Sold by
Orca Security CNAPP Cloud Security Platform
Agentless Cloud Security in a Single, Complete Platform with 100% Coverage
Reviews (325)
Avraham Goldawsser
Cloud security has become unified with agentless visibility, faster remediation, and better compliance
Reviewed on Jul 14, 2026
Review from a verified AWS customer
What is our primary use case?
My main use case for Orca Security is cloud security, and we integrated AppSec in the last year.
What is most valuable?
Orca Security offers good security as a CSPM, runtime security with the real-time security agent on Kubernetes, and excellent visual representation to see what is really going on. The visual representation helps me understand where our gaps are and what needs to be fixed through remediations. In terms of AppSec, it provides entire connectivity with some missing parts, but mainly the Git parts with the repos allow me to see everything, how it is integrated, and to assess its risks. The SCA with the SAST is also crucial.
The feature that stands out the most for me is that it is agentless, so I have simple connectivity where I can see everything in one place. If there are misconfigurations, security risks, or misconfiguration gaps, I can be alerted and set up custom alerts and non-custom alerts, allowing our security team to observe these alerts and take action.
Orca Security has positively impacted my organization mainly through use by the security team, but we also use it for compliance reports. We can set the compliance standards we want to adhere to in Orca Security, and then I can check in which areas of each resource or organization-wide efforts comply with those standards. This is really useful to know where our compliance gaps are.
Risk detection and identification capabilities of Orca Security are great and really useful. They had too many false positives in the past, but over time, with their improvements, probably due to UBA or something similar, it has really improved.
What needs improvement?
Orca Security can be improved by adding more connectivity and more integrations because the world is moving so fast that having integrations is really poor compared to other vendors.
What is also missing with Orca Security is more robust AI security. Even though they have something, it is still really immature. We need better observability, and not only for cloud-based issues but also for any AI LLMs to ensure real security over AI.
Regarding Orca Security's AI capabilities, I think it is still immature and we are missing some introduction to it. In terms of Orca Security's accuracy and reliability of output, I find that it is still immature, so I have a gap over there.
For how long have I used the solution?
I have been using Orca Security for the last four years.
What do I think about the stability of the solution?
I find Orca Security stable.
What do I think about the scalability of the solution?
Orca Security's scalability is great and I have not seen any faults.
How are customer service and support?
The customer support from Orca Security is the best and it is really good. I would rate the customer support a ten.
Which solution did I use previously and why did I switch?
We did not previously use a different solution. We conducted a POC with other solutions, and at the end of the day, after checking everything, it was my choice to go with Orca Security.
How was the initial setup?
I purchased Orca Security through the AWS Marketplace.
What was our ROI?
Orca Security has helped my organization reduce the time it takes to address cloud security alerts, and it does so very fast. Its visualization of the alerts, including custom alerts, makes it really efficient. Today, it is integrated with our SOC team.
I have utilized Orca Sensor for Cloud Detection and Response, CDR, and it has been effective in providing runtime visibility and security. This was the main part because we started with CDR straight at the beginning before doing anything else, and it was good.
Orca Security has helped in preventing risks and attacks across my application lifecycle if it is about secrets, exposed secrets, or vulnerable packages within the CI/CD pipeline, which were detected through the pipeline. It has full integration with GitHub or other tools such as Azure DevOps.
Which other solutions did I evaluate?
What other advice do I have?
I rate Orca Security a ten out of ten. I chose this rating because we started with Orca Security when it was a new kind of competition to Wiz. We went with Orca Security because of its support, which is one of the best third-party supports we have. They made a really big jump over the last two years, especially in the last year where they changed almost everything, from visualization to reducing false positives, and now they categorize alerts separately compared to what it was earlier, making this really useful. My advice for others looking into using Orca Security is to really consider them. I have given this advice before, and I know that some have taken my advice and moved forward with Orca Security. My overall rating for Orca Security is ten.
Samuel J.
Orca Unifies AppSec, Cloud, and Agent Context in One Clear View
Reviewed on Jul 13, 2026
Review provided by G2
What do you like best about the product?
We used to split our view of risk: AppSec tools looked at the code, cloud tools looked at the infrastructure, and nobody owned the full picture for the agents that sit on top of both. In reality, the marketer was writing the Python, the analyst was shipping the agents, and those agents call the APIs, touch the containers, and invoke serverless functions across clouds. Orca ties the application, cloud, and agent context together in one unified model. When there’s an issue, we can see the agent, the vulnerable code it relies on, the service it runs on, and the data it touches—all in a single view.
What do you dislike about the product?
Our appsec engineers broadened their focus to include agent behaviour and the cloud context, and that shift has helped them collaborate more closely with the rest of the security team.
What problems is the product solving and how is that benefiting you?
It brings application cloud and AI agent security into a single story we can actually act on, aligned with how our teams build and deploy agents.
Shubhankar T.
Orca Keeps AI Agent Compliance Continuously Aligned With Our Cloud Workloads
Reviewed on Jul 13, 2026
Review provided by G2
What do you like best about the product?
We are constantly creating with AI agents, and compliance used to feel completely disconnected from that reality. Teams ship agents to production, analysts wire agents into workflows, PMs push agent-backed features, and then audit season arrives with the spreadsheet. Orca continuously maps our cloud workload and agent posture to the frameworks we care about, tied directly to the resources and agents that power what we build.
What do you dislike about the product?
We fine-tuned how Orca’s controls map to the way our auditors phrase agent and AI governance requirements, which helped align its evidence directly with our own review style.
What problems is the product solving and how is that benefiting you?
This Sift AI agent compliance takes what used to slow down our normal security posture work and turns it into part of the process, so we can keep shipping agents while still proving we’re safe enough to keep going.
Kevin J.
Orca Gives Us a Single View of AI Agent Risk Across AWS, Azure, and GCP
Reviewed on Jul 11, 2026
Review provided by G2
What do you like best about the product?
We build across AWS, Azure, and GCP. Different teams own each cloud and ship features independently, and our AI agents follow those same paths, calling services across multiple providers at once. Before Orca, that meant three different stories about where the agents lived and what they could reach. Orca connects to every account and subscription and gives us a single, contextual view of the risk tied to the AI agents and the services our business depends on. Our CISO can see the agents, their identities, and their blast radius across clouds in one place instead of chasing separate dashboards.
What do you dislike about the product?
Cloud specialists sometimes want more provider-specific detail at the top level, but the ability to drill down is there. Our teams have found a good balance between the unified agent view and the depth available for each cloud.
What problems is the product solving and how is that benefiting you?
It lets us run one coherent security program for both AI agents and traditional workloads across all our clouds, at the pace our teams ship. Agents that cross provider boundaries are now part of the same overall picture, so we can see their full multicloud blast radius instead of treating each provider as a separate silo.
Santo J.
Orca Makes Serverless Security Clear and Actionable
Reviewed on Jul 10, 2026
Review provided by G2
What do you like best about the product?
Our teams leaned hard into serverless. Developers, analysts, and even marketers writing Python scripts ended up shipping Lambda functions that touched important data. Traditional tools treated those functions as an afterthought. Orca sees serverless as part of the same unified risk surface, showing permissions, data access, and exposure in the context of the features we’re building. It lets our CISO enable that speed of creation instead of asking teams to slow down.
What do you dislike about the product?
We still rely on separate tools for performance and latency, so we’ve had to be clear internally about which findings are security-related versus operational. That distinction is straightforward to make.
What problems is the product solving and how is that benefiting you?
It makes our serverless estate visible to security at the same speed it was actually created, without forcing builders to change how they deploy. That visibility has been especially useful as more of our AI agents invoke the serverless functions as part of their day-to-day work.
Pious C.
Orca Brings Clear, Actionable Context to Kubernetes Security at Scale
Reviewed on Jul 10, 2026
Review provided by G2
What do you like best about the product?
Our Kubernetes footprint grew faster than our security efforts could keep up with. Engineers and analysts were pushing workloads across clusters, and misconfigurations were getting lost in the complexity. Orca surfaces Kubernetes issues in the same unified context as everything else, and it helps show which misconfigurations are actually reachable from the internet or from the identities tied to our critical services. It also makes it clearer which Kubernetes misconfigurations sit on the paths that the AI agents, or the services they drive, could realistically reach. That added context is what lets a small team keep up with the clusters that power the features our business depends on.
What do you dislike about the product?
Some of the Kubernetes terminology in the findings required a quick internal primer for non-cluster specialists, but once that foundation was in place, the insights became much easier to understand and act on.
What problems is the product solving and how is that benefiting you?
It gives us one place to see and prioritize Kubernetes risk alongside the rest of our estate, so the services that drive what we create stay safe without slowing down the teams shipping them.
Deepika C.
Orca Cuts Container CVE Noise and Highlights Real Exposure Along AI Agent Paths
Reviewed on Jul 09, 2026
Review provided by G2
What do you like best about the product?
We used to drown in container CVE lists that didn’t reflect how our teams—or the AI agents—actually use those services. Developers were shipping images quickly, product managers were prototyping and pushing features, and the agents were calling into containers in ways that security couldn’t easily prioritize.
Orca shows which container vulnerabilities sit on the assets that are truly exposed, and more importantly, which ones fall along the paths our AI agents and their tools actually traverse. It filters out the noise and surfaces the container risks that could affect real agent workflows, not just theoretical package issues.
Orca shows which container vulnerabilities sit on the assets that are truly exposed, and more importantly, which ones fall along the paths our AI agents and their tools actually traverse. It filters out the noise and surfaces the container risks that could affect real agent workflows, not just theoretical package issues.
What do you dislike about the product?
The container view had a lot of depth, so we spent some time tuning the filters and groupings to match how our teams and the agents use services and environments. That tuning made it much easier for both builders and security to focus on the container risks that affect agent-driven paths.
What problems is the product solving and how is that benefiting you?
It turned container vulnerability management into something we can actually keep up with at the speed our builders and agents ship. Because Orca ties container findings to the AI agents that depend on them, we can focus our effort on the risks that could truly impact agent workflows and the data behind them, instead of spending time on issues that never sit on a real path.
Anurag Jat
Holistic risk monitoring has improved cloud file integrity checks and reduced false positives
Reviewed on Jul 08, 2026
Review from a verified AWS customer
What is our primary use case?
I was using Orca Security in my previous organization, and I have recently switched to a new organization, so my previous company domain and email ID are no longer active.
I last used Orca Security approximately five months ago and worked with it for around two years.
I used Orca Security for file monitoring of AWS EC2 instances and S3 buckets, with the focus primarily on EC2 instances. Orca Security was migrated with AWS, and we routinely monitored and checked file integrity. We received details about EC2 instances, including instance type, who created it, and when it was created.
I am not currently using Orca Security, and none of my clients are using it. My previous client was using it.
What is most valuable?
I find the filters of Orca Security very beneficial, and the GUI is also very beneficial. The migration support provided by Orca Security across multiple clouds, including AWS, GCP, and Azure, gives a wide range for searching.
All risks are timely identified in Orca Security and timely notified, with alerts triggering over the ticketing tool, providing good risk identification and incident handling.
Orca Security provides a very holistic approach and holistic view of what has happened, with things categorized accordingly.
Orca Security generally has a rating based on risk parameters. If the risk level is high, the rating is based on a zero to five star scale, and high-risk items generally have a rating of 4.5 or above, which is very beneficial for judging incidents based on their rating.
Orca Security helps much in defense and gives notifications prior to the alert, providing a more detailed view for proper investigation.
Orca Security provides a very holistic approach and a very user-friendly GUI while supporting multiple clouds, which is helpful for security personnel to identify and mitigate risks.
Orca Security helped us reduce the false positive rate. When changes in instances are made by a historical user or the user to which the instance is assigned, I can set a query in Orca Security and the alert is not triggered. However, if changes have been made by a malicious person, the alert triggers. This means not every change triggers an alert, only malicious ones do, reducing the false positive rate by approximately 10 to 20 percent.
What needs improvement?
Orca Security could support its own ticketing tool, which would be helpful for security personnel so they would not need to integrate with any other ticketing tool. We could receive a ticket directly in Orca Security and work on it there since most of the information is available. Additionally, Orca Security should present raw logs, which would make it much easier to do the findings.
For how long have I used the solution?
I worked with Orca Security for around two years.
What do I think about the stability of the solution?
Orca Security was fully stable, and I did not experience any instability.
Which solution did I use previously and why did I switch?
I have worked a little bit with Qualys, but not extensively, just an overview of the tool.
How was the initial setup?
I have not set up the initial level of Orca Security, as it was handed over to me by someone already set up. I have not seen the initial setup or migration of Orca Security.
What's my experience with pricing, setup cost, and licensing?
I have no idea about the pricing of Orca Security. I do not have any information about the pricing or cost, as it was managed by my organization.
What other advice do I have?
There was no technical fault while I was using Orca Security, and I did not encounter any such technical faults, so I have not contacted any technical team. I have not explored many options in the VM field. At this time, nothing additional comes to mind. All matters regarding scalability and other technical details were managed by my organization, and I just had to work with the system. My overall review rating for Orca Security is 8 out of 10.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Sania J.
Orca Surfaces Hidden Agentic Workflows and Helps Govern Access Fast
Reviewed on Jul 08, 2026
Review provided by G2
What do you like best about the product?
The CISO here is accountable for everyone who ships: the developer, the data scientist, the analyst deploying the agents, the PM, and even the marketer writing Python. Last month, an analyst spun up an agentic workflow with access to multiple internal systems, and nobody had told Security. Orca surfaced it, mapped what the agent could reach, and we were able to govern it before it became an exposure.
What do you dislike about the product?
With so much consolidated into one platform, we decided to rethink some internal team boundaries around who owns agents and their policies. More than anything else, that shift has improved clarity.
What problems is the product solving and how is that benefiting you?
This made it possible for one accountable leader to truly enable every builder and every agent across the company, instead of chasing risk one tool at a time.
Juan C.
Orca’s Unified Data Model Made Agentic Workflow Governance Clear and Actionable
Reviewed on Jul 07, 2026
Review provided by G2
What do you like best about the product?
The CISO here was accountable for everyone who ships: the developer, the data scientist, the analyst deploying the agents, the PM, and the marketer writing the Python. Last month, an analyst spun up an agentic workflow with access to multiple internal systems, and nobody had told security. Orca surfaced it, mapped what the agent could reach, and we were able to govern it before it became an exposure. That’s what the unified data model actually means in practice: code, cloud, AI services, and now agents, all in one place.
What do you dislike about the product?
With so much consolidated into one platform, we decided to rethink some internal team boundaries around who owns the agents and their policies. That change improved clarity more than anything else.
What problems is the product solving and how is that benefiting you?
It has made it possible for one accountable leader to actually enable every builder and every agent across the company, instead of chasing risk tool by tool.