Orca Security CNAPP Cloud Security Platform - GovCloud

I have used Orca Security  for continuous cloud assessment visibility, identifying and prioritizing vulnerabilities and misconfigurations. I also monitor compliance against frameworks, whether it's NIST or SOC 2. Additionally, I use it for detecting cloud security risk and supporting incident response because it provides context around affected cloud resources.

Risk detection in Orca Security  is strong, mainly because it provides agentless visibility across the cloud environments I work in. My job involves identifying vulnerabilities, misconfigurations, identifying risk or exposed assets, and Orca Security does a great job helping to prioritize those risks on their potential business impact. It helps me align very well with the type of risk and the type of work I do in an AWS  environment.

I have used Orca Security's Cloud Cost Optimization feature in one of my recent projects to help identify underutilized cloud resources or cloud resources that have been idle for a long time. That feature allows me to identify those resources. My main focus is security, but I find it useful because if I'm able to see those resources that are not being used, I can adjust them. If I have to reduce their size, depending on what the case might be, or if I have to get it decommissioned, I can do so to help reduce unnecessary cloud spending while maintaining a secure environment. As much as my part of the job is security, I think overall, making sure that we are not just spending money on resources that we're not taking full advantage of is definitely a role that I would have to play. It also helps support conversations with the infrastructure team about balancing cost, performance, and security, to be able to get more data to have those conversations with those teams.

Regarding the Cloud to Dev feature, I personally have not used that. However, I do know about it. Orca Security has the capability to help developers identify and remediate security issues early in software development life cycles by connecting cloud risk back to the code, repositories, or development responsibility. Although I have not used it personally, I have had a conversation with the software team where it helps to bridge the gap between security and development by mapping cloud security findings back to relative code repositories and development teams. It makes it easier to identify root causes and prioritize remediation early in the development cycle, which helps with collaboration between engineers and the security team.

Orca Security has helped significantly to reduce the time it took to identify or prioritize cloud security alerts because of the way it provides a centralized view of risk and correlated findings across the cloud environment. Instead of manually investigating every alert, I am able to focus on high-risk issues first based on factors such as exposure, exploitability, or business impact. This definitely significantly improves response time and makes the remediation process more efficient. Taking that manual factor out of it overall reduces the time for everything.

Orca Security has been very helpful in preventing risks and attacks across my application life cycle by providing continuous visibility into the cloud workload. This also allows my team to prioritize and remediate issues before they could be exploited in production. It has also helped strengthen collaborations between security and development teams by providing actionable findings, which reduce the overall attack surface and improve security posture.

The features of Orca Security that stand out to me from my experience are that it allows agentless deployments. Since it is integrated into my AWS  environment, it gives me comprehensive visibility across my whole AWS environment. With that kind of visibility, I am able to detect vulnerabilities or misconfigurations. I can do risk prioritizations and compliance monitoring through that. These capabilities of Orca Security align closely with the work I do when it comes to vulnerability management or security, cloud security assessments, or even regulatory compliance. Those features help with my day-to-day activities.

Orca Security goes beyond just basic vulnerability detection when analyzing risks contextually and holistically. I think it adds a strong contextual understanding. Instead of treating each finding in isolation, it correlates risk across cloud assets, identities, network exposures, or workload configurations. That really helps provide a more holistic view of the attack path and potential business impact.

From my perspective, Orca Security is a really good tool. I would say one area I would like to see CNAPP  platforms get is more intelligence when it comes to risk prioritization, which correlates with vulnerability, exposing assets, identities, and active threats to help the security team focus on risks that are more likely to be exploited. I am a huge advocate for automation. I also think deeper automation for remediation or stronger integration with ticketing and CI/CD pipelines or more customization would help. Executive reporting would help the security team respond significantly faster and communicate risk more effectively if those kinds of improvements are made.

I have relatively hands-on experience with Orca Security for about three to four years. I have worked more hands-on with cloud security projects, and some of them are integrated with Orca Security.

I think the state of stability with Orca Security is impressive. It generally provides strong availability and scalability compared to a traditional on-premises security tool. I think the agentless part of it and the fact that it integrates directly with a cloud provider such as AWS helps to reduce operational overhead and potential points of failure that come with managing agents across multiple systems. From what I have seen, the architecture can support consistent visibility and create a very good, reliable risk detection across environments, even as a cloud workload scales.

Before Orca Security, I used different solutions for the same use cases because of my expertise in those areas. I have used Amazon Web Services Security Hub, IAM , native logging and monitoring tools, Nessus, and a lot of SIEM  platforms such as Splunk or QRadar. Overall, those tools together helped with vulnerability detection. They also helped with incident response or compliance monitoring and security alert triage. However, when it comes to more correlated data across multiple systems, Orca Security streamlines that by centralizing and correlating the risk all in one place.

With my previous agent-based solutions, I have encountered performance issues when identifying risks. The challenges came more with the scalability of risk analysis across the multiple tools. Each solution provided a valuable insight on its own. For example, Nessus for vulnerability scanning and Splunk or QRadar for log analysis. However, the main limitation was that the findings were often siloed because they are different platforms. That meant I had to do the manual correlation of the data across the different platforms to understand the full context of the risk, which could slow down triage or investigation overall, especially if I was working with a larger environment with higher volume alerts.

Before Orca Security, I used different solutions for the same use cases because of my expertise in those areas. I have used Amazon Web Services Security Hub, IAM , native logging and monitoring tools, Nessus, and a lot of SIEM  platforms such as Splunk or QRadar. Overall, those tools together helped with vulnerability detection. They also helped with incident response or compliance monitoring and security alert triage. However, when it comes to more correlated data across multiple systems, Orca Security streamlines that by centralizing and correlating the risk all in one place.

With my previous agent-based solutions, I have encountered performance issues when identifying risks. The challenges came more with the scalability of risk analysis across the multiple tools. Each solution provided a valuable insight on its own. For example, Nessus for vulnerability scanning and Splunk or QRadar for log analysis. However, the main limitation was that the findings were often siloed because they are different platforms. That meant I had to do the manual correlation of the data across the different platforms to understand the full context of the risk, which could slow down triage or investigation overall, especially if I was working with a larger environment with higher volume alerts.

I did not participate in the initial setup and installation process of Orca Security personally. When I joined the team, it was already set up. I was not directly involved in the initial installation or setup. However, in my previous role, I did support some onboarding of other tools. I have a good understanding of how certain platforms are implemented or operationalized in an enterprise environment, but I did not set up Orca Security that I work with now.

This is somewhat out of my scope because I do not see the exact pricing structure of Orca Security. However, from what I know through research, I think it is good. I think it is fair pricing in my opinion. I have that in place of multiple tools. Orca Security kind of replaces multiple tools that help improve efficiency. So when it comes down to it, if it is cost-effective in terms of overall security operation, I think the price point is reasonable. However, I do not know the exact amount or the exact pricing.

That personally would not be a decision I made before choosing Orca Security. However, I have been collaborating with a bunch of other people in my team, and I think they have considered other options. Depending on what the environment is being used for and the use case in general, they like to look for something that will mix with cloud-native tools. Any third-party solution, whether it is Prism Cloud or Wiz , is something that I have heard of. However, the decision usually comes down to factors such as coverage across the multi-cloud environment or how easily it is to deploy or signal-to-noise ratio. Many factors come in before selecting what CNAPP  they want to get. I feel that across everything, Orca Security stands out. The main thing that many people appreciate is the agentless visibility and the contextual risk prioritization, which is a good benefit that it has over competitors.

Regarding Orca  Sensor, I personally have not used it, but I do know of it. I have not used it directly, but my experience has been more about how it collaborates with the AWS environment, which is my strong field. However, I know it has been useful when deploying sensors and agents. I do not know how in-depth that goes because I have never done that personally, but I still feel that overall, it does what it needs to do. It still provides visibility into workloads and vulnerabilities, whether it is misconfigurations or exposed assets, in whatever environment they are running it in.

I have used the official documentation offered by Orca Security a few times. I have used the documentation and guidelines in the context of IAM  management workflows, particularly around single sign-on, multi-factor authentication, and user provisioning. The documentation from Orca Security is structured really properly. It got all the points across really great. It made it easy for me to read and understand. It was very straightforward. I was able to understand what was put across in the documentation without having to do multiple research or over-explanation. I appreciate that.

I would rate this review as an eight out of ten.

My main use case for Orca Security  is cloud security posture management for our cloud in the company.

A specific example of how I use Orca Security  for cloud security posture management is that we connect Orca Security to our main cloud providers, it scans all of the configurations, and it lets us know if we have risks in our configurations and how to mitigate them, and also it helps us to prioritize those risks.

I would also like to add that we are evaluating using Orca Security for scanning Infrastructure as Code  and scripts.

In my opinion, the best features Orca Security offers include the integration to our cloud services, which is smooth, easy, and plug and play, along with its effectiveness in prioritizing risks, taking into account all of the different factors that make a risk—not only vulnerabilities but also if you have sensitive data or if you have your cloud resources exposed, giving you the risk based on that context, which helps you to prioritize the risks to know where to mitigate first.

This has changed the way my team works and responds to threats because it saves us a lot of time and helps us to focus on the real risk rather than all of the alerts that we receive, as we have a lot; therefore, we cannot fix everything and need to prioritize, making the way that Orca Security prioritizes the risks key for us.

Orca Security has impacted my organization positively by giving us visibility on what is happening in the cloud and helping us detect risks fast. Before Orca Security, we did not have that visibility, and we had to manually check our cloud to understand if we had risks. Today, with Orca Security, we are comfortable and feel that we have the visibility that we need in the cloud to be sure that we do not have risks there.

I would add that the CDR, the Cloud Detection and Response that Orca Security offers, could be improved as it is not the best functionality that it offers. Orca Security is good at posture, but not at the response and alerting in real time.

Orca Security can be improved as it is very good at posture, but it does not detect attacks or behavioral attacks in the cloud on its own; it depends on other security features or logs like GuardDuty from Amazon, lacking its own intelligence to detect and respond to attacks.

Additionally, it could be useful if Orca Security has more context on the network and how the resources are exposed. For example, it could take into account that we have a firewall in front of an S3  in Amazon and understand that we do not have so much risk there because of that firewall, incorporating the network topology context, which today does not function as it should.

I have been using Orca Security for three years.

In my experience, Orca Security is stable.

Orca Security's scalability is quite good; it scales smoothly, and adding more resources or clouds is easy.

Orca Security's customer support is not very good. We are practically alone; we do not use the support, and they are not very responsive.

I did not previously use a different solution for cloud security.

My experience with pricing, setup cost, and licensing is good. The costs are reasonable, licensing is clear, and the renewal process is good.

We do not see a return on investment in that way; rather, we see that we improve our risk posture, as we have detected risks that without Orca Security, we would not have detected. In that sense, I can say that it mitigates risks, but I do not have a metric on that.

We do not have specific metrics; however, I can say that in the past, it took us two to three hours a week to do manual checks, whereas today with Orca Security, we just check the dashboard for ten minutes a day and that is all.

Before choosing Orca Security, I evaluated other options, specifically Wiz .

My advice to others looking into using Orca Security is to access the console every day to see if you have risks, to try to stay close to customer support to understand new features, and to not rely on the CDR because it is not very effective. I rated this product an eight out of ten.