Cloud posture management has improved remediation and optimizes costs with contextual risk insights
What is our primary use case?
In my previous company, I used Orca Security as a CSPM tool, which stands for Cloud Security Posture Management. The tool is very nice, and with it, we achieved a lot of our remediation activities. Orca Security looks good in terms of Kubernetes and in terms of telling us about cloud misconfigurations and many other things.
I used Orca Security for approximately one and a half years, or roughly 11 to 12 months. Orca Security proved to be a good tool in my previous company.
I did not use the Cloud to Dev feature because it was recently rolled out at that time. At that point, we were moving to secure code and code review processes.
We did not use Orca Security sensor because we installed Orca Security API integration with our Azure Entra ID, in which all devices on our cloud infrastructure were scanned every 24 hours. However, after I left, the team considered using sensors because they have some limitations, particularly on legacy devices.
What is most valuable?
The standout part of Orca Security is the package approach. When they provide remediation or alerts, they also provide the exact path for a particular vulnerability or alert. They show us the specific path that needs to be fixed in order to remove the vulnerability or alert. They provide path information directly from the systems, so sometimes we don't need to log in directly and investigate ourselves. This feature is valuable, though there are occasional false positives, which is a normal part of security.
Regarding prioritization and assigning risk, Orca Security was good at analyzing risks contextually and holistically. As the tool and product mature, they will definitely announce new features. On a scale of ten, I would rate this around seven or eight. I have not given a ten because there are a few false positives and some areas where the product needs improvement on a regular basis. Sometimes they release the product, but modifications could still be required on their side.
It is good to prioritize risks with Orca Security because they are not only targeting the CVSS score but also the EPSS, which is the Exploit Prediction Scoring System. They monitor particular assets based on both approaches. On the CVSS side, they reference the National Vulnerability Database, and on the EPSS side, they target the Exploit Prediction Scoring System. So they are targeting both risk-based approaches as well as the CVSS approach.
What needs improvement?
Since I have not used Orca Security for 10 months, I am uncertain what areas still need improvement, as they may have rolled out features that addressed issues I faced in the past. However, I can say the tool is good. A few things could potentially be improved, particularly regarding false positives and the UI. What I observed is that they release updates to the platform without notifying the customer. Every time the UI is upgraded, they release something without notification. This could be a slight improvement. If they released some kind of notification to just inform the customer about UI changes, the customer would be aware of the changes that Orca Security is making in the backend.
What do I think about the stability of the solution?
Regarding stability, I would rate Orca Security an eight.
What do I think about the scalability of the solution?
In terms of scalability, I would rate it an eight because it performed well with what I worked with at that point in time.
How are customer service and support?
I would rate the technical support of Orca Security as eight. The customer success manager was also very helpful in terms of resolving issues.
How would you rate customer service and support?
Which solution did I use previously and why did I switch?
I am currently using Wiz as well, and Wiz is also good. I think both Orca Security and Wiz are comparable and can work hand-in-hand. I would not say one is better than the other. I have started using Wiz and I like it because they also do similar things. I am yet to explore more on the Wiz side of things, but both are comparable and good.
How was the initial setup?
Orca Security is deployed in the cloud.
What was our ROI?
I can say Orca Security roughly reduced the operating expenses by around 20-50%.
What's my experience with pricing, setup cost, and licensing?
Which other solutions did I evaluate?
Regarding the extent to which Orca Security helps in preventing risks and attacks across application lifecycles, I think it is the same scenario because there are many CSPM tools available. We have Wiz, Orca Security, and Lacework. All CSPM tools do the same work by scanning the infrastructure and providing reports either through API or through sensors. Definitely, the risk is more important on the cloud misconfiguration side because they tell us about the misconfigurations. CSPM is not a vulnerability management tool. It is more on the cloud side where they provide misconfigurations related to that. After you have deployed something on your infrastructure or cloud infrastructure, once you put a CSPM in your infrastructure, it will tell you how effectively you can remove those misconfigurations. That is the edge that CSPM is giving.
What other advice do I have?
I would recommend Orca Security to other users because it was good at the point in time I used the product.
Regarding how Orca Security has helped reduce the time it takes to address cloud security alerts, this is a complex scenario because it is totally dependent on the situation of the alert. I cannot say it takes one or two minutes because it depends on how critical the alert is and how critical it is in our environment. Some of the time, based on our infrastructure, we have to keep things as exceptions. We cannot fix all things. But many times we got the right alert and fixed it by checking and updating the risk provided by Orca Security in my previous organization.
We used the cloud cost optimization feature and it was very effective. We used it alongside Microsoft Azure where we had a specific subscription for cloud cost optimization. They provided better features showing us which features we were not utilizing much and could turn off, or which features we were utilizing more so we could adjust the bandwidth level. For every feature there is a cost associated with it. In that way, we used it effectively.
Orca Security saves resources because it provides the actual output on the screen with the package path. The resources aspect is definitely valuable because of how it uses Linux and goes deep down into the assets. It provides that particular information directly on the portal itself.
Orca Security was used by approximately 50 to 100 users. I believe Orca Security was purchased through the AWS Marketplace.
I rate Orca Security an overall eight out of ten.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Agentless cloud security has provided deep visibility and now simplifies risk prioritization
What is our primary use case?
In my previous organization, where I worked with Orca Security, it was a product-based company, and only a select few, such as our CISO and cybersecurity architect, had admin access. The rest of us had read-only access as analysts, and the tool was deployed across all our EC2 instances.
I did not have any exposure in deploying or developing with Orca Security, as I was just analyzing the alerts, which included Sophos and Orca Security alerts. We had access to the Orca Security dashboard where we received alerts, and my company was a product-based company securing our infrastructure using Orca Security. I did not have any experience or exposure in deploying Orca Security, but I had experience in deploying Wazuh in many AWS accounts, adding agents to those accounts.
I monitor cloud assets for misconfigurations or vulnerabilities, and Orca Security connects to AWS via API permissions instead of deploying agents or running servers as CrowdStrike does. We use side-scanning to analyze snapshots and metadata, build attack paths, and prioritize risk based on exploitability.
What is most valuable?
My experience with Orca Security is recent, as I used it about two months back while still in the previous organization, and I have recently switched jobs.
In my opinion, the best features of Orca Security are that it is very easy to deploy, primarily because it does not have agents, which are used in many other SIEM solutions or security solutions such as SentinelOne, Sentinel, Wazuh, or AlienVault. Those benefits include faster onboarding and reduced alert noise via intelligent prioritization. It also has better DevSecOps integrations with code scanning and SDLC visibility. The main advantages are that it is easy to set up with user-friendly dashboards, and the agentless design reduces operational friction. It also offers excellent visibility and exhaustive scanning of the cloud accounts, and Orca Security can be used on any cloud platform, whether it is AWS, Azure, GCP, or Oracle.
Using Orca Sensors has been beneficial since by default, Orca Security's cloud platform employs a side-scanning technology that connects cloud accounts via APIs. It offers workload block storage without needing to deploy a traditional agent on each workload. Orca Sensor is a lightweight sensor designed to supplement the agentless platform with runtime visibility. It uses EBPF for deep system-level observability, making it easy to deploy. The reason we use Orca Sensor is that it provides broad cloud-wide visibility and prioritized risk. Orca Sensor adds real-time monitoring and detects malicious behavior similar to other SIEM products. By using Orca Sensor, we can confirm if potential vulnerable code is executed in runtime. There are many features for Orca Sensors, as it fits into an agentless model, is easy to deploy via cloud APIs, and offers deep, real-time processing and network visibility.
Providing runtime visibility with Orca Sensor has been effective, as it complements Orca Security's core platform, which uses agentless side-scanning. This allows us to see what processes are running and detect real-time threats such as malware execution or privilege escalation. The hybrid approach lets organizations maintain agentless coverage for the entire cloud estate while applying deep runtime protection to critical workloads.
Prioritizing risks using Orca Security is generally easy and effective, especially compared to other tools I have used such as SentinelOne and Sentinel. Orca Security provides a risk score for everything, including attack path visualization and business impact context. This helps us propose risks while correlating multiple signals such as common CVEs and cloud misconfigurations. For example, a public EC2 instance with an admin IAM role running malicious scripts could be a critical risk. Compared to other cybersecurity tools, Orca Security's agentless architecture enhances its risk prioritization capabilities.
I have not seen many alerts in Orca Security during my tenure since the architecture was well-structured by our cybersecurity architect, leading to very few alerts. Some alerts were related to possibly malicious activity installed by our team or older versions of Java. However, I believe that Orca Security reduces alert volume because it combines vulnerability data into a unified view, speeding up cloud security workflow. It significantly reduces alert noise and accelerates alert handling by correlating risks with workloads, showing prioritized issues so the team can focus on remediation.
What needs improvement?
In my opinion, after using Orca Security for seven to eight months, areas for improvement could include automating processes as other solutions do. I have a background in automation and think that if Orca Security had its own automation capabilities for repetitive tasks, it could enhance the user experience. The dashboards and reports focus on security and are strong, but automation remains my suggestion for improvement.
The workflow and automation aspect would be beneficial, similar to having playbooks indicating steps for alerts, such as creating tickets or providing remediation steps that could be automated.
The only limitation I see is in auto-remediation capabilities, but Orca Security excels in risk prioritization and has a balance of visibility and operational efficiency.
For how long have I used the solution?
I have been working with Orca Security for around seven to eight months in my previous organization.
What do I think about the stability of the solution?
For stability, I would rate Orca Security an eight or nine, as I have not experienced any downtime, bugs, or glitches.
What do I think about the scalability of the solution?
I find Orca Security to be scalable, as it takes very little time to deploy, and I would give it a ten for scalability.
What about the implementation team?
I was not a part of the deployment team; I was just an analyst trying to explore the tool. When Orca Security came online, it was seamless, as we had been informed beforehand.
Which other solutions did I evaluate?
When comparing Orca Security with other solutions, the main advantage is its agentless architecture, which I find to be a significant unique selling point. Deploying other tools such as Wazuh involves manual commands and server creation, whereas Orca Security is easier to manage. While there are other agentless architectures, such as Wiz, they lack some of the features such as side-scanning that Orca Security offers.
What other advice do I have?
Regarding the cloud cost optimization feature in Orca Security, I have not explored it yet, and I would not be the right person to answer questions about it, as I am not aware of it.
I am not aware of any maintenance requirements for Orca Security, as I have not received any communication regarding maintenance from the team.
I would recommend Orca Security to other users, especially for cloud users, as it is easy to deploy. For small organizations, I would give it a ten, highlighting its agentless architecture that simplifies maintenance.
Overall, comparing to other tools, I would rate Orca Security around an eight or nine, primarily due to its agentless architecture, so I would say nine. My overall review rating for Orca Security is nine.
In my assessment, the risk detection and identification capabilities of Orca Security are very good, accurately reflecting vulnerabilities and processes running in the backend. The risk score provided is also very impressive.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
