No more typing reviews! Try our Samantha, our new voice AI agent.

Orca Security vs WithSecure Elements Exposure Management (XM) comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Jan 18, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Qualys TotalCloud
Sponsored
Ranking in Vulnerability Management
10th
Ranking in Cloud Security Posture Management (CSPM)
7th
Average Rating
8.6
Reviews Sentiment
7.2
Number of Reviews
41
Ranking in other categories
Container Security (11th), Cloud Workload Protection Platforms (CWPP) (7th), SaaS Security Posture Management (SSPM) (2nd), Cloud-Native Application Protection Platforms (CNAPP) (6th)
Orca Security
Ranking in Vulnerability Management
7th
Ranking in Cloud Security Posture Management (CSPM)
6th
Average Rating
8.8
Reviews Sentiment
7.0
Number of Reviews
41
Ranking in other categories
Container Security (7th), Cloud Workload Protection Platforms (CWPP) (5th), API Security (2nd), Cloud-Native Application Protection Platforms (CNAPP) (5th), Data Security Posture Management (DSPM) (6th), Cloud Detection and Response (CDR) (2nd), AI Security (1st)
WithSecure Elements Exposur...
Ranking in Vulnerability Management
77th
Ranking in Cloud Security Posture Management (CSPM)
38th
Average Rating
10.0
Reviews Sentiment
6.6
Number of Reviews
1
Ranking in other categories
Continuous Threat Exposure Management (CTEM) (26th)
 

Mindshare comparison

As of August 2026, in the Vulnerability Management category, the mindshare of Qualys TotalCloud is 1.2%, up from 1.0% compared to the previous year. The mindshare of Orca Security is 2.3%, down from 3.8% compared to the previous year. The mindshare of WithSecure Elements Exposure Management (XM) is 0.5%, up from 0.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Vulnerability Management Mindshare Distribution
ProductMindshare (%)
Orca Security2.3%
Qualys TotalCloud1.2%
WithSecure Elements Exposure Management (XM)0.5%
Other96.0%
Vulnerability Management
 

Featured Reviews

RO
IT Security Expert at Alior Bank S.A.
Unified risk scoring has improved our cloud visibility and simplifies remediation priorities
Qualys TotalCloud provides unified vulnerability and threat assessment across both IAS and SaaS. This solution provides a single prioritized view of risk, which helps reduce the work I would have to do. We are no longer based on CVSS; we are based on Qualys risk scoring, which is based on CVSS plus internal findings made by Qualys, and then assigns its own score. The TruRisk insight feature has found a small number of assets with high vulnerability scores, though I am cautious since some information is classified. Qualys TotalCloud has positively impacted our bank's performance, and we have definitely seen benefits after implementing this solution.
Nykole Denoo - PeerSpot reviewer
Cyber Security Analyst at BNY
Cloud risk visibility has transformed how I prioritize threats and reduce unnecessary spend
From my perspective, Orca Security is a really good tool. I would say one area I would like to see CNAPP platforms get is more intelligence when it comes to risk prioritization, which correlates with vulnerability, exposing assets, identities, and active threats to help the security team focus on risks that are more likely to be exploited. I am a huge advocate for automation. I also think deeper automation for remediation or stronger integration with ticketing and CI/CD pipelines or more customization would help. Executive reporting would help the security team respond significantly faster and communicate risk more effectively if those kinds of improvements are made.
PP
System Specialist at Fix-Forum Oy
Stable, scalable, and can be deployed on both cloud and on-premises
We usually need the solution to have extra protection against data breaches, as we have seen with our customers. The solution is deployed on the public cloud The solution works both outside and on-premises of the company, thus preventing secondary breaches from reaching the company's data. The…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Qualys TotalCloud has significantly improved our organization by automating our reporting processes, reducing the time spent on report creation from two hours to less than fifteen to twenty minutes."
"The best feature would be the ability to create policies. It is easy to control and update policies as required."
"I appreciate Qualys TotalCloud's ability to onboard any type of device with ease, including containers."
"By integrating TotalCloud, we have significantly reduced vulnerabilities in our deployment pipeline."
"The platform's unified view of the organization proves particularly valuable for leadership team meetings."
"Generally, Qualys is very good at detections, whether on cloud or on-prem, and the agent allows deployment on both infrastructures, providing continuous monitoring of your assets, which is a key selling point for us."
"TruRisk Insights is the most important innovation they've released this year."
"With TotalCloud, we can scan through the API. If we are not able to deploy cloud agents on the machine, we can use the API."
"Orca Security is easier to use than other alternatives; you need a little skill to dominate Orca Security compared to other options and Orca Security is more user-friendly and in this case is more enjoyable."
"Orca Security has helped significantly to reduce the time it took to identify or prioritize cloud security alerts because of the way it provides a centralized view of risk and correlated findings across the cloud environment."
"Orca Security has helped reduce the time it takes to address cloud security alerts."
"For me, it's a no-brainer to have Orca running in your cloud."
"Overall, I'm thoroughly impressed with this product, which is the best way I can put it."
"We really enjoy using Orca; it's a very well-designed, well-executed product, I'm really super-impressed, this is a game-changer."
"It's for protection. It's an agentless tool. We don't need to install anything at a customer's premises. We can just scan the entire assets in the cloud."
"With its Cloud Security Posture Management capability, we have the ability to read across all of our cloud-based environments, which includes AWS and Azure. We have visibility into those environments. Seeing all vulnerabilities and configurations is really powerful for us, but ultimately, the ability to use the API to query across the fleet to understand what is the current state, what is the patch level, which ones are potentially exposed for a new CVE that just came out is even more valuable. It allows us to gather really specific intelligence through simple queries."
"The solution works both outside and on-premises of the company, thus preventing secondary breaches from reaching the company's data."
 

Cons

"Their support could be improved."
"The areas in the solution that have room for improvement include the UI/UX design, which should be improved, and they should integrate more artificial intelligence into the product."
"The support process is inefficient due to the excessive number of replies required when submitting tickets."
"An area for improvement would be to focus on risks related to AI, such as large language models and potential data leakage."
"There should be improvement from a dashboard perspective when collecting and showcasing data to lead management."
"I would appreciate additional integration options to connect Qualys TotalCloud with our other vulnerability management tools."
"From a downside perspective, the UI is not user-friendly and feels dated compared to other tools like Prisma Cloud."
"Qualys's ticketing system can be confusing when assigning tasks to individuals, and support could be improved by offering instant call solutions with engineers in addition to ticket replies."
"I have concerns about OCI support. When I work with Orca Security, the support for OCI is limited, so I cannot effectively work with the OCI environment."
"I would like to see an option to do security checks on a code level. This is possible because they have access to all of the code running in the cloud provider, and combining their site-scanning solution with that would be a nice add-on."
"I believe they need more time developing this solution, which means they need to be more comprehensive and extended in their approach."
"In two implementation projects that I participated in, the customers reported difficulty with the options for generating specific reports."
"The interface can be a bit cranky and sometimes takes a lot of time to load."
"The timeout settings could be made more customizable, as sometimes if I leave the office early, it's still running unless manually turned off."
"I would be happy if they offered more automatic remediation options."
"The main drawback in an agentless approach is that if the solution detects a virus or malware in the environment, we need to manually remove it. But from my experience with other production environments, it's not straightforward to install agents in the hope they will automatically remediate viruses, even from production environments... Ultimately, the ability to auto-remediate is something that I would like to see."
"The cost of the solution has room for improvement."
 

Pricing and Cost Advice

"I am not sure about the pricing. From what I understand, it is a bit on the higher side, but I do not have the exact numbers."
"The pricing is comparable. It is built into our other product, so I cannot piecemeal it. It is a part of our subscription."
"Qualys TotalCloud is cost-efficient and was selected for its value compared to other products."
"Qualys TotalCloud offers cost-effective licensing flexibility."
"While Qualys TotalCloud's pricing is currently acceptable, it is becoming increasingly expensive and may soon be considered overpriced."
"It isn't cheap, but it's reasonable. It helps us to manage things with very few resources."
"TotalCloud's price is about right where I would expect it to be."
"The pricing for TotalCloud is attractive and competitive in the market. Given the features, especially the dashboard, I have no concerns regarding pricing."
"Orca Security charges are based on cloud workloads. So, it's based on workloads. If we look at one feature, it might be expensive."
"Its license is a bit expensive."
"Orca is very competitive when compared to the alternatives and is not the most expensive in the market, that's for sure."
"It is the cost of the visibility that you get. When you really sit down and think about what do you need to do to secure an environment with a low impact on the business, and you take a look out into the world, I think this tool is well justified around cost."
"We have a total of 25 licenses for this solution. The solution is on a pay-and-you-use model."
"The pricing depends on how many assets you have running in your cloud and how many environments you have. If you have a dev environment, test environment, and a production environment then it's really important that you have coverage for all of them."
"Orca Security is cheaper compared to other solutions in the same space."
"The price is a bit expensive for smaller organizations."
"The cost of the solution is mid-ranged but worth the price."
report
Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.
908,834 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Manufacturing Company
13%
Outsourcing Company
12%
Comms Service Provider
10%
Financial Services Firm
10%
Financial Services Firm
14%
Computer Software Company
12%
Manufacturing Company
10%
Outsourcing Company
7%
No data available
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business11
Midsize Enterprise5
Large Enterprise30
By reviewers
Company SizeCount
Small Business18
Midsize Enterprise9
Large Enterprise16
No data available
 

Questions from the Community

What needs improvement with Qualys TotalCloud?
To be totally honest, I do not have any best features because I have had a bad experience using this tool, especially...
What is your primary use case for Qualys TotalCloud?
My main use case for Qualys TotalCloud is vulnerability management and exposure management. I use this tool to evalua...
What needs improvement with Orca Security?
Regarding how Orca Security can be improved, I think there is not much; it is fully completed and it is great.
What is your primary use case for Orca Security?
My main use case for Orca Security is to secure infrastructure, course, and service. A specific example of how I use ...
What advice do you have for others considering Orca Security?
My advice to others looking into using Orca Security is to practice and study the platform in test scenarios. My impr...
Ask a question
Earn 20 points
 

Also Known As

Qualys TotalCloud with FlexScan
No data available
No data available
 

Interactive Demo

Demo not available
Demo not available
 

Overview

 

Sample Customers

Information Not Available
BeyondTrust, Postman, Digital Turbine, Solarisbank, Lemonade, C6 Bank, Docebo, Vercel, and Vivino
Information Not Available
Find out what your peers are saying about Wiz, Tenable, Qualys and others in Vulnerability Management. Updated: July 2026.
908,834 professionals have used our research since 2012.