Sold by: Orca Security CNAPP
Deployed on AWS
Free Trial
Vendor Insights
Quick Launch
Agentless Cloud Security in a Single, Complete Platform with 100% Coverage
4.6
Overview
Orca Security is the true Cloud Native Application Protection Platform (CNAPP) that identifies, prioritizes, and remediates risks and compliance issues across all of your workloads, configurations, and identities on AWS. Orca offers the industrys most comprehensive cloud security solution in a single platform, eliminating the need to deploy and maintain multiple point solutions.
FAST TIME TO VALUE: The Orca CNAPP Platform is agentless first, and connects to your environment in minutes using patented SideScanning™ technology that provides deep and wide visibility into your cloud environment, without requiring agents. In addition, Orca offers a lightweight agent for organizations that require real-time protection for critical workloads.
RISK PRIORITIZATION: Orca effectively prioritizes risks by applying a granular risk score to each alert, and recognizes when seemingly unrelated issues can be combined to create dangerous attack paths straight to your crown jewels.
FULL SDLC SECURITY: The Orca platform shifts security left by seamlessly integrating into the CI/CD process so that applications can be secured from code to cloud and back.
AI-POWERED: Orca is at the forefront of leveraging Generative AI for simplified investigations and accelerated remediation, reducing required skill levels and saving cloud security, DevOps, and development teams time and effort, while significantly improving security outcomes.
PURPOSE-BUILT CNAPP: Orca unifies many different point solutions in one platform, including CSPM, CWPP, CIEM, DSPM, Container security, API security, AI-SPM, and much more.
Sign up for a demo to uplevel your cloud security and get the fastest time to value available in the industry: https://orca.security/demo/
Additional platform licensing options are not shown in this listing but are available via Private Offer. Please email aws@orca.security .
Highlights
- Visibility to all your IAAS and PAAS assets including EC2, Containers, S3 buckets using account level read only permissions
- Detect compromises, vulnerabilities and risky configuration within minutes
- No impact on your assets, grows automatically with your cloud account
Get personalized pricing in minutes - New
If qualified, an express private offer gets you custom pricing and terms. Finalize your purchase in the AWS Marketplace console.
Details
Sold by
Categories
Delivery method
Deployed on AWS
Features and programs
Skip the manual risk assessment. Get verified and regularly updated security info on this product with Vendor Insights.
Security credentials achieved
(2)
ISO27001
AWS Security Specialization
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Quick Launch
Leverage AWS CloudFormation templates to reduce the time and resources required to configure, deploy, and launch your software.
Pricing
Free trial
Try this product free according to the free trial terms set by the vendor.
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/month |
|---|---|---|
Small | Small starter pack of concurrent workloads (EC2) per month | $7,000.00 |
Small-Medium | Small-Medium starter pack of concurrent workloads (EC2) per month | $12,000.00 |
Medium | Medium starter pack of concurrent workloads (EC2) per month | $17,000.00 |
Large | large starter pack of concurrent workloads (EC2) per month | $30,000.00 |
Vendor refund policy
Contact us
Custom pricing options
Request a private offer to receive a custom quote.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Support
Vendor support
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Orca Security CNAPP
By Aqua Security Software Inc.
Top
10
In Monitoring, Application Development
Top
25
In Observability, Software Development
Top
10
In Container Workloads
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Agentless Cloud Security Architecture
Agentless-first approach using patented SideScanning technology that provides deep visibility into cloud environments without requiring agent deployment
Risk Prioritization and Attack Path Analysis
Granular risk scoring applied to each alert with capability to identify and correlate seemingly unrelated issues into dangerous attack paths
Unified Cloud Security Platform
Single platform consolidating multiple security functions including CSPM, CWPP, CIEM, DSPM, Container security, and API security
CI/CD Integration for Application Security
Seamless integration into CI/CD process to secure applications from code to cloud deployment
AI-Powered Investigation and Remediation
Generative AI capabilities for simplified security investigations and accelerated remediation workflows
Offensive Security Engine
Simulates external exploits to produce Verified Exploit Paths for prioritizing exposures that are reachable by outside attackers and reducing cloud attack surface.
Cloud Security Posture Management
Continuously monitors and manages security of AWS configurations to prevent public exposure and ensure compliance.
Secrets Scanning
Identifies more than 750 types of secrets across public and private repositories.
Cloud Infrastructure Entitlements Management
Detects and manages excessive or unused permissions to mitigate the risk of privilege escalation.
Real-Time Malware Detection
Detects malware including zero-days in milliseconds with scanning performed directly in cloud environment for object storage services like Amazon S3 and file storage services.
Multi-Workload Security Coverage
Unified platform securing containers, serverless, Kubernetes, and AI workloads across AWS, on-premises, and multi-cloud environments
Runtime Threat Detection and Enforcement
Runtime protection to detect threats, block malicious activity, and enforce compliance in production across all cloud native workloads
AI and LLM Security Governance
Purpose-built AI workload security to govern large language models and generative AI applications with model abuse detection and policy enforcement
Full Lifecycle Security
Security coverage across the entire software development lifecycle from code development through production deployment
Compliance and Authorization Standards
FedRAMP High authorization enabling compliance with rigorous security and regulatory standards
Validated by AWS Marketplace
FedRAMP
GDPR
HIPAA
ISO/IEC 27001
PCI DSS
SOC 2 Type 2
-
-
-
-
-
No security profile
-
-
-
Standard contract
No
No
No
Customer reviews
Marcus Cassilia
Cloud risk visibility has improved and security teams gain faster, more focused remediation
Reviewed on Apr 23, 2026
Review from a verified AWS customer
What is our primary use case?
When discussing the main use case for Orca Security , I am referring to implementations for my clients. I participate in several CSPM implementations for my company, but I cannot comment much on the customers due to confidentiality rules. The projects that I participate in typically involve a cloud environment that is already in production, such as AWS , Azure Cloud, or GCP . We create a context of the environment and connect multiple accounts for scanning all assets and containers in the cloud accounts of customers. We perform onboarding and create initial maps of risks. Orca Security supports remediation with clear technical evidence, objective remediation recommendations, and monitoring of risk reduction over time.
What is most valuable?
The best feature is Orca Side-Scanning. Because of this feature, the platform does not need to use agents for the detection of virtual machines, containers, and hosts. It can connect via a cloud-native API and perform out-of-band scanning using read-only access. Orca Side-Scanning has made things both easier and faster for security teams and for the people who have to act on findings. This platform is very useful for the maintenance of vulnerability in cloud environments, with the impact on the security team's workflow being a much faster time-to-value.
The Attack Path feature is a great option for the capabilities of Orca Security's strengths because it models network exposure, permissions, vulnerabilities, and trust relationships. This feature helps security teams think like attackers and identify high-impact risks.
What needs improvement?
In two implementation projects that I participated in, the customers reported difficulty with the options for generating specific reports. With these same customers, we had problems importing the custom tags from the connections in an AWS account. Orca Security needs report customization and custom collection, as well as custom tag collection improvements for the platform. Integration with Vulcan, a feature of Tenable, also needs improvement.
For how long have I used the solution?
I have been using Orca Security for about one year.
What do I think about the stability of the solution?
Orca Security is stable in my experience.
What do I think about the scalability of the solution?
The fact that Orca Security does not need to use local agents permits the scale-up for more assets in the environment to be easy.
How are customer service and support?
We have interacted with their support team, and it is good.
Which solution did I use previously and why did I switch?
Orca Security is my first experience with CSPM.
How was the initial setup?
I have experience in license and installation, but I do not have experience in pricing because I am participating in the technical team.
What about the implementation team?
I only participate in the implementation, but all the customers report good results from using Orca Security.
What other advice do I have?
Orca Security typically delivers three major positive changes, in my opinion: a faster understanding of risks in cloud environments, better prioritization, and less noise. Orca Security enables collaboration between security and cloud teams for better troubleshooting and monitoring of the cloud environment. There is a faster time to visibility and results, along with a high reduction in security noise. I have a case of a customer who managed to significantly reduce the number of vulnerabilities in a team of development for web software and also in maintenance for virtual machines and containers for this environment.
The deployment of Orca Security in my organization depends on which client is doing the implementation.
The cloud providers my clients use most often with Orca Security are AWS and GCP .
I would suggest they test it and talk to Orca Security representatives because it will be a very positive experience for their company. I rate this product an eight out of ten.
Saqi B.
Orca SideScanning Delivers Agentless Azure Visibility Without Downtime
Reviewed on Apr 16, 2026
Review provided by G2
What do you like best about the product?
Managing the fleet of Azure servers for our high-frequency trading and logistics platform requires absolute visibility without any performance degradation. Orca SideScanning has been a real asset. Because it operates entirely agentless, we can deploy comprehensive security monitoring across our entire Azure infrastructure without ever having to schedule maintenance windows.
What do you dislike about the product?
Navigating between different regional cloud environments within the main dashboard can be slightly disorienting when I’m trying to compare the risk posture of our European trading servers against our Asian logistics nodes.
What problems is the product solving and how is that benefiting you?
Deploying traditional security agents across thousands of trading servers was causing unacceptable CPU overhead and creating bottlenecks. Orca entirely eliminated the agent lifecycle management problem.
Serina J.
Best-in-Class Agentless Cloud Security with Orca Security
Reviewed on Apr 15, 2026
Review provided by G2
What do you like best about the product?
As a digital agency managing cloud transformation for various corporate clients, Orca Security sidecaning has been the best option for us. It’s completely agentless, so we don’t have to spend weeks negotiating with our clients’ internal developers to install security agents on active workloads.
What do you dislike about the product?
The built-in reporting engine feels heavily geared toward technical engineers, but I need to present our monthly security posture to non-technical client stakeholders or the board of directors.
What problems is the product solving and how is that benefiting you?
Shadow IT was a massive problem for our organization, with different development teams spinning up unauthorized cloud servers for temporary staging projects and then forgetting to save them.
Mrigen S.
Orca Security’s Agentless Side-Scanning Makes Multi-Cloud Deployments Easy
Reviewed on Apr 13, 2026
Review provided by G2
What do you like best about the product?
We manage multiple client cloud environments, and Orca Security’s side-scanning technology is a major advantage for our deployment teams because it is completely agentless. We don’t have to spend weeks negotiating with the client’s internal developers to install security agents on the workloads. Instead, we simply connect Orca to the AWS or Azure accounts via the IAM role.
What do you dislike about the product?
Managing multi-tenant environments is a little hard in this. We can have separate client environments, but the overall dashboard approach doesn’t provide a clear multi-tenant view.
What problems is the product solving and how is that benefiting you?
Onboarding new clients for cloud security assessments used to be a highly abrasive process, filled with technical friction. Otrca solves this by providing instantaneous, zero-impact visibility.
Codrin T.
Agentless Scanning That Makes Cloud Security Manageable
Reviewed on Apr 07, 2026
Review provided by G2
What do you like best about the product?
Agentless scanning is ideal because getting hundreds of independent research departments to install a security agent in their cloud environments is basically impossible. Orca side-scanning also helps us identify unpatched operating systems and exposed databases.
What do you dislike about the product?
The alert noise caused by forgotten projects is a constant struggle. Faculty members often leave the lab server running for years after a grant expires, and the platform ends up flagging very outdated libraries as critical vulnerabilities.
What problems is the product solving and how is that benefiting you?
We suffer from an incredibly decentralized cloud usage setup: dozens of departments, each with their own cloud space and their own grant money. This has created a massive shadow IT problem. Orc connects at the root level and instantly shows us every misconfigured storage bucket or other workload storing sensitive academic data.