Lacework FortiCNAPP vs Orca Security comparison

Fortinet and Orca Security are both solutions in the Cloud Security Posture Management (CSPM) category. Fortinet is ranked #24 with an average rating of 7.0, while Orca Security is ranked #11 with an average rating of 8.6. Fortinet holds a 2.2% mindshare in CSPM, compared to Orca Security’s 5.7% mindshare. Additionally, 90% of Fortinet users are willing to recommend the solution, compared to 100% of Orca Security users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jun 22, 2025

Lacework FortiCNAPP and Orca Security compete in the cloud security solutions category. Despite tough competition, Orca Security seems to have the upper hand due to its innovative SideScanning technology and user-friendly deployment features.

Features: Lacework FortiCNAPP integrates seamlessly with multi-cloud environments, offering machine learning anomaly detection and insightful compliance reporting for improved vulnerability management. It excels in continuously monitoring security events, enriching security audits without overwhelming data exposure. Orca Security provides agentless visibility across cloud environments through SideScanning technology, ensuring comprehensive security insights without operational overhead. Its task ranking features enable efficient prioritization, enhancing resource allocation by identifying critical vulnerabilities swiftly.

Room for Improvement:Lacework FortiCNAPP could improve IAM security controls, simplify alert integrations, and secure FedRAMP authorization for more comprehensive applicability. The setup of alerts and user communication could be more efficient for enhanced user experience. Orca Security could expand real-time risk assessment capabilities and further integrate with data centers. Improving user education and simplifying the dashboard's interface for scalability could enhance its overall usability.

Ease of Deployment and Customer Service:Lacework FortiCNAPP supports public cloud deployment with proactive customer service via Slack, promoting community discussion for problem-solving. Orca Security offers agentless implementation across public and hybrid clouds, though customer service reviews suggest mixed engagement levels despite proactive support efforts.

Pricing and ROI: Lacework FortiCNAPP's pricing is high but justifiable, providing significant ROI through operational efficiency and resource management via unit pricing. Orca Security could be considered expensive; however, its comprehensive features deliver competitive value and ROI, as they significantly reduce operational burdens.

To learn more, read our detailed Lacework FortiCNAPP vs. Orca Security Report (Updated: September 2025).

Buyer's Guide

Lacework FortiCNAPP vs. Orca Security

September 2025

Download the complete report

Helped 868,787 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

SentinelOne Singularity Clo...

Mindshare comparison

As of October 2025, in the Cloud Security Posture Management (CSPM) category, the mindshare of SentinelOne Singularity Cloud Security is 3.7%, up from 1.7% compared to the previous year. The mindshare of Lacework FortiCNAPP is 2.2%, down from 2.8% compared to the previous year. The mindshare of Orca Security is 5.7%, down from 7.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Cloud Security Posture Management (CSPM) Market Share Distribution
Product	Market Share (%)
SentinelOne Singularity Cloud Security	3.7%
Orca Security	5.7%
Lacework FortiCNAPP	2.2%
Other	88.4%

Cloud Security Posture Management (CSPM)

Featured Reviews

Ritesh P.

Senior Manager at ICICI Lombard

It's more scalable and flexible than our previous solution because we don't need to install any agents

The reporting works well, but sometimes the severity classifications are inaccurate. Sometimes, it flags an issue as high-impact, but it should be a lower severity. For example, it might highlight an exposed AWS encryption key, a critical compliance issue, but it isn't tagged as a high-risk problem. That only happens about 10 percent of the time. It shows a true positive 80-90 percent of the time.

Read full review

Carlos Vitrano

Cloud security director at Medallia

Provides quick visibility and significantly reduces alerts

Its integrations with third-party SIEMs can be better. That is one of the things that we discussed with them. We have integrations, for instance, with Splunk. The data that we are receiving in Splunk is huge, and it is valid because Lacework has a bunch of data that they can provide to you. However, to be able to import the data and create alerts, we needed to do some work, so integration is one of the things that they can improve. For container security, how they scan images and how they provide results is something that they need to continue improving in terms of visibility. We already have visibility to several artifacts, but they can take that to the next level and see what else they can do. There can be better integrations with CI/CD pipelines. There can be improvements in terms of how we can take action or how we can report from the number of inventories they are providing to us.

Read full review

CHINTAN MEHTA

Cloud Security Automation Engineer at a financial services firm with 10,001+ employees

Consolidating security tools with comprehensive cloud visibility

The documentation for Orca Security could be improved. The compliance framework also needs enhancements, especially concerning integrations with other tools like ServiceNow's vulnerability modules, which are not as mature as expected. It should also increase its capability to ingest data from other security tools like CloudSight for endpoint detection and provide real-time monitoring.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"For Singularity, the task capability is easy to use and it has a very intuitive dashboard, which streamlines the processes."

"SentinelOne Singularity Cloud Security can integrate all your cloud accounts and resources you create in the AWS account, We have set it up to scan the AWS transfer services, EC2, security groups, and GitHub."

"SentinelOne Singularity Cloud Security offers valuable scalability suitable for organizations of all sizes, from small businesses to large enterprises."

"I would rate SentinelOne Singularity Cloud Security a nine out of ten."

"I would rate this solution a nine out of ten."

"SentinelOne Singularity Cloud Security has a dashboard that can detect the criticality of a particular problem, whether it falls under critical, medium, or low vulnerability."

"SentinelOne Singularity Cloud Security offers security solutions for both Kubernetes and CI/CD pipelines."

"The most valuable feature of SentinelOne Singularity Cloud Security is its advanced AI and machine learning capabilities, which allow it to identify and respond to threats in real time."

More SentinelOne Singularity Cloud Security pros

"The most valuable feature, from a compliance perspective, is the ability to use Lacework as a platform for multiple compliance standards. We have to meet multiple standards like PCI, SOC 2, CIS, and whatever else is out there. The ability to have reports generated, per security standard, is one of the best features for me."

"The most valuable aspects are identifying vulnerabilities—things that are out there that we aren't aware of—as well as finding what path of access attackers could use, and being able to see open SSL or S3 buckets and the like."

"The most valuable feature is Lacework's ability to distill all the security and audit logs. I recommend it to my customers. Normally, when I consult for other customers that are getting into the cloud, we use native security tools. It's more of a rule-based engine."

"I find the cloud configuration compliance scanning mature. It generates a lot of data and supports major frameworks like ISO 27001 or SOC 2, providing reports and datasets. Another feature I appreciate is setting custom alerts for specific events. Additionally, I value the agent-based monitoring and scanning for compute nodes. It gives us deeper insights into our workloads and helps identify vulnerabilities across our deployed assets."

"The best feature, in my opinion, is the ease of use."

"For the most part, out-of-the-box, it tells you right away about the things you need to work on. I like the fact that it prioritizes alerts based on severity, so that you can focus your efforts on anything that would be critical/high first, moderate second, and work your way down, trying to continue to improve your security posture."

"There are many valuable features that I use in my daily work. The first are alerts and the event dossier that it generates, based on the severity. That is very insightful and helps me to have a security cap in our infrastructure. The second thing I like is the agent-based vulnerability management, which is the most accurate information."

"Polygraph compliance is a valuable feature. In our perspective, it delivers significant benefits. The clarity it offers, along with the ability to identify and address misconfigurations, is invaluable. When such issues arise, we promptly acknowledge and take action, effectively collaborating with our teams and the responsible parties for those assets. This enables us to promptly manage problems as soon as they arise."

More Lacework FortiCNAPP pros

"Orca's SideScanning is the biggest feature. It's the 'wow' factor... With Orca's SideScanning, they just need permissions for your account and that makes it so simple."

"Orca Security has patented technologies. It's an agentless solution, so you don't need to install an agent. Instead, it contacts your account provider and fetches metadata, eliminating the need for snapshots or reserved space to copy client infrastructure."

"I recommend Orca Security to others looking for a cloud security solution due to its seamless integration and side-scanning technology that does not hamper cloud asset performance."

"The reporting and automated remediation capabilities are valuable to me. They're real game-changers."

"Orca provides X-ray vision into everything within the cloud properties, whereas normally, this would require multiple tools."

"I find Orca Security's CIEM feature invaluable, as it focuses on entitlement and posture management, identifying assets with older OS versions, and asset misconfiguration."

"It's for protection. It's an agentless tool. We don't need to install anything at a customer's premises. We can just scan the entire assets in the cloud."

"Once our organization is configured, any cloud account under that organization is automatically detected in Orca Security, along with all the assets associated with it."

More Orca Security pros

Cons

"SentinelOne Singularity Cloud Security is an excellent CSPM tool, but its CWPP features need improvement, and there is scope for more application security posture management features."

"For SentinelOne, improvements could be made in managing Internet dependency as cloud-based operations can pose challenges in environments with limited connectivity."

"The could improve their mean time to detect."

"When we request any changes, they must be reflected in the next update."

"In some cases, the rules are strictly enforced but do not align with real-world use cases."

"It does not bring much threat intel from the outside world. All it does is scan. If it can also correlate things, it will be better."

"Cloud Native Security's reporting could be better. We are unable to see which images are impacted. Several thousand images have been deployed, so if we can see some application-specific information in the dashboard, we can directly send that report to the team that owns the application. We'd also like the option to download the report from the portal instead of waiting for the report to be sent to our email."

"I would like to see the map feature improve. It's good, but it isn't fully developed. It lets us use custom resources and policies but does not allow us to perform some actions. I would also like more custom integration and runtime security for Kubernetes."

More SentinelOne Singularity Cloud Security cons

"The biggest thing I would like to see improved is for them to pursue and obtain a FedRAMP moderate authorization... I don't believe they have any immediate plans to get FedRAMP moderate authorized, which is a bit of a challenge for us because we can only use Lacework in our commercial environment."

"The solution lacks a cohesive data model, making extracting the necessary data from the platform challenging. It uses its own LQL query language, and each database across different layers and modules is structured differently, complicating correlation efforts. Consequently, I had to create extensive custom reports outside Lacework because their default dashboards didn't communicate risk metrics. They're addressing these issues by redesigning their tools, including introducing the dashboard, which is a step closer to actionable insights but still needs refinement."

"There are a couple of the difficulties we encounter in the realm of cybersecurity, or security as a whole, that relate to potentially limited clarity. Having the capacity to perceive the configuration aspect and having the ability to contribute to it holds substantial advantages, in my view. It ranks high, primarily due to its role in guaranteeing compliance and the potential to uncover vulnerabilities, which could infiltrate the system and introduce potential risks. I had been exploring a specific feature that captured my interest. However, just yesterday, I participated in a product update session that announced the imminent arrival of this feature. The feature involves real-time alerting. This was something I had been anticipating, and it seems that this capability is now being integrated, possibly as part of threat intelligence. While anomaly events consistently and promptly appear in the console, certain alerts tend to experience delays before being displayed. Yet, with the recent product update, this issue is expected to be resolved. Currently, a comprehensive view of all policies is available within the console. However, I want a more tailored display of my compliance posture, focusing specifically on policies relevant to me. For instance, if I'm not subject to HIPAA regulations, I'd prefer not to see the HIPAA compliance details. It's worth noting that even with this request, there exists a filtering mechanism to control the type of compliance information visible. This flexibility provides a workaround to my preference, which is why it's challenging for me to definitively state my exact request."

"Lacework lacks remediation features, but I believe they're working on that. They're focused on the reporting aspect, but other features need to improve. They're also adding some compliance features, so it's not worth saying they need to get better at it."

"A feature that I have requested from them is the ability to sort alerts and policies based on a security framework. Right now, when you go into alerts, you have hundreds and hundreds of them that you have to manually pick. It would be useful to have categories for CIS Benchmark or SOC 2 and be able to display all the alerts and policies for one security framework."

"Visibility is lacking, and both compliance-related metrics and IAM security control could be improved."

"Its integrations with third-party SIEMs can be better. That is one of the things that we discussed with them."

"The configuration and setup of alerts should be easier. They should make it easier to integrate with systems like Slack and Datadog. I didn't spend too much time on it, but to me, it wasn't as simple as the alerting that I've seen on other systems."

More Lacework FortiCNAPP cons

"A notable limitation with Orca Security is its scanning feature. The automatic scan only runs every 24 hours, and if an alert is remediated within an hour, it still remains until the next scheduled scan."

"In the future, I'd like to see Orca work better with third-party vendors. Specifically, being able to provide sanitized results from third parties."

"We are PCI DSS compliant, so we need to scan our environment externally with tools vetted by the PCI DSS organization. Orca doesn't scan the environment externally. It only scans what's currently in the cloud."

"I think Orca could give me more alerts. It could give me a dashboard with all the specific types of alerts I want to see for the day. It should just be one click."

"Orca Security can be improved as there should be some kind of central pane of glass. Similar to how cloud management works, Orca Security should have something comparable."

"As with all software, the user interface can always be made simpler to use. It would be helpful for people with very little knowledge, like somebody sitting behind the SOC, to allow them to be able to drill down into things a little bit easier than it is currently."

"The interface can be a bit cranky and sometimes takes a lot of time to load."

"The main drawback in an agentless approach is that if the solution detects a virus or malware in the environment, we need to manually remove it. But from my experience with other production environments, it's not straightforward to install agents in the hope they will automatically remediate viruses, even from production environments... Ultimately, the ability to auto-remediate is something that I would like to see."

More Orca Security cons

Pricing and Cost Advice

"While I'm slightly out of touch with pricing, I know SentinelOne is much cheaper than other products."

"PingSafe's pricing is good because it provides us with a solution."

"I would rate the cost a seven out of ten with ten being the most costly."

"SentinelOne provided competitive pricing compared to other vendors, and we are satisfied with the deal."

"PingSafe is not very expensive compared to Prisma Cloud, but it's also not that cheap. However, because of its features, it makes sense to us as a company. It's fairly priced."

"It is cost-effective compared to other solutions in the market."

"PingSafe's primary advantage is its ability to consolidate multiple tools into a single user interface, but, beyond this convenience, it may not offer significant additional benefits to justify its price."

"PingSafe is fairly priced."

More SentinelOne Singularity Cloud Security pricing and cost advice

"The licensing fee was approximately $80,000 USD, per year."

"My smaller deployments cost around 200,000 a year, which is probably not as expensive as Wiz."

"The pricing has gotten better. That scenario was somewhat unstable. They have a rather interesting licensing structure. I believe you get 200 resources per "Lacework unit." It was difficult, in the beginning, to figure out exactly what a "resource" was... That was a problem until about a year or so ago. They have improved it and it has stabilized quite a bit."

"It is slightly expensive. It depends on how big your environment is, but it is expensive. Right now, we are spending a lot of money. We have covered all of the cloud providers and most of our colocation facilities as well, so we cannot complain, but it is slightly expensive. It is not super expensive."

"Orca Security is cheaper compared to other solutions in the same space."

"Orca is very competitive when compared to the alternatives and is not the most expensive in the market, that's for sure."

"Overall, the pricing is reasonable and the discounts have been acceptable."

"While it's competitive with Palo Alto Prisma, I think Orca's list price is very high. I would advise Orca to lower it because, at that price, I might consider alternatives like Wiz, which also offers agentless services."

"The pricing depends on how many assets you have running in your cloud and how many environments you have. If you have a dev environment, test environment, and a production environment then it's really important that you have coverage for all of them."

"The most expensive solution is Palo Alto. They claim to be very robust. The next most expensive is Wiz, followed by Orca and all the rest."

"Orca Security charges are based on cloud workloads. So, it's based on workloads. If we look at one feature, it might be expensive."

"The price is a bit expensive for smaller organizations."

More Orca Security pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Cloud Security Posture Management (CSPM) solutions are best for your needs.

See recommendations

868,787 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

16%

Financial Services Firm

15%

Manufacturing Company

10%

Government

Computer Software Company

15%

Financial Services Firm

13%

University

Manufacturing Company

Computer Software Company

15%

Financial Services Firm

13%

Manufacturing Company

10%

University

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	44
Midsize Enterprise	21
Large Enterprise	53

By reviewers
Company Size	Count
Small Business	4
Midsize Enterprise	4
Large Enterprise	3

By reviewers
Company Size	Count
Small Business	9
Midsize Enterprise	7
Large Enterprise	5

Questions from the Community

What do you like most about PingSafe?

The dashboard gives me an overview of all the things happening in the product, making it one of the tool's best featu...

See all answers

What is your experience regarding pricing and costs for PingSafe?

I don't handle the price part, but it isn't more expensive than Palo Alto Prisma Cloud. It's not cheap, but it is wor...

See all answers

What needs improvement with PingSafe?

There is scope for more application security posture management features. Additionally, the runtime protection needs ...

See all answers

What is your experience regarding pricing and costs for Lacework?

My smaller deployments cost around 200,000 a year, which is probably not as expensive as Wiz.

See all answers

What needs improvement with Lacework?

The solution lacks a cohesive data model, making extracting the necessary data from the platform challenging. It uses...

See all answers

What is your primary use case for Lacework?

We use the tool for two main purposes: vulnerability management and monitoring. We utilize it to scan all of our IAC ...

See all answers

What do you like most about Orca Security?

It's for protection. It's an agentless tool. We don't need to install anything at a customer's premises. We can just ...

See all answers

What needs improvement with Orca Security?

I really love the way Orca Security worked. A potential improvement could be additional security features for the two...

See all answers

What is your primary use case for Orca Security?

We used Orca Security ( /products/orca-security-reviews ) for about two to three months until I left the company. The...

See all answers

Comparisons

Prisma Cloud by Palo Alto Networks vs SentinelOne Singularity Cloud Security

Compared 12% of the time

Wiz vs SentinelOne Singularity Cloud Security

Compared 11% of the time

AWS GuardDuty vs SentinelOne Singularity Cloud Security

Compared 8% of the time

Microsoft Defender for Cloud vs SentinelOne Singularity Cloud Security

Compared 5% of the time

Check Point CloudGuard CNAPP vs SentinelOne Singularity Cloud Security

Compared 4% of the time

More SentinelOne Singularity Cloud Security Competitors

Wiz vs Lacework FortiCNAPP

Compared 18% of the time

Prisma Cloud by Palo Alto Networks vs Lacework FortiCNAPP

Compared 13% of the time

AWS GuardDuty vs Lacework FortiCNAPP

Compared 6% of the time

Tenable Cloud Security vs Lacework FortiCNAPP

Compared 6% of the time

Snyk vs Lacework FortiCNAPP

Compared 3% of the time

More Lacework FortiCNAPP Competitors

Wiz vs Orca Security

Compared 28% of the time

Microsoft Defender for Cloud vs Orca Security

Compared 9% of the time

Prisma Cloud by Palo Alto Networks vs Orca Security

Compared 5% of the time

Upwind vs Orca Security

Compared 5% of the time

AWS Security Hub vs Orca Security

Compared 3% of the time

More Orca Security Competitors

Product Reports

Buyer's Guide

SentinelOne Singularity Cloud Security

September 2025

SentinelOne Singularity Cloud Security report

Download SentinelOne Singularity Cloud Security product report

Buyer's Guide

Lacework FortiCNAPP

September 2025

Download Lacework FortiCNAPP product report

Buyer's Guide

Orca Security

September 2025

Download Orca Security product report

Also Known As

PingSafe

Polygraph, FortiCNP

No data available

Overview

SentinelOne Singularity Cloud Security offers a streamlined approach to cloud security with intuitive operation and strong integration capabilities for heightened threat detection and remediation efficiency.

Singularity Cloud Security stands out for its real-time detection and response, effectively minimizing detection and remediation timelines. Its automated remediation integrates smoothly with third-party tools enhancing operational efficiency. The comprehensive console ensures visibility and support for forensic investigations. Seamless platform integration and robust support for innovation are notable advantages. Areas for development include improved search functionality, affordability, better firewall capabilities for remote users, stable agents, comprehensive reporting, and efficient third-party integrations. Clarity in the interface, responsive support, and real-time alerting need enhancement, with a call for more automation and customization. Better scalability and cost-effective integration without compromising capabilities are desired.

What are SentinelOne Singularity Cloud Security's standout features?

Ease of Use: Intuitive operation simplifies navigation across platforms.
Real-Time Detection: Quick identification and response to threats.
Automated Remediation: Streamlines recovery processes with integration capabilities.
Forensic Visibility: Aids in thorough threat analysis and prevention strategies.
Comprehensive Console: Offers full visibility and historical data tracking.
Platform Integration: Supports seamless operation across cloud and hybrid environments.

What benefits should users expect from SentinelOne Singularity Cloud Security?

Enhanced Efficiency: Automation and third-party integration improve threat response.
Improved Detection: Reduces mean time to detect and respond to threats.
Operational Support: Comprehensive visibility and forensic tools aid operational decisions.
Cost Efficiency: Affordable integration with scaling capabilities without high overhead.

SentinelOne Singularity Cloud Security is deployed in industries needing robust cloud security posture management, endpoint protection, and threat hunting. Utilized frequently across AWS and Azure, it assists in monitoring, threat detection, and maintaining compliance in diverse environments while providing real-time alerts and recommendations for proactive threat management.

SentinelOne

Lacework FortiCNAPP provides robust cloud security, combining vulnerability management and multi-cloud insight with user-friendly controls, machine learning detection, and compliance support.

Lacework FortiCNAPP specializes in cloud security by merging machine learning anomaly detection with agent-based vulnerability management to offer detailed alerts and compliance reports. Its comprehensive approach allows continuous monitoring across AWS and Kubernetes, providing insights from an attacker's perspective. The platform offers automation and seamless Slack integration, facilitating collaborative and efficient cloud security management. Users value its ability to handle multi-cloud environments and scan IAC scripts, configurations, and compute nodes across AWS and GCP.

What are the key features?

Machine Learning Detection: Identifies anomalies effectively.
Compliance Reports: Provides precise compliance documentation.
Vulnerability Management: Supports agent-based vulnerability assessments.
Multi-Cloud Support: Manages and secures across multiple cloud providers.
Automation and Collaboration: Enables integration with Slack for streamlined communication.
Custom Alerts: Allows creation of personalized alerts for better focus.

What benefits do users expect?

Reduced Alert Noise: Minimizes distractions with filtered alerts.
Efficient Cloud Security: Automates processes for enhanced security management.
Collaboration Support: Integrates with tools like Slack.
Insightful Perspective: Provides insight from an attacker's viewpoint.

Organizations across sectors leverage Lacework FortiCNAPP for cloud security, focusing on compliance, security posture, and vulnerability management. It is widely used for monitoring AWS and Kubernetes environments, scanning IAC scripts, configurations, and securing compute nodes. It supports multi-cloud security posture management and log ingestion, enabling companies to maintain strong cloud infrastructures without dedicated security layers.

Fortinet

Orca Security is the pioneer of agentless cloud security that is trusted by hundreds of enterprises globally. Orca makes cloud security possible for enterprises moving to and scaling in the cloud with its patented SideScanning™ technology and Unified Data Model. The Orca Cloud Security Platform delivers the world's most comprehensive coverage and visibility of risks across AWS, Azure, Google Cloud and Kubernetes.

At Orca Security, we’re on a mission to make it fast, easy, and cost effective for organizations to address critical cloud security issues so they can operate in the cloud with confidence.

Key Platform Features:

Agentless: Complete, centralized coverage of the entire cloud estate, without the need for installing and configuring agents or layering together multiple siloed tools. Full visibility of cloud misconfigurations, vulnerabilities, workload protection, malware scanning, image scanning, file integrity monitoring and more.
Asset Inventory: Get a complete inventory of all your public cloud assets, including detailed information on installed OSes, software, and applications, as well as data and network assets such as storage buckets, Virtual Private Clouds (VPCs), and Security Groups.

Attack Path Analysis: Visualize attack vectors to critical assets or crown jewels. See which assets are susceptible to lateral movement, assume roles, privilege escalation, and more.

Risk Prioritization: Prioritize the 1% of risks that matter the most, based on impact scores. Secure the vulnerabilities and misconfigured targets (critical assets) and eliminate the potential risks residing on the attack paths to those targets.
Cloud Threat Detection: Monitor for malicious activity within your entire cloud estate. Be aware of detected threats, user behavior anomalies and more.

Breach Forensics: Log every change and all activity into a central repository for investigation procedures to confirm or deny entry and compromises within the cloud estate.
Cloud To Dev (Shift Left): Orca’s built-in shift left capabilities enables DevOps to focus more security attention earlier in the CI/CD pipelines. Security teams are able to trace a production risk (misconfiguration or vulnerability) directly to the original source code repository from which it came, even down to the exact line of code that is at the root of the identified risk.
Compliance: Choose from over 60 preconfigured compliance frameworks, cloud security best practices, CIS Benchmarks, or design and build your own compliance framework for fast and continuous reporting.
Security Score: The Orca Security Score is found on Orca’s Risk Dashboard and is updated daily. The overall score is calculated based on performance in the following five categories - Suspicious Activity, IAM, Data at Risk, Vulnerable Assets, and Responsiveness. Since the scores are percentage based and not raw numbers, you can objectively make comparisons to other organizations within your industry or business units of different sizes. In addition to reporting to senior management, the Orca Security Score can help with internal self-monitoring, as a way of measuring risk mitigation efforts, to know where to focus efforts, and track progress.

Orca Security Benefits

Consolidate technologies to reduce costs and complexity:

“The more I can get out of this one solution, the better. I see Orca as the tool where we get all cloud-related security data.” - Joshua Scott, Head of Security and IT | Postman

Avoid costly breaches:

"I look at proactive asset discovery, configuration management, and vulnerability management as being able to find a vulnerability before the bad guys do and being able to deal with it before something exploits it. This is what Orca does for us." - Doug Graham, CSO & CPO | Lionbridge

Increase team productivity and efficiency by focusing on high-value activities and solving the 1% of risks that matter most:

"Orca is unique in that it locates vulnerabilities with precision and delivers tangible, actionable results – without having to sift through all the noise." - Aaron Brown, Senior Cloud Security Engineer | Sisense

Quick Time-to-Value with Immediate ROI:

"Orca told us we could have some visibility within 5 or 10 minutes, and I thought, ‘There’s no way.’ Well, I was wrong. They really did it." - Thomas Hill, CISO | Live Oak Bank

Reduce MTTR and remove operational friction:

“We can’t ask developers things like ‘Did you think about security? When you start a new VM on AWS, can you please let me know so I’m able to scan it? Can you please deploy an agent on that machine for me?’ We need a better way to work. Orca provides that better way by eliminating organizational friction.” - Erwin Geirnaert, Cloud Security Architect | NG Data

Orca Security

Sample Customers

Information Not Available

J.Crew, AdRoll, Snowflake, VMWare, Iterable, Pure Storage, TrueCar, NerdWallet, and more.

BeyondTrust, Postman, Digital Turbine, Solarisbank, Lemonade, C6 Bank, Docebo, Vercel, and Vivino

Buyer's Guide

Lacework FortiCNAPP vs. Orca Security

September 2025

Free Report: Lacework FortiCNAPP vs. Orca Security

Find out what your peers are saying about Lacework FortiCNAPP vs. Orca Security and other solutions. Updated: September 2025.

DOWNLOAD NOW

868,787 professionals have used our research since 2012.

See our Lacework FortiCNAPP vs. Orca Security report.

See our list of best Cloud Security Posture Management (CSPM) vendors, best Vulnerability Management vendors, and best Container Security vendors.

We monitor all Cloud Security Posture Management (CSPM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.