Answers the question: **"Tell me everything about this asset in one place."**

Answers the question: **"Where are we failing, what's the fastest path to improve, and who owns the worst gaps?"**

Answers the question: **"How do I create a custom compliance framework tailored to my organization's specific security requirements?"**

Answers the question: **"What can an attacker see from outside, and what's the easiest way in?"**

Answers two questions: 1. **"If I fix this, what else closes?"** — alerts, attack paths, compliance controls resolved 2. **"If I fix this, what might break?"** — production workflows, automation, and services that depend on the current (insecure) state

Answers the question: **"What happened, who did it, and how far did they get?"**

Cloud cost optimization analysis using Orca Security asset data. Discovers all cloud assets (AWS, GCP, Azure) through Orca MCP tools, compares current configurations against cheaper alternatives using live public pricing, and produces a prioritized cost reduction report with exact asset evidence. Use when the user asks about cloud cost optimization, reducing cloud spend, rightsizing instances, saving money on cloud infrastructure, cost reduction opportunities, unused resources, oversized VMs, reserved instances, storage tiering, or wants to know what changes would lower their cloud bill.

Traces any Orca alert back to who deployed it, what tool was used, what introduced the issue, and a full timeline of events. Use when user asks about origin, deployment, or ownership of an alert (e.g., "who created this", "where did this come from", "trace back orca-3380725", "who deployed", "what tool was used").

Analyzes any cloud identity for overprivileged access, actual usage patterns, lateral movement risk, and least-privilege recommendations. Use when user asks about identity permissions, overprivileged access, or IAM review (e.g., "identity review for anika", "is this role overprivileged", "review permissions", "IAM analysis").

Daily security briefing summarizing new critical alerts, attack paths, compliance drift, exposure changes, and aging unactioned alerts from the last 24-72 hours. Use when user asks for a briefing, summary, or overview (e.g., "morning briefing", "what happened", "security summary", "daily report", "what needs attention").