Orca Security Reviews

My use cases for Orca Security include working with the sales team and the pre-sales team to offer Orca Security in the Chilean market with an integrator or a partner of Orca Security. The real impact when the client or the potential client sees the POC is truly awesome because you can have 100% visibility since Orca Security provides full coverage across your entire cloud estate across AWS, Azure, and GCP within minutes, finding shadow assets that traditional tools like Cortex or Prisma from Palo Alto cannot detect.

Orca Security has other strategic features such as CNAPP or Cloud Network Application Protection Platform capabilities, including CSPM (Cloud Security Posture Management). You can detect misconfiguration and ensure compliance with frameworks like SOC 2, ISO 27001, or GDPR of the European Union. Another valuable feature is the Cloud Workload Protection Platform, where you can identify vulnerabilities such as CVEs, malware, and exposed secrets such as API keys or passwords inside your workloads during scanning. Another feature is Cloud Infrastructure Entitlement Management, where you can manage identities and permissions to enforce least privilege and find overprivileged accounts. Finally, there is Data Security Posture Management, where Orca Security can automatically discover and protect sensitive data such as PII and PHI to prevent data breaches.

Orca Security is a really strong product because it has a lot of different differentiators. Orca Security is based on agentless side scanning, so it has the ability to scan cloud workloads including virtual machines, containers, and serverless infrastructure all without installing any software or agents. This results in zero performance impact on production, which I think is the most important thing in the market share or in an eventual Gartner Quadrant.

Orca Security helps in preventing risks and attacks across the application lifecycles by scanning not only the apps in production, but also the apps or microservices in development. This provides complete visibility to your infrastructure.

The price is one thing I would like to see improved because the pricing is a little elevated, as the pricing is based on the quantity of workloads. However, I think that since Orca Security is a medium company, you can negotiate the pricing if you are a medium company.

My experience with Orca Security is recent, approximately eight months ago.

We had a problem with the uptime with a really important client. I think the capability to respond to those kinds of issues was a little vague. I found it a little unprofessional.

I find Orca Security scalable. On a scale of one to ten, I would rate it six or seven.

The problem with the Orca Security technical support team and customer service team is that Orca Security is a medium company and I think they do not have a large team. If you have a lot of problems, you will receive an unprofessional service or unprofessional customer service because you do not have an entire team to respond to all of those kinds of problems.

I would rate the technical support team as a six.

The deployment is frictionless, and I think that feature is one of the most important.

I remember that the read-only connection is the deployment model we were using for Orca Security. Deployment is completely out of band, so we simply connect Orca Security through a read-only IAM role or service account at the cloud root level. You need root access.

The ROI or return on investment with Orca Security might be favorable. The TCO or Total Cost of Ownership is an important term. While the initial sticker price might be higher than point solutions, the total cost of ownership is much lower. This is because you do not need a team of five persons to install and update the agents in thousands of servers. The operational overhead is equal to zero.

I have not worked with the Orca Security Cloud Cost Optimization feature. The price is one thing I would like to see improved because the pricing is a little elevated, as the pricing is based on the quantity of workloads. However, since Orca Security is a medium company, you can negotiate the pricing if you are a medium company.

I did not evaluate other options.

Overall, my impressions of the risk detection and identification capabilities of Orca Security are that it has the capability to scan and show you all your infrastructure. If you have any kind of vulnerabilities, you can see them. It is very important to see all your infrastructure and all the possible ways to have vulnerabilities. Another important thing is if you need to scan all your workloads.

Overall, I think Orca Security is the leader because of the strategic features I mentioned. It is easy to analyze and detect breaches, anomalies, and misconfiguration. It is a tool that is designed to be very user-friendly.

The real value of Orca Security is not just finding vulnerabilities but reducing the noise so the security team can focus on the critical attack path. Orca Security is a really complete tool for cloud security. I think Orca Security reduces alert volume by focusing only on the one percent of risk that actually matters, which I refer to as the one percent rule. Orca Security filters the noise and reduces alert fatigue.

My advice for other organizations considering Orca Security is to remember that Orca Security is a great product, but the team should work on customer service. I gave this review an overall rating of eight.

Public Cloud

My main use case for Orca Security is to protect our cloud infrastructure. Specifically, I scan our cloud workloads with Orca Security to detect vulnerabilities and help determine what to prioritize for patching and upgrading.

Orca Security helps me decide what to prioritize for patching and upgrading with its workload protection features that work really well and help contextualize and prioritize the issues it finds.

The best features Orca Security offers are cloud security and its shift-left features. The shift-left features of Orca Security help detect issues earlier in the software development lifecycle, benefiting my team day-to-day.

Orca Security has positively impacted my organization by helping us become more secure by flagging and prioritizing issues.

My impressions of the risk detection and identification capabilities of Orca Security are that they are very good because it helps contextualize and prioritize the issues for us to work on.

Orca Security has helped in preventing risks and attacks across my application lifecycle by highlighting insecure configurations or vulnerabilities that do not yet have an exploit so that we can resolve those issues before they become more critical.

My impression of Orca Security's ability to analyze risks contextually and holistically is that it seems quite good because it has visibility of our entire cloud infrastructure and can gather additional context to help prioritize and inform on issues.

Sometimes with Orca Security, it is a little bit hard for me to differentiate between different ephemeral cloud workloads and what the actual root cause of a particular issue is. I rate it a nine because of the issues with ephemeral workloads that I mentioned, which kept it from being a perfect ten.

I have been using Orca Security for four years.

Orca Security is stable.

The scalability of Orca Security is very good.

I find the customer support for Orca Security to be good.

I did not previously use a different solution.

My experience with pricing, setup cost, and licensing is that the pricing was about on par with other options, the setup was very easy, and licensing is quite straightforward.

Although I do not have well-defined ROI with Orca Security, it has prevented us from needing additional employees, and it has certainly saved time.

My experience with pricing, setup cost, and licensing is that the pricing was about on par with other options, the setup was very easy, and licensing is quite straightforward.

Before choosing Orca Security, I evaluated other options, which included Google Security Command Center, Prisma Cloud, and Qualys.

Orca Security has helped my organization reduce the time it takes to address cloud security alerts; since bringing Orca Security in, it has improved our time to resolve by about fifty percent.

I find it very easy to prioritize risks using Orca Security.

Regarding Orca Security's AI capabilities, I think their governance and security are pretty good because I use those capabilities as well.

I have not seen any issues with the accuracy and reliability of Orca Security's AI output; it seems accurate.

My advice to others looking into using Orca Security is to try to consider organizing assets by business units just to help organize and prioritize findings relevant to different teams. I rate Orca Security a nine overall.

Public Cloud

Google

I implement Orca Security on B3 to improve my security maturity in cloud environments, mitigate risks, and correct vulnerabilities and resolve some issues.

I appreciate Orca Security because I can see CSPM, KSPM, and DSPM. Orca Security works with major frameworks on security, such as NIST and CIS, allowing me to see comprehensive insights on my cloud environment. I appreciate the Orca Security CI/CD integration, the shift-left configuration, which helps me improve cloud maturity and DevSecOps maturity. From my perspective, Orca Security is a complete CNAPP platform with the most capabilities to work with cloud security.

I have concerns about OCI support. When I work with Orca Security, the support for OCI is limited, so I cannot effectively work with the OCI environment.

I have used Orca Security for one year.

I do not see any lagging, crashing, or downtime in Orca Security. In my time working with Orca Security, I have not experienced downtime on the platform.

I think the scalability of Orca Security is good. I did not have a problem with scalability, as it works effectively for my scenario and environment.

In my case, I had technical support, and it is easy to contact the technical support. The quality of the support is good. If I were to rate the support on a scale from one to ten, I would give it an eight.

Positive

I worked with Prisma Cloud, an alternative platform for cloud security from Palo Alto, and I worked with the Rapid7 platform as well as Tenable, so there are other vendors with the same concept platform as Orca Security.

The initial deployment of Orca Security is easy; it is just plug-and-play on the cloud environment. When I deployed Orca Security for the first time, it took me around two days for cloud environments, no more.

A team is needed for deployment; one person cannot deploy it.

I see the benefits of Orca Security immediately because you can see the issues right after deployment, and you can correct the critical issues, so the proof of value is immediate.

Compared with other vendors, the Orca Security pricing is very competitive, and I think it is a good price compared with the other vendors.

I do not use Orca Security agentless exclusively for vulnerabilities. I appreciate Orca Security because it is a complete platform and its cost is very small compared with other vendors. I think the user interface of Orca Security is very intuitive, friendly, and easy to use. It takes me very little time to learn how to use Orca Security; I find it very easy to learn, and the documentation is online and intuitive. Overall, I would rate Orca Security at a nine out of ten.

Public Cloud

Other

Orca Security serves as a centralized solution within our organization that offers scanning of all issues found in our cloud accounts. We have AWS, Azure, and GCP, and Orca Security identifies best practices we are not following or configurations that are not optimal. Orca Security automatically finds these issues and generates reports for us.

For example, if we have any EBS volumes or file systems which are not encrypted, Orca Security scans all cloud resources and detects such misconfigurations. These issues are then flagged in the report and we act on them accordingly.

The best feature I appreciate about Orca Security is its reporting functionality. The dashboard is very clear and concise, and it helps filter multiple accounts by issue type. Exporting the dashboard into an Excel sheet provides a good user experience.

To ensure we remain compliant, Orca Security's dashboard is really helpful in tracking the issues we have, with the end goal of always being compliant with our compliance standards and organizational requirements. It helps significantly with that.

Orca Security has helped our organization become compliant and maintain high standards because any organization with multiple products needs to be compliant, especially when it comes to underlying infrastructure and cloud resources. Orca Security helps tremendously in that regard.

Orca Security could benefit from more agentic workflows, where agentic workflows could be integrated with Orca Security to provide a quick view of large reports and issues we have. Additionally, data analytics capabilities could be improved.

I have been using Orca Security for the last five years.

Orca Security is quite stable.

Scalability is good. So far, we have not faced any issues related to scalability when using it or the underlying infrastructure on AWS. It is quite responsive and we have not encountered any issues. Orca Security provides a highly scalable architecture for us.

We have used only Orca Security.

We save a lot of time now. We have also implemented automations from our side so that people receive reports automatically, whether they are Orca Security IVM issues or Orca Security issues related to any resource. This has been really helpful.

We did not evaluate alternate solutions because this organization initiated Orca Security centrally. We do not have much control over it as I am just a user.

The advice I would give is that you can make good use of the issues depending on different organizational use cases. Try your best to have all Orca Security issues into one dashboard and then export them. Additionally, making it more AI-enabled would be beneficial because when you have multiple Excel sheets exported with all the data, that data can be visualized in a better way. I would rate this review a 9.

Public Cloud

Amazon Web Services (AWS)

My main use case for Orca Security is cloud security posture management for our cloud in the company.

A specific example of how I use Orca Security for cloud security posture management is that we connect Orca Security to our main cloud providers, it scans all of the configurations, and it lets us know if we have risks in our configurations and how to mitigate them, and also it helps us to prioritize those risks.

I would also like to add that we are evaluating using Orca Security for scanning Infrastructure as Code and scripts.

In my opinion, the best features Orca Security offers include the integration to our cloud services, which is smooth, easy, and plug and play, along with its effectiveness in prioritizing risks, taking into account all of the different factors that make a risk—not only vulnerabilities but also if you have sensitive data or if you have your cloud resources exposed, giving you the risk based on that context, which helps you to prioritize the risks to know where to mitigate first.

This has changed the way my team works and responds to threats because it saves us a lot of time and helps us to focus on the real risk rather than all of the alerts that we receive, as we have a lot; therefore, we cannot fix everything and need to prioritize, making the way that Orca Security prioritizes the risks key for us.

Orca Security has impacted my organization positively by giving us visibility on what is happening in the cloud and helping us detect risks fast. Before Orca Security, we did not have that visibility, and we had to manually check our cloud to understand if we had risks. Today, with Orca Security, we are comfortable and feel that we have the visibility that we need in the cloud to be sure that we do not have risks there.

I would add that the CDR, the Cloud Detection and Response that Orca Security offers, could be improved as it is not the best functionality that it offers. Orca Security is good at posture, but not at the response and alerting in real time.

Orca Security can be improved as it is very good at posture, but it does not detect attacks or behavioral attacks in the cloud on its own; it depends on other security features or logs like GuardDuty from Amazon, lacking its own intelligence to detect and respond to attacks.

Additionally, it could be useful if Orca Security has more context on the network and how the resources are exposed. For example, it could take into account that we have a firewall in front of an S3 in Amazon and understand that we do not have so much risk there because of that firewall, incorporating the network topology context, which today does not function as it should.

I have been using Orca Security for three years.

In my experience, Orca Security is stable.

Orca Security's scalability is quite good; it scales smoothly, and adding more resources or clouds is easy.

Orca Security's customer support is not very good. We are practically alone; we do not use the support, and they are not very responsive.

I did not previously use a different solution for cloud security.

My experience with pricing, setup cost, and licensing is good. The costs are reasonable, licensing is clear, and the renewal process is good.

We do not see a return on investment in that way; rather, we see that we improve our risk posture, as we have detected risks that without Orca Security, we would not have detected. In that sense, I can say that it mitigates risks, but I do not have a metric on that.

We do not have specific metrics; however, I can say that in the past, it took us two to three hours a week to do manual checks, whereas today with Orca Security, we just check the dashboard for ten minutes a day and that is all.

Before choosing Orca Security, I evaluated other options, specifically Wiz.

My advice to others looking into using Orca Security is to access the console every day to see if you have risks, to try to stay close to customer support to understand new features, and to not rely on the CDR because it is not very effective. I rated this product an eight out of ten.

Public Cloud

Other

When discussing the main use case for Orca Security, I am referring to implementations for my clients. I participate in several CSPM implementations for my company, but I cannot comment much on the customers due to confidentiality rules. The projects that I participate in typically involve a cloud environment that is already in production, such as AWS, Azure Cloud, or GCP. We create a context of the environment and connect multiple accounts for scanning all assets and containers in the cloud accounts of customers. We perform onboarding and create initial maps of risks. Orca Security supports remediation with clear technical evidence, objective remediation recommendations, and monitoring of risk reduction over time.

The best feature is Orca Side-Scanning. Because of this feature, the platform does not need to use agents for the detection of virtual machines, containers, and hosts. It can connect via a cloud-native API and perform out-of-band scanning using read-only access. Orca Side-Scanning has made things both easier and faster for security teams and for the people who have to act on findings. This platform is very useful for the maintenance of vulnerability in cloud environments, with the impact on the security team's workflow being a much faster time-to-value.

The Attack Path feature is a great option for the capabilities of Orca Security's strengths because it models network exposure, permissions, vulnerabilities, and trust relationships. This feature helps security teams think like attackers and identify high-impact risks.

In two implementation projects that I participated in, the customers reported difficulty with the options for generating specific reports. With these same customers, we had problems importing the custom tags from the connections in an AWS account. Orca Security needs report customization and custom collection, as well as custom tag collection improvements for the platform. Integration with Vulcan, a feature of Tenable, also needs improvement.

I have been using Orca Security for about one year.

Orca Security is stable in my experience.

The fact that Orca Security does not need to use local agents permits the scale-up for more assets in the environment to be easy.

We have interacted with their support team, and it is good.

Orca Security is my first experience with CSPM.

I have experience in license and installation, but I do not have experience in pricing because I am participating in the technical team.

I only participate in the implementation, but all the customers report good results from using Orca Security.

Orca Security typically delivers three major positive changes, in my opinion: a faster understanding of risks in cloud environments, better prioritization, and less noise. Orca Security enables collaboration between security and cloud teams for better troubleshooting and monitoring of the cloud environment. There is a faster time to visibility and results, along with a high reduction in security noise. I have a case of a customer who managed to significantly reduce the number of vulnerabilities in a team of development for web software and also in maintenance for virtual machines and containers for this environment.

The deployment of Orca Security in my organization depends on which client is doing the implementation.

The cloud providers my clients use most often with Orca Security are AWS and GCP.

I would suggest they test it and talk to Orca Security representatives because it will be a very positive experience for their company. I rate this product an eight out of ten.

I have used Orca Security for one year while working for a client where we set up Orca Security to scan our environment and identify vulnerabilities.

The main use case for using Orca Security is to identify vulnerabilities in our environment so that we can address them before any issues occur.

In one of our projects in GCP, we purchased Orca Security from the marketplace, which was enabled in our account at the organization level.

The main feature that I appreciated about Orca Security is that it is 100% agentless and context-aware, meaning it understands what it is doing.

The primary benefit is that it provides us with CVEs, through which I can identify the vulnerabilities in our security posture.

In the long run, as a security tool, it has helped us improve our security posture.

There is one issue that I encountered: when Orca Security provides CVEs and we attempt to implement its solutions, sometimes those solutions are not available on the cloud and cannot be implemented.

My main concern is the integration of Orca Security with generative AI for remediation inquiry.

Another concern I have is around the guardrails.

The primary improvement that Orca Security needs is to enhance its remediation steps based on the cloud platform being used.

I have been working in my current field for the past five or more years.

Orca Security has been stable in my experience.

Orca Security is internally based on cloud infrastructure and is 100% agentless, so it does not require significant scalability considerations.

Customer support is also good. I would rate it a 10 because they respond properly and communicate effectively.

Previously, I used to install an open-source tool to understand my security posture, which required some additional infrastructure investment.

I was using the native GCP Security Command Center.

We purchased Orca Security from the AWS Marketplace.

I am aligned with the pricing, as it is not that costly.

I did evaluate open-source tools, Orca Security, native open-source tools, and cloud-native tools as well.

When Orca Security provides CVEs, clicking on them gives suggestions about what can be done to resolve the issue.

I would advise others to use Orca Security because of the rich features that it offers.

I would rate this review a 9.

Public Cloud

Amazon Web Services (AWS)

My main use case for Orca Security is to secure infrastructure, course, and service. A specific example of how I use Orca Security to secure my infrastructure or services is for vulnerability management on VMs or other resources in Azure or AWS.

I have more to add about my main use case with Orca Security, including security posture frameworks such as ISO 27007 and 9001.

The best feature Orca Security offers is a remediation solution. What I appreciate most about the remediation solution is that it provides a fast fix for the vulnerabilities in my day.

Orca Security has positively impacted my organization by improving our security posture and hardening our services and resources.

Regarding how Orca Security can be improved, I think there is not much; it is fully completed and it is great.

I have been using Orca Security for around two years.

Orca Security is stable.

The scalability of Orca Security is great.

I find the customer support to be excellent. I would rate the customer support a ten.

I did not use a different solution before Orca Security; it is the one and only for me.

I do not know if I have seen a return on investment with Orca Security; I cannot share any relevant metrics.

Regarding my experience with pricing, setup cost, and licensing, I think that is not my place in the company.

Before choosing Orca Security, I evaluated other options, such as Wiz or Google, perhaps.

My advice to others looking into using Orca Security is to practice and study the platform in test scenarios. My impressions of the risk detection and identification capabilities of Orca Security are fascinating because they are clear and serve as a guide. Orca Security has helped my organization reduce the time it takes to address cloud security alerts because we can automate alerts.

To the extent that Orca Security has helped in preventing risks and attacks across our application lifecycle, it has allowed me to understand the security status of our resources before they go into production. My experience prioritizing risks using Orca is easy. In my experience, Orca Security's ability to analyze risks contextually and holistically is excellent. I have not utilized Orca Security's sensor for cloud detection and response, so I cannot speak to its effectiveness.

I would rate this review a ten out of ten. Orca Security is a great platform, and I am very happy with it.

I use Orca Security to have a complete view of our cloud environment at the company.

I needed to know what assets were vulnerable and how to fix them, and it was very helpful to have Orca Security because it has some AI features that helped our developers fix the vulnerabilities while coding and understand which vulnerabilities require more attention and resources.

OrcA Security automates remediation because we could install a plugin in the developer's IDE, so while they were coding, it actually helped them fix vulnerabilities in real time, which was very helpful.

The AI fix for vulnerabilities that we found is the best feature because it gives us more time to focus on other things.

The dashboards were very helpful, and I could personalize them for our case, which helped me show my leadership where the main points were and how to address them, allowing us to focus on what was really important. It was very easy to change the dashboards and personalize everything.

OrcA Security improved our collaboration because we could explain better to everyone at the company what we were doing and how it positively impacts our security posture. We could also measure our risks and vulnerabilities better, enabling us to think more strategically about improving our cybersecurity posture.

We have faster fixing of vulnerabilities with our DevOps team, and we could have fewer attacks.

It was really good because we could see threats coming before they materialize, which I think is a really good way to protect ourselves, our resources at the company, and all our assets.

We are a small team, and I did not feel any difficulty in the work using Orca Security, so I believe it saved us more employees and other costs, helping us save in different ways.

Some dashboards could be a little more personalized for each company and have more options to show the real data we need for our leadership.

I have been using Orca Security for a year.

I believe it is stable, and we did not have any availability problems with them.

It is very scalable. We have a small environment, but it was very scalable when the Orca Security engineers were explaining the tool to us.

It was really good. We had direct access to some commercial people and also the engineers, and they helped us every time we needed.

It was Prisma Cloud, and we stopped using it because of the costs, and the results were not that organized or easy to use as Orca Security.

We jumped directly to Orca Security without comparing it with any other platform.

We installed the Orca Security plugin in the developers' machines, and when they were coding, they could see the vulnerabilities with the Orca Security plugin and fix them in the code before it was put into the production environment. This allowed us to fix vulnerabilities before they reached our productive systems, which was very helpful.

We are not working with a partner or reseller.

Eight out of ten.

I believe it can be improved, but it is also a really good platform to use.

Someone asked me on LinkedIn to talk about Orca Security.

It was really accurate and gave us the right answers.

The advice I give is to talk with the support team. They help us and listen to us about features and things that made sense for our environment and our specific case, and they consider applying them to the final product.

I rate this product a 10 out of 10.

Private Cloud

Google

We used Orca Security for about two to three months until I left the company. The product itself is really good. It helped us streamline the way we access our servers. It increased the amount of security for our product and allowed us to work from different various places without having to always use a VPN that we had used before.

A lot of the comfort of just being able to access our servers and upload to local servers without having any security risks and having to take extra precautions was the main benefit because we had the safety of actually being able to use Orca Security.

Orca Security's multi-tenant architecture helped the organization ensure consistent security coverage across different servers. Since we use different servers for our company, it helped balance out everything and work in a single environment. It helped localize everything in a comfortable way, which I really appreciated, because whenever we used different levels of our product, it helped us maintain things in a more comfortable way.

I assessed the effectiveness of Orca Security's content, malware prioritization system, and evaluated alerts based on severity and business impact, but I don't remember getting any alerts, which is presumably a good thing. The whole process of logging on, which is extensive in a good way, helped us maintain a high level of security with features such as two-step authentication. This created a sense of security when working from home or abroad.

I really love the way Orca Security worked. A potential improvement could be additional security features for the two-step authentication, such as fingerprint recognition similar to what Checkpoint does. That could be something to consider, though it's more about convenience than security as we didn't have any security issues.

The timeout settings could be made more customizable, as sometimes if I leave the office early, it's still running unless manually turned off. The process of turning it off isn't very straightforward, so making it easier to turn off manually would be beneficial. It would be good for any business to implement so they don't have to use a VPN. Security in today's age is important, and if a company can afford it, they should get it as it's the most valuable protection against threats.

We used Orca Security for about two to three months until I left the company.

The integration with existing workflows was handled by different engineers.

The main challenge or key issue we faced was security.

I did not integrate Orca Security with any other product features as I didn't get a chance to use it often since I was just logging on. However, the company is really happy using it, and they're still using it today according to friends who still work there.

Regarding metrics to validate performance, while logging on and maintaining the system takes time due to auto log off after a few hours, the time spent logging back on is minimal compared to the security benefits provided by the product. We found an increase in security, and being able to work without VPNs improved load times and efficiency.

I would recommend Orca Security to managers. We were a very small company, so it wasn't widely publicized.

I rate Orca Security a 9 out of 10.