Orca Security: cloud security profile and facts (2026)
Visit Orca's siteOrca Security
orca.security
* Not found on the pages we read; it may exist. Facts as the vendor states them on its own pages and marketplace listings, read September 2026, checked 3 Nov 2026. Not a measure of how well anything works.
Which categories does Orca describe?
- Described on the vendor's pages we read
- Not in our sources (it may exist; we did not find it on the pages we read)
- CNAPPDescribed
CNAPP is listed as a module on the platform page, built on one Unified Data Model.
Source: Orca Security platform overview, read .
- CSPMDescribed
CSPM and multi-cloud compliance are listed as modules.
Source: Orca Security platform overview, read .
- CWPPDescribed
Workloads are covered by SideScanning (VMs, containers, serverless) and, for runtime, the optional Orca Sensor.
Source: Orca agentless SideScanning, read .
- CIEMDescribed
CIEM is listed as a module.
Source: Orca Security platform overview, read .
- DSPMDescribed
DSPM is listed as a module.
Source: Orca Security platform overview, read .
- Vulnerability managementDescribed
Vulnerability management is listed as a module, with risk prioritization and attack path analysis.
Source: Orca Security platform overview, read .
The map shows what each vendor's own pages describe. It is not a measure of how well a feature works.
How does Orca deploy?
| Fact | Orca |
|---|---|
| Agent approach | Agentless core SideScanning reads workloads' runtime block storage and reconstructs the file system in a read-only view, covering Linux and Windows VMs, containers and images, and serverless, without agents. Source: Orca agentless SideScanning, read . |
| Runtime sensor | The optional Orca Sensor is eBPF-based, runs on Linux, Kubernetes and Windows in public, private cloud and on-premises environments, and can be configured to terminate processes. Source: Orca runtime sensor, read . |
| Clouds named | AWS, Azure, GCP, OCI, Alibaba, Tencent AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud and Tencent Cloud. Source: Orca Security platform overview, read . |
| Private cloud or on-premises | The Orca Sensor runs in private cloud and on-premises environments. Source: Orca runtime sensor, read . |
| Disconnected environments | Not in our sources |
What else does Orca cover?
| Fact | Orca |
|---|---|
| Code security | SCM posture, SCA, SAST, secrets, IaC and container image scanning, with GitHub, GitLab and Azure DevOps, and cloud-to-code tracing that opens pull requests. Source: Orca application security, read . |
| AI security | AI-SPM inventory of models, pipelines, training datasets and AI packages, shadow AI discovery, MCP server monitoring and AI AppGen Security. Source: Orca AI security, read . |
| Kubernetes runtime | Container and Kubernetes security is listed as a module; the Orca Sensor runs on Kubernetes. Source: Orca runtime sensor, read . |
| Compliance reporting | Multi-cloud compliance is listed as a module. Source: Orca Security platform overview, read . |
| Public-sector authorization | Orca states it is FedRAMP Authorized at the Moderate Impact Level for its cloud security platform. Source: Orca glossary: FedRAMP, read . |
| Open source | None named |
What does Orca cost?
Not published Orca's own site publishes no price (orca.security/pricing returned a 404 on 27 September 2026). An AWS Marketplace contract listing (Unique Expansion) shows Small, up to 100 concurrent workloads (EC2) per month, $7,000.00; Small-medium (300) $12,000.00; Medium (500) $17,000.00; Large (1,000) $30,000.00. These are monthly prices under the listing's 1-month contract, checked on 4 November 2026. The listing also offers a 12-month contract.
Source: AWS Marketplace: Orca Security CNAPP Cloud Security Platform, Unique Expansion, read .
Where is Orca strong, and where are its limits?
Strengths and limits come from the vendor's own pages and our sources; a limit can be something we did not find.
Strengths
- Agentless SideScanning covers VMs, containers and serverless without installing anything, which suits teams with a no-agent rule.
- Names six clouds, including Oracle Cloud, Alibaba Cloud and Tencent Cloud; it is the only vendor here that names Tencent Cloud.
- Its platform page lists every category this site covers, plus code security, AI security and multi-cloud compliance.
Limits
- Its own site publishes no price; the AWS Marketplace listing's 1-month contract starts at $7,000 per month for up to 100 concurrent workloads (EC2), checked on 4 November 2026.
- Detection inside running workloads and process termination need the optional Orca Sensor, an agent; with agentless scanning alone you get the read-only view.
- Its FedRAMP authorization is at the Moderate level; disconnected environments are not described on the pages we read.
What does Orca say about itself?
Orca describes SideScanning as patented and says it deploys in minutes.
Source: Orca agentless SideScanning, read .
Orca says AI AppGen Security finds apps built on AI app builders such as Replit, Vercel and Bolt, across 50+ vendors.
Source: Orca AI AppGen Security, read .
What has Orca announced recently?
16 Sep 2026
Launched the Partner POD Program and an AI-based Partner Success Platform, available globally in six languages at launch.
Source: Orca press release: Partner Success Platform, read .
2 Sep 2026
Released full Japanese localization of the platform, covering menus, alerts, dashboards and profile management.
Source: Orca press release: Japanese localization, read .
29 Jul 2026
Unveiled AI AppGen Security and AI Code Security Auditor ahead of Black Hat USA 2026, with general availability expected later in 2026.
Source: Orca press release: platform extended to AI builders, read .
Who should shortlist Orca?
Consider Orca if you want broad coverage without installing agents, or if your estate includes Tencent Cloud, Alibaba Cloud or Oracle Cloud.
In our example finder profiles, Orca is in the first group for: AWS and Azure, VMs and containers; Four clouds, no agents, continuous compliance.
Run the finder with your answersHow does Orca compare with each other vendor?
Frequently asked questions
Does Orca need an agent?
Agentless core. SideScanning reads workloads' runtime block storage and reconstructs the file system in a read-only view, covering Linux and Windows VMs, containers and images, and serverless, without agents.
Which clouds does Orca name?
AWS, Azure, GCP, OCI, Alibaba and Tencent. AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud and Tencent Cloud.
Does Orca publish its prices?
Orca's own site publishes no price (orca.security/pricing returned a 404 on 27 September 2026). An AWS Marketplace contract listing (Unique Expansion) shows Small, up to 100 concurrent workloads (EC2) per month, $7,000.00; Small-medium (300) $12,000.00; Medium (500) $17,000.00; Large (1,000) $30,000.00. These are monthly prices under the listing's 1-month contract, checked on 4 November 2026. The listing also offers a 12-month contract.