Sold by
Orca Security CNAPP Cloud Security Platform
Agentless Cloud Security in a Single, Complete Platform with 100% Coverage
Reviews (343)
Cathrine S.
Orca’s Attack Path View Transformed How We Prioritize Fixes
Reviewed on Jul 29, 2026
Review provided by G2
What do you like best about the product?
The thing that really changed how we work is the attack path view. Instead of a list of separate findings, Orca shows the full chain: an exposed asset, the vulnerability on it, the identity it can assume, and the sensitive data at the end of that path. Seeing the entire route makes it obvious which single fix can break the whole chain, so we stopped trying to patch everything and started cutting the links that actually matter.
What do you dislike about the product?
In a large environment, the attack path graphs can hold a lot of detail, so we found it most effective to scope to the crown jewel assets first. Once we did that, the overall picture became clear and genuinely useful.
What problems is the product solving and how is that benefiting you?
It moved us from simply counting vulnerabilities to reasoning about exploitable routes, which is a much better use of a small team’s time. It’s especially valuable when AI agents sit somewhere along that route, because we can see how the agents access identities and how the data paths factor into the real chain an attacker could follow. As a result, we fix fewer things, but we reduce the more real risk.
Guilherme Ferreira Mury
Integrated devsecops practices have prevented vulnerabilities across the application lifecycle
Reviewed on Jul 29, 2026
Review provided by PeerSpot
What is our primary use case?
In my previous experience with Orca Security, I was working on the DevSecOps model, mainly using it for CI/CD pipelines, scanning our repositories for identifying vulnerabilities and breaking the build of the project if there are any high or critical vulnerabilities.
Prioritizing risks using Orca Security is straightforward; it has many tools for assessing and prioritizing risk, including CVSS for all vulnerabilities and the Orca Score that considers the whole context of each vulnerability, helping me understand the true risk and impact.
We had experience with the Orca Sensor, but we did not think it brings too much value to our current environment, so we decided to remove it.
I have used the Cloud to Dev feature in Orca Security before, but not as much as other features such as the DevSecOps model.
How has it helped my organization?
Orca Security has helped me in preventing risks and attacks across my application life cycle by being the base of the whole secure development life cycle I implemented in my previous experience, which was crucial for detecting vulnerabilities both in development and runtime.
What is most valuable?
What I appreciate the most about Orca Security are the AI features for solving false positives and tackling some cases that are not entirely clear for my team, which helped greatly for investigating and dealing with those situations and proved to be highly accurate.
What needs improvement?
Some visualizations and dashboards in Orca Security were not as clear to me; even though I can edit and modify them as much as I prefer, the dashboards that came with the application were not ideal.
There are not many negative aspects about Orca Security; I think it is a solid solution and the issue with the dashboards is more of a design preference of mine, so I am not certain if it qualifies as a downside.
For how long have I used the solution?
I have been working with Orca Security for around one to one and a half years.
What do I think about the stability of the solution?
I have not experienced any lagging, crashing, downtime, or any sort of instability with Orca Security.
What do I think about the scalability of the solution?
Orca Security is quite scalable; we had more than 500 projects on the platform, and adding more projects is a natural progression.
How are customer service and support?
I have contacted the technical support of Orca Security and had positive experiences; I always received quick answers and was able to resolve my problems.
I would rate the support of Orca Security an eight on a scale from one to ten.
How was the initial setup?
The initial deployment of Orca Security was straightforward, but the configuration as a whole and integrating all of our tools and repositories was challenging, requiring significant work to configure it and put it into production.
It took approximately two months to fully deploy Orca Security.
What about the implementation team?
Deploying Orca Security probably requires a team; a single person can deploy it, but not to its fullest potential, so you probably need more people and workforce to integrate everything effectively.
Which other solutions did I evaluate?
I have used Snyk as an alternative security coding solution, and while it does not have as many functions and models as Orca Security, it works as a security coding solution as well. I am also currently evaluating Wiz, which is quite similar to Orca Security.
I am not the person that interacts with the pricing of Orca Security, but the solutions have standard pricing; I do not think Orca Security is higher or cheaper than Wiz or similar solutions. I know Snyk is cheaper, but it does not have many of the models and functions that Orca Security has.
What other advice do I have?
I was a regular customer of Orca Security, responsible for operating it daily, and I do not have any current relation with them, but I remain impressed with the application as a whole. I would rate this review a nine out of ten.
Kishore K.
Orca Uncovered Hidden Malware and Suspicious Workflows Our Other Tools Missed
Reviewed on Jul 29, 2026
Review provided by G2
What do you like best about the product?
Orca flagged malicious files and suspicious workflows across our workloads that none of our other tooling had caught, including scenarios where an abused AI agent could have been used to plant or trigger malware. It goes beyond simple hash matching, picking up things like cryptominers and web shells that agents might deploy or invoke as part of a compromised toolchain. Because scanning happens off the workload at the storage and configuration layer, there’s nothing for the malware to hide from on the box itself, and it also covers hosts and agent-linked paths we never would have pointed a dedicated scanner at.
What do you dislike about the product?
We aligned the Orca agent-aware malware and threat findings with our existing endpoint response processes, which helped us fold that context smoothly into the way the team already operates.
What problems is the product solving and how is that benefiting you?
It gave us malware and abuse visibility across our cloud workloads and the agent paths that were previously blind spots. We can see not just that malware exists, but how AI agents could be used to deploy or spread it, and then cut those routes off.
Fernando S.
Orca Uncovered Agent-Reachable Secrets Fast, with Clear Context and Low Noise
Reviewed on Jul 27, 2026
Review provided by G2
What do you like best about the product?
We had a vague sense that credentials and secrets were scattered across our environment, but we didn’t have a clear map of which ones agents could actually see. Orca surfaced hardcoded API keys, SSH private keys, and database credentials in places agents or their tools might read—config files, storage buckets, and logs. It doesn’t just pattern-match; it uses entropy and the surrounding context to decide whether a string is truly a secret, which keeps the noise down. Seeing each secret in the context of agent reachability made it clear which exposures could be triggered by agents and needed immediate cleanup.
What do you dislike about the product?
We spent some time defining suppression rules for the test credentials in our sandboxes, so that agent-relevant secrets stayed front and center in the findings.
What problems is the product solving and how is that benefiting you?
It turned secret sprawl from an abstract worry into a concrete, prioritized cleanup list, with a special focus on the secrets that AI agents could stumble over. Exposed credentials have become a tracked, agent-aware risk rather than something we had to get to eventually.
Jonathan X.
Orca Delivers a True Shift-Left Win for IaC and Pipeline Security
Reviewed on Jul 27, 2026
Review provided by G2
What do you like best about the product?
Having Orca scan our infrastructure as code and our pipelines has been a genuine shift-left win for the AI agents. We started catching templates and configuration snippets that would have granted agents broad, long-lived permissions or exposed new agent endpoints before any of those changes ever deployed. Because Orca ties these IaC findings back to the same risk model it uses for the running environment, we can clearly see that a misconfiguration flagged in code is the same kind of agent exposure we’d otherwise be chasing down in production later.
What do you dislike about the product?
We worked closely with our platform team to integrate agent-focused checks cleanly into our build steps, and to decide which misconfigurations should trigger a warning versus block a deployment.
What problems is the product solving and how is that benefiting you?
It shifts cloud and agent security left in a way that actually sticks. We’re catching reachable, exploitable agent misconfigurations during code review instead of after agents are already live and exposed, which has made the whole pipeline safer without adding friction.
Markose J.
Orca Clarified Sensitive Data Exposure and AI Agent Access Paths
Reviewed on Jul 26, 2026
Review provided by G2
What do you like best about the product?
Orca gave us a much clearer picture of where sensitive data actually lives in relation to our AI agents. It surfaced PII in storage, secrets in places agents might read, and old database snapshots sitting in accounts that newly created agents were able to reach. The real value is the context: each finding shows what the data is, whether it’s exposed, and which agents and identities can access it. That turned what could have been an overwhelming inventory into a clear, prioritized list of data our agents should never be able to touch, along with the paths we needed to close.
What do you dislike about the product?
We spent a bit of time upfront tuning the data classification and agent reachability settings to align with our own definitions of sensitive information, as well as the agent access paths we consider unacceptable.
What problems is the product solving and how is that benefiting you?
It folds data security into the same agent-aware risk picture as misconfigurations and identities, so “where is our sensitive data, and which agents can reach it?” is finally a question we can answer continuously.
Rio T.
Orca Brings AI Agent Risk Into Clear Business Context
Reviewed on Jul 26, 2026
Review provided by G2
What do you like best about the product?
Our finance and enterprise risk teams wanted to understand AI agent risk in business terms, not just issue counts or an abstract idea of "agent exposure." Orca’s context—what data an agent can touch, whether it can reach internet-facing services, and which identities and systems sit behind its paths—lets us group agent-driven risks around business-critical assets and regulated workflows. It’s not a full quantitative risk engine, but it has given us a structured way to discuss which agent behaviors matter most to revenue, compliance, and our contractual obligations.
What do you dislike about the product?
We still add some business mapping on our side for certain agent-centric technical risks, so they line up neatly with the revenue streams and the contractual exposure.
What problems is the product solving and how is that benefiting you?
It has moved our security discussions with Finance and Enterprise Risk from “here is a pile of agent findings” to “here are the top agent-driven threats to the system” that actually drive cost and compliance exposure.
reviewer2879382
Cloud security has improved posture and simplifies risk remediation and alert response
Reviewed on Jul 23, 2026
Review provided by PeerSpot
What is our primary use case?
My main use case for Orca Security is to secure infrastructure, course, and service. A specific example of how I use Orca Security to secure my infrastructure or services is for vulnerability management on VMs or other resources in Azure or AWS.
I have more to add about my main use case with Orca Security, including security posture frameworks such as ISO 27007 and 9001.
What is most valuable?
The best feature Orca Security offers is a remediation solution. What I appreciate most about the remediation solution is that it provides a fast fix for the vulnerabilities in my day.
Orca Security has positively impacted my organization by improving our security posture and hardening our services and resources.
What needs improvement?
Regarding how Orca Security can be improved, I think there is not much; it is fully completed and it is great.
For how long have I used the solution?
I have been using Orca Security for around two years.
What do I think about the stability of the solution?
Orca Security is stable.
What do I think about the scalability of the solution?
The scalability of Orca Security is great.
How are customer service and support?
I find the customer support to be excellent. I would rate the customer support a ten.
Which solution did I use previously and why did I switch?
I did not use a different solution before Orca Security; it is the one and only for me.
What was our ROI?
I do not know if I have seen a return on investment with Orca Security; I cannot share any relevant metrics.
What's my experience with pricing, setup cost, and licensing?
Regarding my experience with pricing, setup cost, and licensing, I think that is not my place in the company.
Which other solutions did I evaluate?
Before choosing Orca Security, I evaluated other options, such as Wiz or Google, perhaps.
What other advice do I have?
My advice to others looking into using Orca Security is to practice and study the platform in test scenarios. My impressions of the risk detection and identification capabilities of Orca Security are fascinating because they are clear and serve as a guide. Orca Security has helped my organization reduce the time it takes to address cloud security alerts because we can automate alerts.
To the extent that Orca Security has helped in preventing risks and attacks across our application lifecycle, it has allowed me to understand the security status of our resources before they go into production. My experience prioritizing risks using Orca is easy. In my experience, Orca Security's ability to analyze risks contextually and holistically is excellent. I have not utilized Orca Security's sensor for cloud detection and response, so I cannot speak to its effectiveness.
I would rate this review a ten out of ten. Orca Security is a great platform, and I am very happy with it.
Cyril S.
Orca Catches Hidden Exposure from AI Agent-Driven Feature Experiments
Reviewed on Jul 23, 2026
Review provided by G2
What do you like best about the product?
Our product team constantly runs experiments, turning features on and off with flags that are increasingly evaluated or executed by AI agents. Orca doesn’t try to live in the feature-flag layer; instead, it watches the underlying cloud identity and the agent posture. When an experiment gives an agent broader access than intended, or opens up a test path to sensitive data, Orca picks it up on its next assessment of the cloud and agent surface and flags it. Developers don’t have to change how they ship experiments, but security can still see where agent-driven flags might create unexpected exposure.
What do you dislike about the product?
Explaining to some product folks why the temporary agent-powered experiments still need proper access controls took a few rounds of education, even with the Orcas findings on hand.
What problems is the product solving and how is that benefiting you?
It keeps up with experimentation-heavy, agent-driven development without slowing it down. Orca watches the surfaces where risk actually materializes—when agents toggle, evaluate, or act on feature flags.
Ahmed A.
Orca Unifies AI Agent Risk in One Clear Posture View for Leadership
Reviewed on Jul 23, 2026
Review provided by G2
What do you like best about the product?
Our CISO used to get disparate stories about the AI agents: AppSec had one view, cloud security had another, and no one owned a single picture of how agent identities and the data all fit together. Orca’s top-level posture view now gives leadership one pane where every AI agent shows up alongside traditional services, with clear exposure, effective permissions, and blast radius. When the CISO walks into a meeting, they can see which agents carry meaningful risk, what data is at stake, and how that ties back to what the business is building next.
What do you dislike about the product?
We still produce the simplified roll-up for the board decks, so there’s some translation effort involved in turning the rich agent context into a higher-level narrative. That said, it’s a much better starting point than what we had before.
What problems is the product solving and how is that benefiting you?
It gives our security leadership a coherent, agent-aware view of where we stand, at the speed of creation. Conversations about risk and investment finally include AI agents as first-class actors, instead of treating them as a footnote.