Orca Security

Overview

Orca Security is an agentless-first cloud-native application protection platform (CNAPP) that covers posture (CSPM), workload vulnerabilities, data security, and cloud infrastructure entitlement management (CIEM) from one data model. Founded in 2019, headquartered in Portland, Oregon with R&D in Israel, it is privately held and venture-backed. That independence matters more than it used to: its closest rival, Wiz, became part of Google Cloud in March 2026, and Microsoft retired Entra Permissions Management in November 2025, so Orca is now one of the few large multi-cloud CNAPPs not owned by a hyperscaler or a firewall vendor. See the consolidation report for the wider pattern.

What it is good at

Speed to first finding. SideScanning reads workload block storage out of band through the cloud provider's APIs and reconstructs a read-only view of the operating system, applications, and data, so nothing has to be installed on the workload. Connecting cloud accounts is a read-only role grant, which security teams can usually do without negotiating with every application owner.

The CIEM module inventories identities, roles, groups, and policies, then answers questions like "which machine identities can reach this bucket with PII?" It recommends right-sized policies from the last 90 days of role usage, which is the practical way to get to least privilege. Because entitlement findings sit in the same graph as vulnerabilities and exposure, an over-permissioned role on an internet-facing, vulnerable instance ranks above the same role on an isolated one. Orca also offers just-in-time access for AWS, with request and approval through Slack and an audit trail per request.

Where it falls short

CIEM is one module of a CNAPP, not the product's center of gravity. Just-in-time access is documented for AWS only, there is no access-certification or request workflow comparable to an IGA tool, and remediation of entitlement findings is mostly recommendation plus ticketing. Teams whose main problem is governing standing cloud privilege, rather than prioritizing cloud risk, will get more from Sonrai Security or Britive.

Snapshot-based scanning has limits by design: it sees state, not live behavior. Orca now sells an optional eBPF-based Orca Sensor for runtime detection, which means "agentless" no longer describes the full product if you want runtime coverage. The control plane is SaaS only.

Pricing

Quote-based enterprise subscription with no public list price, sold direct, through partners, and through the major cloud marketplaces. Expect cost to scale with the size of the scanned estate. See how this compares across the category in the pricing transparency index.

Best for, and who should look elsewhere

Choose Orca if you need multi-cloud visibility in days rather than months and want entitlement risk ranked alongside vulnerabilities and exposure. Orca's deployment effort is a read-only role grant per cloud account; most of the real work is triaging what it finds, not installing it. Look elsewhere if you need a self-hosted control plane, deep JIT across Azure and Google Cloud, or a dedicated entitlement-governance workflow. Compare it directly in Wiz vs Orca Security and the best CIEM for multi-cloud ranking.

Bottom line

Orca is the fastest way for a security team to see cloud entitlement risk in context across AWS, Azure, and Google Cloud, and the strongest independent alternative to Wiz. Treat its CIEM as risk prioritization, not as a replacement for access governance.