Defender for Cloud vs Orca: cloud security facts side by side
How do their category maps compare?
- Described on the vendor's pages we read
- Not in our sources (it may exist; we did not find it on the pages we read)
What are the facts, side by side?
| Fact | Defender for Cloud | Orca |
|---|---|---|
| Positioning | Microsoft's cloud security product: a free posture tier, paid posture and server plans billed per resource, across Azure, AWS and Google Cloud. | A cloud security platform built on agentless SideScanning, with an optional runtime sensor, covering posture, workloads, identity, data, vulnerabilities, code and AI. |
| Agent approachDiffers | Agentless parts, agent for depth Agentless VM, secrets and Kubernetes scanning exist, but only in the paid Defender CSPM plan and Defender for Servers Plan 2. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Agentless core SideScanning reads workloads' runtime block storage and reconstructs the file system in a read-only view, covering Linux and Windows VMs, containers and images, and serverless, without agents. Source: Orca agentless SideScanning, read . |
| Runtime sensor | Defender for Servers Plan 1 and Plan 2 bring Microsoft Defender for Endpoint EDR to servers. Source: Microsoft Learn: Defender for Servers overview, read . | The optional Orca Sensor is eBPF-based, runs on Linux, Kubernetes and Windows in public, private cloud and on-premises environments, and can be configured to terminate processes. Source: Orca runtime sensor, read . |
| Clouds namedDiffers | Azure, AWS, GCP Azure, AWS and Google Cloud, plus on-premises machines through Azure Arc. Source: Microsoft Learn: Defender for Servers overview, read . | AWS, Azure, GCP, OCI, Alibaba, Tencent AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud and Tencent Cloud. Source: Orca Security platform overview, read . |
| CNAPP | Described Posture (Defender CSPM) and workload protection (Defender for Servers) are separate plans in one product; the full set needs paid plans. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Described CNAPP is listed as a module on the platform page, built on one Unified Data Model. Source: Orca Security platform overview, read . |
| CSPM | Described Foundational CSPM is free; Defender CSPM adds attack path analysis and the cloud security explorer. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Described CSPM and multi-cloud compliance are listed as modules. Source: Orca Security platform overview, read . |
| CWPP | Described Defender for Servers Plan 1 and Plan 2, with file integrity monitoring and just-in-time access in Plan 2. Source: Microsoft Learn: Defender for Servers overview, read . | Described Workloads are covered by SideScanning (VMs, containers, serverless) and, for runtime, the optional Orca Sensor. Source: Orca agentless SideScanning, read . |
| CIEM | Described Defender for Cloud includes native CIEM, supporting Microsoft Entra ID, AWS IAM and Google Cloud IAM. Source: Microsoft Learn: CIEM in Defender for Cloud, read . | Described CIEM is listed as a module. Source: Orca Security platform overview, read . |
| DSPM | Described DSPM is part of the paid Defender CSPM plan. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Described DSPM is listed as a module. Source: Orca Security platform overview, read . |
| Vulnerability management | Described Agentless VM vulnerability scanning is in the paid Defender CSPM plan and Defender for Servers Plan 2. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Described Vulnerability management is listed as a module, with risk prioritization and attack path analysis. Source: Orca Security platform overview, read . |
| Code securityDiffers | Code-to-cloud mapping in the paid Defender CSPM plan. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | SCM posture, SCA, SAST, secrets, IaC and container image scanning, with GitHub, GitLab and Azure DevOps, and cloud-to-code tracing that opens pull requests. Source: Orca application security, read . |
| AI securityDiffers | AI-SPM in the paid Defender CSPM plan; Defender for AI Services is billed per 1,000 tokens. Source: Azure: Defender for Cloud pricing, read . | AI-SPM inventory of models, pipelines, training datasets and AI packages, shadow AI discovery, MCP server monitoring and AI AppGen Security. Source: Orca AI security, read . |
| Kubernetes runtimeDiffers | Agentless Kubernetes discovery in the paid Defender CSPM plan. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Container and Kubernetes security is listed as a module; the Orca Sensor runs on Kubernetes. Source: Orca runtime sensor, read . |
| Private cloud or on-premises | On-premises machines through Azure Arc. Source: Microsoft Learn: Defender for Servers overview, read . | The Orca Sensor runs in private cloud and on-premises environments. Source: Orca runtime sensor, read . |
| Disconnected environments | Not in our sources | Not in our sources |
| Compliance reporting | Compliance standards include CIS, PCI DSS v4.0.1, HIPAA, ISO/IEC 27001:2022, SOC 2023, NIST CSF v2.0 and NIST SP 800-53, assignable to Azure subscriptions, AWS accounts and GCP projects. Source: Microsoft Learn: regulatory compliance standards, read . | Multi-cloud compliance is listed as a module. Source: Orca Security platform overview, read . |
| Public-sector authorization | Microsoft lists Defender for Cloud in FedRAMP High audit scope for Azure and Azure Government. Source: Azure and other Microsoft cloud services compliance scope, read . | Orca states it is FedRAMP Authorized at the Moderate Impact Level for its cloud security platform. Source: Orca glossary: FedRAMP, read . |
| PriceDiffers | Foundational CSPM is free. Defender CSPM is $5.11 per billable resource per month (8 functions or web apps count as 1 resource). Defender for Servers is $4.906 per server per month for Plan 1 and $14.60 for Plan 2. Defender for Containers is $6.8693 per vCore per month. USD list prices, East and Central US; free for the first 30 days. Source: Azure: Defender for Cloud pricing (re-read), read . | Not published Orca's own site publishes no price (orca.security/pricing returned a 404 on 27 September 2026). An AWS Marketplace contract listing (Unique Expansion) shows Small, up to 100 concurrent workloads (EC2) per month, $7,000.00; Small-medium (300) $12,000.00; Medium (500) $17,000.00; Large (1,000) $30,000.00. These are monthly prices under the listing's 1-month contract, checked on 4 November 2026. The listing also offers a 12-month contract. Source: AWS Marketplace: Orca Security CNAPP Cloud Security Platform, Unique Expansion, read . |
| Open source | None named | None named |
| Ownership | Microsoft. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Standalone vendor. Source: Orca Security platform overview, read . |
Where do they differ?
- Agent approach: Defender for Cloud has agentless parts and an agent for depth; Orca has an agentless core.
- Clouds named: Defender for Cloud names Azure, AWS and GCP; Orca names AWS, Azure, GCP, OCI, Alibaba and Tencent.
- Code security: Defender for Cloud partly matches; Orca matches.
- AI security: Defender for Cloud partly matches; Orca matches.
- Kubernetes runtime: Defender for Cloud partly matches; Orca matches.
- Price: Defender for Cloud matches; Orca partly matches.
Choose Defender for Cloud if
- Most of your estate is on Azure and you already use Microsoft security products.
- You need to model cost from public prices before talking to anyone.
Choose Orca if
- You want broad coverage without installing agents.
- Your estate includes Tencent Cloud, Alibaba Cloud or Oracle Cloud.
Which limits should you check?
Defender for Cloud
- Agentless scanning, attack paths, DSPM and AI-SPM sit in the paid Defender CSPM plan ($5.11 per billable resource per month), not the free tier.
- Oracle Cloud and Alibaba Cloud are not named, and from 27 October 2026 the free tier becomes opt-in for new Azure subscriptions.
Orca
- Its own site publishes no price; the AWS Marketplace listing's 1-month contract starts at $7,000 per month for up to 100 concurrent workloads (EC2), checked on 4 November 2026.
- Detection inside running workloads and process termination need the optional Orca Sensor, an agent; with agentless scanning alone you get the read-only view.
- Its FedRAMP authorization is at the Moderate level; disconnected environments are not described on the pages we read.
Frequently asked questions
How do Defender for Cloud and Orca differ?
Neither is scored on this site. Defender for Cloud describes 6 of six categories and Orca 6 on the pages we read, and they differ on 6 recorded facts. Which fits depends on your clouds, agent tolerance and existing tools; the finder checks those.
Which of the two needs an agent?
Defender for Cloud: Agentless parts, agent for depth. Orca: Agentless core.
Do Defender for Cloud or Orca publish prices?
Defender for Cloud: Foundational CSPM is free. Defender CSPM is $5.11 per billable resource per month (8 functions or web apps count as 1 resource). Defender for Servers is $4.906 per server per month for Plan 1 and $14.60 for Plan 2. Defender for Containers is $6.8693 per vCore per month. USD list prices, East and Central US; free for the first 30 days. Orca: Orca's own site publishes no price (orca.security/pricing returned a 404 on 27 September 2026). An AWS Marketplace contract listing (Unique Expansion) shows Small, up to 100 concurrent workloads (EC2) per month, $7,000.00; Small-medium (300) $12,000.00; Medium (500) $17,000.00; Large (1,000) $30,000.00. These are monthly prices under the listing's 1-month contract, checked on 4 November 2026. The listing also offers a 12-month contract.