Orca Security CNAPP Cloud Security Platform - GovCloud

I have used Orca Security  for one year while working for a client where we set up Orca Security  to scan our environment and identify vulnerabilities.

The main use case for using Orca Security is to identify vulnerabilities in our environment so that we can address them before any issues occur.

In one of our projects in GCP , we purchased Orca Security from the marketplace, which was enabled in our account at the organization level.

The main feature that I appreciated about Orca Security is that it is 100% agentless and context-aware, meaning it understands what it is doing.

The primary benefit is that it provides us with CVEs, through which I can identify the vulnerabilities in our security posture.

In the long run, as a security tool, it has helped us improve our security posture.

There is one issue that I encountered: when Orca Security provides CVEs and we attempt to implement its solutions, sometimes those solutions are not available on the cloud and cannot be implemented.

My main concern is the integration of Orca Security with generative AI for remediation inquiry.

Another concern I have is around the guardrails.

The primary improvement that Orca Security needs is to enhance its remediation steps based on the cloud platform being used.

I have been working in my current field for the past five or more years.

Orca Security has been stable in my experience.

Orca Security is internally based on cloud infrastructure and is 100% agentless, so it does not require significant scalability considerations.

Customer support is also good. I would rate it a 10 because they respond properly and communicate effectively.

Previously, I used to install an open-source tool to understand my security posture, which required some additional infrastructure investment.

I was using the native GCP  Security Command Center.

We purchased Orca Security from the AWS Marketplace .

I am aligned with the pricing, as it is not that costly.

I did evaluate open-source tools, Orca Security, native open-source tools, and cloud-native tools as well.

When Orca Security provides CVEs, clicking on them gives suggestions about what can be done to resolve the issue.

I would advise others to use Orca Security because of the rich features that it offers.

I would rate this review a 9.

Of my three customers, one is using Orca Security , and two are not using it. There are plenty of use cases available for Orca Security , and I can provide more details.

Orca Security is very good for faster management due to their CNAP, which stands for Cloud Native  Application Protection Platform. It consolidates CSPM, CWPM, CWPP , and CAEM, which includes entitlement management and vulnerability scanning. Orca Security consolidates these solutions into a single platform. If I buy Orca Security, I can check data-related security posture management across various domains, including security and multi-cloud compliance. We put security at the forefront rather than waiting until project completion to engage security. It is important to place security in the field, and Orca Security is a very good tool for that.

Orca Security is an agentless vulnerability scanner, meaning we do not need to run any agents. The first use case is for consolidating various solutions into one. The second use case is agentless vulnerability scanning, and the third use case is for multi-cloud security. Some customers might have different cloud environments that can lead to vulnerabilities if not carefully managed, especially in stringent scenarios like FedRAMP. Orca Security is quite effective in these aspects, particularly for government and semi-government scenarios.

Orca Security serves to analyze configurations against what is optimally used and identify gaps. It identifies when servers are underutilized. For example, if a server is supposed to be at least eighty-eight percent utilized and is running below one percent, that results in unnecessary costs. This gap analysis is something every synaptic tool, including Orca Security, supports for cost optimization.

Orca Security has improved our cloud security visibility, streamlined vulnerability management, reduced alert fatigue through risk-based prioritization, and helped us remediate critical issues faster while maintaining compliance across our cloud environments.

Orca Security excels in identifying risks. If posture management is configured well, the tool performs effectively in identifying risks. I appreciate the tool as it finds various issues. In today's AI era, we see many new challenges, including tool poisoning and broken paths, which Orca Security identifies effectively. The tool captures all the risks related to entitlement management as well, focusing on the segregation of duties to minimize risks.

We use AI across the cloud environment, which helps in automating and remediating issues while enabling organizations to connect fragmented data for faster investigations and prioritizing measurable risks. Orca Security has seven distinct positive risks, including token theft and command injections, which are vital for security posture management.

I think Orca Security should be more SMB friendly since I mostly work with enterprise customers who have more budget. Orca Security could include options for smaller businesses and improve on areas like agentless functionalities and cost efficiency for small-scale deployments.

I work in an SMB organization and find Orca Security quite expensive. They typically offer some credit periods to conduct proofs of value for various products.

For enterprises, I find Orca Security to be fairly priced, whereas it is a bit more expensive for SMBs.

Everything is around five years, and I have been using it for the whole thing because I have been in this field since nineteen ninety-five. All these tools are five years old, maximum of five to six years old. In fact, they were born during my tenure.

Yes, Orca Security is generally considered a stable and mature enterprise-grade CNAPP  (Cloud-Native Application Protection Platform) rather than an emerging startup product. However, stability can be viewed from three perspectives in my personal opinion, they are

1. Product Stability

2. Company Stability

3. Operational Stability

Yes. Scalability is actually one of the strongest differentiators of Orca Security  compared to traditional agent-based cloud security platforms.

Traditional CWPP  and EDR-style cloud security solutions require agents on every VM, Kubernetes  node, or workload. As organizations grow from hundreds to tens of thousands of cloud assets, agent deployment, upgrades, troubleshooting, and performance management become significant operational challenges.

Orca uses its patented Side Scanning™ technology to scan cloud workloads directly from cloud-provider storage snapshots and APIs without deploying agents. This means:

• No agent rollout projects
• No agent lifecycle management
• No performance impact on workloads
• New assets are automatically discovered and assessed

This architecture allows organizations to onboard large multi-cloud environments much faster than agent-centric solutions.

Orca supports:

• AWS 
• Azure 
• Google Cloud 
• Oracle Cloud 
• Alibaba Cloud 
• Kubernetes  environments

A large enterprise running thousands of subscriptions, accounts, projects, containers, and serverless workloads can manage them from a single platform and unified data model.

For organizations like:

• Global banks
• Telecom providers
• Retail giants
• SaaS companies

this becomes important because security teams do not need separate tools for CSPM, CWPP, CIEM , DSPM, vulnerability management, and container security.

One common scaling problem in cloud environments is asset churn:

• New VMs
• New Kubernetes clusters
• Auto-scaling groups
• Temporary containers
• Serverless  functions

Orca automatically discovers and monitors newly created cloud assets without requiring manual updates or security onboarding processes. This is particularly valuable in DevOps-heavy environments where infrastructure changes continuously.

Many enterprises end up with:

• Prisma Cloud
• Tenable
• Wiz 
• CrowdStrike
• Native  CSPM tools

all generating separate alerts.

Orca's Unified Data Model correlates:

• Vulnerabilities
• Misconfigurations
• IAM  risks
• Sensitive data exposure
• Attack paths

into a single risk graph. This helps maintain operational scalability because the security team is not overwhelmed as cloud assets increase.

Orca Security's technical support is very good, aligning with my consulting operations, and I have not received any escalations.

In identifying risks with previous products, there are notable pros and cons between agent-based and agentless solutions. Agentless tools eliminate orchestration concerns, while agent-based tools allow more granular control and calculations.

The initial setup is straightforward, but I find it a bit complex due to the learning curve involved, which requires thorough guidance during the first configuration.

Yes, many organizations use either Orca Security Professional  Services or partners such as Accenture, Deloitte, or Optiv  for deployment. The feedback is generally positive, with customers highlighting fast onboarding, minimal operational overhead due to the agentless architecture, and strong implementation support. Orca Professional  Services is often preferred for quicker deployments and product-specific expertise.

Regarding the time to value from Orca Security, if it is a SaaS setup, it is immediate. For larger solutions like ERP  or MSSP  setups, it can take more than six months. But for security scanning, it is shorter since we pay only for what we use.

Pricing was competitive for an enterprise-grade CNAPP  platform, and the agentless architecture helped minimize deployment and maintenance costs. Licensing was straightforward, and the time-to-value was relatively fast compared to other cloud security solutions.

Among competitors like Trend Micro and Cisco, I compare Orca Security with offerings from those vendors based on features and costs.

In terms of objectives, I need functionality without paying a luxury price. The features offered by some competitors may be attractive, but what counts most is that Orca Security provides essential functions with lower costs.

I cannot provide a straightforward answer about the time it takes to address cloud security alerts because different levels of alerts exist, and fixing each alert can vary depending on how alerts are configured. Policies play a crucial role in alert management.

If SaaS is available, customers prefer it due to low engagement compared to hybrid models. The cost savings on SaaS are quite attractive.

Orca Security's ability to combine functionalities of multiple tools into one platform is indeed one of its strongest points.

I would rate support at eight plus points. My personal rating for Orca Security as a service provider would be nine.

Orca Security  serves as a centralized solution within our organization that offers scanning of all issues found in our cloud accounts. We have AWS , Azure , and GCP , and Orca Security  identifies best practices we are not following or configurations that are not optimal. Orca Security automatically finds these issues and generates reports for us.

For example, if we have any EBS volumes or file systems which are not encrypted, Orca Security scans all cloud resources and detects such misconfigurations. These issues are then flagged in the report and we act on them accordingly.

The best feature I appreciate about Orca Security is its reporting functionality. The dashboard is very clear and concise, and it helps filter multiple accounts by issue type. Exporting the dashboard into an Excel sheet provides a good user experience.

To ensure we remain compliant, Orca Security's dashboard is really helpful in tracking the issues we have, with the end goal of always being compliant with our compliance standards and organizational requirements. It helps significantly with that.

Orca Security has helped our organization become compliant and maintain high standards because any organization with multiple products needs to be compliant, especially when it comes to underlying infrastructure and cloud resources. Orca Security helps tremendously in that regard.

Orca Security could benefit from more agentic workflows, where agentic workflows could be integrated with Orca Security to provide a quick view of large reports and issues we have. Additionally, data analytics capabilities could be improved.

I have been using Orca Security for the last five years.

Orca Security is quite stable.

Scalability is good. So far, we have not faced any issues related to scalability when using it or the underlying infrastructure on AWS . It is quite responsive and we have not encountered any issues. Orca Security provides a highly scalable architecture for us.

We have used only Orca Security.

We save a lot of time now. We have also implemented automations from our side so that people receive reports automatically, whether they are Orca Security IVM issues or Orca Security issues related to any resource. This has been really helpful.

We did not evaluate alternate solutions because this organization initiated Orca Security centrally. We do not have much control over it as I am just a user.

The advice I would give is that you can make good use of the issues depending on different organizational use cases. Try your best to have all Orca Security issues into one dashboard and then export them. Additionally, making it more AI-enabled would be beneficial because when you have multiple Excel sheets exported with all the data, that data can be visualized in a better way. I would rate this review a 9.