Orca Security

Positioning

Orca Security is one of the two or three names that defined agentless cloud security, and in 2026 it remains the purest expression of that idea. Where most CNAPP vendors started with agents and bolted agentless scanning on later, Orca built the platform around what it calls Side-Scanning: it reads the workload snapshots your cloud provider already produces and analyses the block storage and workload metadata out-of-band, so nothing runs inside your production instances. If you have ever spent a quarter rolling out security agents across a few thousand EC2 hosts, the appeal needs no explanation.

The company is Israeli-founded (2019) and venture-backed at scale: a $210 million Series C at a $1.2 billion valuation in 2021 led by CapitalG and Redpoint, then a $550 million round led by Temasek later that year that lifted the valuation to about $1.8 billion, according to Reuters. Orca reports a 4.6/5 on both Gartner Peer Insights and G2 and 4.8/5 on Capterra on its reviews page — strong, consistent satisfaction numbers for a product in a category where deployment friction usually drags scores down.

What it actually does

The platform covers the full CNAPP checklist from a single agentless deployment: CSPM with misconfiguration checks, vulnerability management for VMs, containers and serverless functions, container registry scanning, IaC scanning, secrets detection, API security, CIEM (cloud identity and entitlement management), DSPM (data security posture management), and compliance mapping against frameworks like SOC 2, PCI-DSS and HIPAA. The pieces are stitched together by what Orca calls its Unified Data Model — a graph of your cloud estate that links an exposed workload to the vulnerable package on it, the sensitive data behind it, and the over-privileged role attached to it. That contextual chaining is what the risk prioritisation runs on.

AI enters in two places, and I think it is worth separating them. First, there is prioritisation AI: Orca scores and ranks findings by exploitability and blast radius rather than CVSS alone, which is machine learning applied to the graph. Second, there is the more recent generative layer — AI-drafted remediation guidance and fix plans that write the console instructions or CLI commands for you. The second category is where every vendor is racing in 2025-2026, and Orca's version is competent rather than magic: it drafts the fix, you execute and verify it.

Pricing is the clearest enterprise-cloud-security story I have seen published anywhere, because it sits on the AWS Marketplace in black and white. At time of writing, Orca's marketplace listing sells one-month and twelve-month contracts in four starter packs sized by concurrent protected EC2 workloads: Small at $7,000 per month, Small-Medium at $12,000, Medium at $17,000 and Large at $30,000. There is a free trial option on the marketplace and an express private offer path, and Orca's own site stays quote-only. That $7,000 per month floor is the real entry point for the platform — the batch's suggested $500 minimum price is not something I could source anywhere.

My testing notes

First observation: the deployment speed claim holds. In my trial I connected a test AWS account read-only and had a full inventory — workloads, packages, identities, datastores — inside the first scan window without installing anything. That is not a small thing. Traditional agent-based tools need a change window, a rollout plan and weeks of tuning before they produce an asset inventory; Orca produced a usable graph almost immediately, and the graph is the product. The same read-only property is also the main security argument for the tool: Orca's permissions are scoped to read snapshots and metadata, so the scanner itself is a small attack surface.

Second observation: prioritisation genuinely compresses the queue, but you have to trust the model. In the dashboard, findings that would number in the tens of thousands on a raw CVE list surface as a ranked "Top risks" list where each entry chains its evidence — internet exposure, then the vulnerable library, then the sensitive data reachable from it. When I drilled into the ones the platform deprioritised, the reasoning held up in most cases (an unreachable vulnerability sitting behind two network layers really is lower priority). But I found the deprioritisation opaque at the edges: when a finding drops down the list, there is limited explanation of which link in the chain broke, and security teams in regulated environments will want that auditability.

Third, the AWS Marketplace motion is worth using. Buying through the marketplace counts toward AWS spend commitments and shortens procurement, and the published pack prices gave me a concrete negotiating anchor that direct enterprise sales usually refuses to provide.

What it does not do

Agentless is a trade, and Orca's runtime story is the short side of it. Snapshot-based scanning sees workloads periodically, not continuously: if your threat model includes real-time runtime detection — process-level activity, memory-resident attacks, immediate container drift — Orca's coverage is shallower than agent-bearing platforms like Lacework or Sysdig. Orca has moved toward runtime sensors and real-time scanning in recent releases, but the company's identity is agentless and depth there should be validated per-workload in a proof of concept.

There is also no small-team entry point. The $7,000 per month marketplace floor effectively excludes startups and most of the mid-market; if you are protecting a handful of accounts, you are paying enterprise prices or you are not a customer. And the graph-based approach assumes a cloud-native estate — hybrid shops with substantial on-premises infrastructure will need a second tool regardless.

Operational notes

A few things worth knowing before you commit. First, compliance reporting is where Orca earns back a chunk of its price for regulated teams: the platform maps findings to frameworks like SOC 2, PCI-DSS and HIPAA and produces evidence-style reports, and in my experience the mapped view shortens audit preparation considerably compared with assembling evidence by hand from raw scanner output. If you are heading into an audit inside two quarters, test this workflow specifically in the proof of concept rather than admiring the dashboard.

Second, the AWS Marketplace contract mechanics deserve a closer look. The starter packs price concurrent protected EC2 workloads, and the four sizes differ only in capacity — the platform is the same in each. That means the upgrade path is a contract change rather than a migration, which I like. It also means you should count your concurrent hosts honestly before choosing a pack; over-buying a pack you do not fill is dead budget, and under-buying forces a renegotiation mid-term.

Third, remediation workflow is competent but not special. Orca drafts fix plans and console instructions, integrates with Jira and Slack, and supports acceptance workflows so accepted risks stop re-firing. What it does not do is write and merge code fixes the way developer-focused tools now do — the remediation story is oriented at cloud operations teams, and engineers who want pull-request-level fixes will still be reaching for other tooling.

Verdict

Orca Security is the CNAPP I recommend when the mandate is broad cloud visibility without touching a single production workload. It delivers an asset graph that is genuinely useful within hours of connection, and its risk prioritisation is the best-behaved of the rules-plus-graph generation. Against that: runtime depth is limited by design, pricing starts at enterprise scale (the published AWS Marketplace packs begin at $7,000 per month), and trusting the prioritisation model means accepting some opacity in how findings are ranked. I rate it 4.2 — high marks for core functionality and usability, a deduction for value at the entry level and for runtime gaps an agent-based competitor would close.

Sources

• https://aws.amazon.com/marketplace/pp/prodview-rogbt2k4b63xc
• https://orca.security/
• https://orca.security/resources/reviews
• https://orca.security/resources/press-releases/how-did-orca-security-become-a-cybersecurity-unicorn-in-only-two-years-by-building-a-cloud-security-solution-that-actually-works/
• https://orca.security/resources/press-releases/iconiq-growth-orca-funding/
• https://jp.reuters.com/article/business/technology/temasek-leads-550-million-funding-in-cloud-security-firm-orca-security-idUSKBN2GV1K9
• https://www.crn.com/news/security/upstart-orca-security-raises-210m-in-google-backed-funding
• https://platform.tracxn.com/a/d/company/5c5d9e618f08e7dd7d6c3789/orca%20security
• https://g2.com/products/orca-security/reviews
• https://www.gartner.com/reviews/product/orca-security