Sold by: Orca Security CNAPP
Deployed on AWS
Free Trial
Vendor Insights
Quick Launch
Agentless Cloud Security in a Single, Complete Platform with 100% Coverage
4.7
Overview
Orca Security is the true Cloud Native Application Protection Platform (CNAPP) that identifies, prioritizes, and remediates risks and compliance issues across all of your workloads, configurations, and identities on AWS. Orca offers the industrys most comprehensive cloud security solution in a single platform, eliminating the need to deploy and maintain multiple point solutions.
FAST TIME TO VALUE: The Orca CNAPP Platform is agentless first, and connects to your environment in minutes using patented SideScanning™ technology that provides deep and wide visibility into your cloud environment, without requiring agents. In addition, Orca offers a lightweight agent for organizations that require real-time protection for critical workloads.
RISK PRIORITIZATION: Orca effectively prioritizes risks by applying a granular risk score to each alert, and recognizes when seemingly unrelated issues can be combined to create dangerous attack paths straight to your crown jewels.
FULL SDLC SECURITY: The Orca platform shifts security left by seamlessly integrating into the CI/CD process so that applications can be secured from code to cloud and back.
AI-POWERED: Orca is at the forefront of leveraging Generative AI for simplified investigations and accelerated remediation, reducing required skill levels and saving cloud security, DevOps, and development teams time and effort, while significantly improving security outcomes.
PURPOSE-BUILT CNAPP: Orca unifies many different point solutions in one platform, including CSPM, CWPP, CIEM, DSPM, Container security, API security, AI-SPM, and much more.
Sign up for a demo to uplevel your cloud security and get the fastest time to value available in the industry: https://orca.security/demo/
Additional platform licensing options are not shown in this listing but are available via Private Offer. Please email aws@orca.security .
Highlights
- Visibility to all your IAAS and PAAS assets including EC2, Containers, S3 buckets using account level read only permissions
- Detect compromises, vulnerabilities and risky configuration within minutes
- No impact on your assets, grows automatically with your cloud account
Get personalized pricing in minutes - New
If qualified, an express private offer gets you custom pricing and terms. Finalize your purchase in the AWS Marketplace console.
Details
Sold by
Categories
Delivery method
Deployed on AWS
Features and programs
Trust Center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Quick Launch
Leverage AWS CloudFormation templates to reduce the time and resources required to configure, deploy, and launch your software.
Skip the manual risk assessment. Get verified and regularly updated security info on this product with Vendor Insights.
Security credentials achieved
(2)
ISO27001
AWS Security Specialization
Pricing
Free trial
Try this product free according to the free trial terms set by the vendor.
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/month |
|---|---|---|
Small | Small starter pack of concurrent workloads (EC2) per month | $7,000.00 |
Small-Medium | Small-Medium starter pack of concurrent workloads (EC2) per month | $12,000.00 |
Medium | Medium starter pack of concurrent workloads (EC2) per month | $17,000.00 |
Large | large starter pack of concurrent workloads (EC2) per month | $30,000.00 |
Dimensions summary
This contract offers four starter packs sized by the number of concurrent workloads you protect. Each pack covers running EC2 hosts on a monthly basis. The Small, Small-Medium, Medium, and Large packs differ only by how many concurrent workloads they include. You pick the pack that matches your host count, then scale up to a bundle with more capacity as your environment grows. All packs bill under the same contract term and cover the same agentless cloud security platform.
Top-of-mind questions for buyers
A workload here maps to a running EC2 host you protect during the month. Each starter pack covers a set number of these concurrent hosts. The platform also discovers idle, paused, and stopped workloads, but the packs are sized by the count of concurrent hosts you run.
You choose the pack matching your current concurrent host count. As your environment grows, you move to a pack that includes more concurrent workloads. Each pack sets its own included capacity, so scaling up means selecting a bundle with a higher host count.
The packs are sized by concurrent workloads, meaning running EC2 hosts during the month. The platform still discovers and monitors idle, paused, and stopped workloads for security coverage. For exact counting of non-running states against your pack, confirm with the vendor.
orca.security+1
Helpful?
Vendor refund policy
Contact us
Custom pricing options
Request a private offer to receive a custom quote.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Support
Vendor support
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Orca Security CNAPP
By Aqua Security Software Inc.
Top
10
In Monitoring, Application Development
Top
25
In Observability, Software Development
Top
10
In Container Workloads
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Agentless Cloud Security Architecture
Agentless-first approach using patented SideScanning technology that provides deep visibility into cloud environments without requiring agent deployment
Risk Prioritization and Attack Path Analysis
Granular risk scoring applied to each alert with capability to identify and correlate seemingly unrelated issues into dangerous attack paths
Unified Cloud Security Platform
Single platform consolidating multiple security functions including CSPM, CWPP, CIEM, DSPM, Container security, and API security
CI/CD Integration for Application Security
Seamless integration into CI/CD process to secure applications from code to cloud deployment
AI-Powered Investigation and Remediation
Generative AI capabilities for simplified security investigations and accelerated remediation workflows
Offensive Security Engine
Simulates external exploits to produce Verified Exploit Paths for prioritizing exposures that are reachable by outside attackers and reducing cloud attack surface.
Cloud Security Posture Management
Continuously monitors and manages security of AWS configurations to prevent public exposure and ensure compliance.
Secrets Scanning
Identifies more than 750 types of secrets across public and private repositories.
Cloud Infrastructure Entitlements Management
Detects and manages excessive or unused permissions to mitigate the risk of privilege escalation.
Real-Time Malware Detection
Detects malware including zero-days in milliseconds with scanning performed directly in cloud environment for object storage services like Amazon S3 and file storage services.
Multi-Workload Security Coverage
Unified platform securing containers, serverless, Kubernetes, and AI workloads across AWS, on-premises, and multi-cloud environments
Runtime Threat Detection and Enforcement
Runtime protection to detect threats, block malicious activity, and enforce compliance in production across all cloud native workloads
AI and LLM Security Governance
Purpose-built AI workload security to govern large language models and generative AI applications with model abuse detection and policy enforcement
Full Lifecycle Security
Security coverage across the entire software development lifecycle from code development through production deployment
Compliance and Authorization Standards
FedRAMP High authorization enabling compliance with rigorous security and regulatory standards
Validated by AWS Marketplace
FedRAMP
GDPR
HIPAA
ISO/IEC 27001
PCI DSS
SOC 2 Type 2
-
-
-
-
-
No security profile
-
-
-
Standard contract
No
No
No
Customer reviews
Yagmi M.
Orca Makes Shadow Data Risks Obvious with Clear Sensitive Data Discovery
Reviewed on Aug 03, 2026
Review provided by G2
What do you like best about the product?
There was a recurring problem with shadow data: production data getting copied into staging and dev accounts that were nowhere near as locked down, plus data stores nobody even remembered creating. Orca discovers sensitive data across managed, unmanaged, and shadow stores, including files on VMs, containers, and buckets, and then classifies it against categories like PII and payment data. Seeing a forgotten production snapshot sitting in a loosely controlled dev account, and having that tied to how exposed the account was, makes it obvious which copies are genuinely risky versus intentional.
What do you dislike about the product?
A bit of tuning was needed to distinguish sanctioned data copies from the risky ones, since some of the lower-environment data was there on purpose. That said, the configuration was quick to align with our internal workflows.
What problems is the product solving and how is that benefiting you?
It provides real visibility into sensitive data sprawl, including shadow data and misplaced data, so the gap between well-secured production and looser accounts stops being an invisible exposure. It also highlights where AI agents could run into sensitive data they should never be able to touch, turning those risky paths into concrete cleanup work.
Nelson A.
Orca Adds Exposure Context That Makes Host Vulnerability Prioritization Easy
Reviewed on Aug 02, 2026
Review provided by G2
What do you like best about the product?
A lot of attention goes to containers these days, but there are still plenty of VMs and long-lived hosts, and those were exactly where our old scanning was the patchiest. Orca covers them in the same model as everything else, showing which host vulnerabilities sit on internet-facing machines, which are tied to privileged identities, and which are genuinely reachable versus buried behind existing controls. That added context lets us prioritize host patching based on real exposure instead of relying on raw CVSS scores.
What do you dislike about the product?
A couple of the older hosts had the usual configurations that warranted a closer look, but the underlying findings were sound, and the added context made them straightforward to interpret.
What problems is the product solving and how is that benefiting you?
It closed the gap between our modern container coverage and our older VM estate. As a result, host risk is no longer prioritized on severity scores alone, but on how exposed it actually is. It also helps us understand when host and VM risk could affect the infrastructure supporting AI agents, or the systems those agents depend on.
Saran K.
Orcca Delivered Rapid Visibility Into AI Agent Risks
Reviewed on Aug 02, 2026
Review provided by G2
What do you like best about the product?
Our business moves fast. Developers, analysts, and PMs are constantly shipping, and AI agents are woven into many of those workflows. We needed visibility that could keep up with that pace—not a slow rollout that would still be incomplete by the time the next agent went live.
Orcca connected to our cloud account, and within days it gave us a real risk picture, including the AI agents: the identities they run as, the endpoints they expose, and the data they could touch. We didn’t have to chase teams to get a clear understanding of our agent services.
Orcca connected to our cloud account, and within days it gave us a real risk picture, including the AI agents: the identities they run as, the endpoints they expose, and the data they could touch. We didn’t have to chase teams to get a clear understanding of our agent services.
What do you dislike about the product?
The main follow-on work was organizing the findings to match how our teams and business units are structured, including grouping agents by owner and function. That organizational step has made ongoing reviews much clearer for leadership.
What problems is the product solving and how is that benefiting you?
This removed the usual deployment barrier and gave us AI agent visibility before we could normally even finish planning the rollout. That speed matters even more as agents and their workflows appear across the state, because they become visible and governable as quickly as teams create them.
Cathrine S.
Orca’s Attack Path View Transformed How We Prioritize Fixes
Reviewed on Jul 29, 2026
Review provided by G2
What do you like best about the product?
The thing that really changed how we work is the attack path view. Instead of a list of separate findings, Orca shows the full chain: an exposed asset, the vulnerability on it, the identity it can assume, and the sensitive data at the end of that path. Seeing the entire route makes it obvious which single fix can break the whole chain, so we stopped trying to patch everything and started cutting the links that actually matter.
What do you dislike about the product?
In a large environment, the attack path graphs can hold a lot of detail, so we found it most effective to scope to the crown jewel assets first. Once we did that, the overall picture became clear and genuinely useful.
What problems is the product solving and how is that benefiting you?
It moved us from simply counting vulnerabilities to reasoning about exploitable routes, which is a much better use of a small team’s time. It’s especially valuable when AI agents sit somewhere along that route, because we can see how the agents access identities and how the data paths factor into the real chain an attacker could follow. As a result, we fix fewer things, but we reduce the more real risk.
Guilherme Ferreira Mury
Integrated devsecops practices have prevented vulnerabilities across the application lifecycle
Reviewed on Jul 29, 2026
Review provided by PeerSpot
What is our primary use case?
In my previous experience with Orca Security, I was working on the DevSecOps model, mainly using it for CI/CD pipelines, scanning our repositories for identifying vulnerabilities and breaking the build of the project if there are any high or critical vulnerabilities.
Prioritizing risks using Orca Security is straightforward; it has many tools for assessing and prioritizing risk, including CVSS for all vulnerabilities and the Orca Score that considers the whole context of each vulnerability, helping me understand the true risk and impact.
We had experience with the Orca Sensor, but we did not think it brings too much value to our current environment, so we decided to remove it.
I have used the Cloud to Dev feature in Orca Security before, but not as much as other features such as the DevSecOps model.
How has it helped my organization?
Orca Security has helped me in preventing risks and attacks across my application life cycle by being the base of the whole secure development life cycle I implemented in my previous experience, which was crucial for detecting vulnerabilities both in development and runtime.
What is most valuable?
What I appreciate the most about Orca Security are the AI features for solving false positives and tackling some cases that are not entirely clear for my team, which helped greatly for investigating and dealing with those situations and proved to be highly accurate.
What needs improvement?
Some visualizations and dashboards in Orca Security were not as clear to me; even though I can edit and modify them as much as I prefer, the dashboards that came with the application were not ideal.
There are not many negative aspects about Orca Security; I think it is a solid solution and the issue with the dashboards is more of a design preference of mine, so I am not certain if it qualifies as a downside.
For how long have I used the solution?
I have been working with Orca Security for around one to one and a half years.
What do I think about the stability of the solution?
I have not experienced any lagging, crashing, downtime, or any sort of instability with Orca Security.
What do I think about the scalability of the solution?
Orca Security is quite scalable; we had more than 500 projects on the platform, and adding more projects is a natural progression.
How are customer service and support?
I have contacted the technical support of Orca Security and had positive experiences; I always received quick answers and was able to resolve my problems.
I would rate the support of Orca Security an eight on a scale from one to ten.
How was the initial setup?
The initial deployment of Orca Security was straightforward, but the configuration as a whole and integrating all of our tools and repositories was challenging, requiring significant work to configure it and put it into production.
It took approximately two months to fully deploy Orca Security.
What about the implementation team?
Deploying Orca Security probably requires a team; a single person can deploy it, but not to its fullest potential, so you probably need more people and workforce to integrate everything effectively.
Which other solutions did I evaluate?
I have used Snyk as an alternative security coding solution, and while it does not have as many functions and models as Orca Security, it works as a security coding solution as well. I am also currently evaluating Wiz, which is quite similar to Orca Security.
I am not the person that interacts with the pricing of Orca Security, but the solutions have standard pricing; I do not think Orca Security is higher or cheaper than Wiz or similar solutions. I know Snyk is cheaper, but it does not have many of the models and functions that Orca Security has.
What other advice do I have?
I was a regular customer of Orca Security, responsible for operating it daily, and I do not have any current relation with them, but I remain impressed with the application as a whole. I would rate this review a nine out of ten.