Quick Deterministic Matcher: Uses regex and rule-based matching to identify structured inputs (e.g., IP addresses, CVE numbers) and quickly return predefined Discovery filters.
3. LLM Guardrail Screening: Checks the request for safety, relevance, technicality, and supportability, blocking potential prompt injections, off-topic requests, and unsupported inputs.
4. Embedding-Based Semantic Similarity Retrieval: Utilizes Amazon Titan text embedding to retrieve the 20 most similar examples from the vector store based on semantic similarity.
5. Neural Relevance Reranking: Reranks the retrieved candidates using Cohere Rerank 3.5 to select the five most relevant examples.
6. LLM-Driven Relevant Model Selection: Narrows down the 900+ Sonar models to a small set relevant to the request and provides the appropriate schema details to the generator.
7. Tool-Augmented Agentic Filter Generation: The generator uses a tool-augmented agent to build the final Discovery filter, reasoning over the selected model schemas, retrieved examples, user context, and available tools.
8. Static and API-Backed Validation: Checks the generated filter for syntactic and semantic correctness, first applying static validation and then verifying it against Orca's Sonar API.
9. Post-Processing and Response: Prepares the final response after a valid filter is produced.

Engineering Trade-offs and Performance

Discovery AI achieves performance optimization through the following:

• Cost Reduction: Reduces query costs by 90% by decreasing input token usage and optimizing model allocation.
• Latency Improvement: Decreases end-to-end response time from 60 seconds to 15 seconds, achieving a 75% reduction in latency.
• Accuracy Enhancement: Achieves significant improvements in the accuracy of complex multi-model queries through continuous evaluation and refinement.

Developer Implementation and Deployment Recommendations

For developers looking to build similar solutions, here are some recommendations:

• Leverage Amazon Bedrock: Amazon Bedrock provides a multi-model access interface, simplifying the integration and management of different models.
• Optimize Retrieval Strategies: Use hybrid retrieval strategies (e.g., top-K semantic search combined with MMR or reranking) to effectively enhance retrieval quality and diversity.
• Implement Continuous Improvement Mechanisms: Establish continuous evaluation and feedback mechanisms, involving domain experts and automated scoring systems to continuously optimize the system.
• Ensure Security: Incorporate security measures, such as guardrail screening and validation mechanisms, to ensure system safety and reliability.

Conclusion

Discovery AI demonstrates the powerful application potential of natural language processing technology in the field of cloud security. By combining RAG, schema-aware query construction, and various Amazon Bedrock models, Orca Security has successfully transformed a prototype system into an efficient, accurate production-grade solution, providing a new technological path for cloud security analysis.

---

Source: AWS Machine Learning Blog (2026-10-13)

— END —

Tags: #AWS Follow #Amazon Bedrock Follow #Natural Language Processing Follow #Intelligent Agents Follow #AI Security Follow