Orca Cloud Security Platform

Cloud services enable faster, more flexible, and more cost-effective application delivery through dynamic, just-in-time virtual infrastructure and DevOps practices built on containers and microservices. This same dynamism breaks legacy security assumptions that depended on slow change, stable asset inventories, CMDB-driven visibility, and periodic controls like weekly vulnerability scanning and manual access reviews. In cloud environments, resources are created and destroyed continuously, inventories fluctuate, and additional risks emerge from cloud-native services (including serverless) and customer misconfigurations. DevOps further increases exposure by making rapid deployment easy while reducing enforced pre-deployment checks; security may be deprioritized, leaving common vulnerabilities in code and configuration and enabling exploitation, especially when infrastructure components have excessive privileges. Disaster recovery is also frequently overlooked: the cloud service provider ensures continuity of their platform, but the tenant remains responsible for backups and must protect against both malicious actions (e.g., ransomware) and human error.

Orca Security’s Cloud Security Platform is presented as a “zero-touch” solution founded in 2018, using patent-pending SideScanning™ to achieve deep visibility without agents or network scanners. It inspects workloads out-of-band via the runtime storage layer and correlates findings with cloud-provider API metadata. A context engine unifies workload details (services, host and firewall configurations) with cloud configurations (IAM roles, VPCs, security groups) to build a graph-based asset map that clarifies relationships and prioritizes risk. The platform consolidates multiple capabilities—vulnerability management, workload protection, posture management, compliance, malware detection, and sensitive data discovery—across AWS, Azure, and Google Cloud, with integrations and automation features such as queries and auto-ticketing. Noted limitations include lack of hybrid coverage beyond cloud services, no automatic scanning at creation time, and no built-in automated remediation.

• Orca Security was founded in 2018.
• Orca Security is headquartered in Portland, Oregon, with R&D in Israel.
• SideScanning™ reaches workloads via the runtime storage layer and combines results with metadata from cloud provider APIs.
• The platform builds a unified data model and graph-based map of cloud assets and their relationships.
• Orca supports AWS, Azure, and Google Cloud environments.
• Orca includes over 20 out-of-the-box integrations, including Slack, OpsGenie, Jira, and ServiceNow.
• Orca supports over 800 unique configuration controls across more than 35 compliance frameworks.
• Orca’s vulnerability database aggregates data from over 20 vulnerability data sources.
• Trigger-based scanning ingests AWS CloudTrail to enable automated scans every 15 minutes.
• Orca detects at-risk sensitive data including email addresses, credit card numbers, and Social Security identifiers, and provides masked samples.

• “Dynamic just-in-time infrastructure and development need a dynamic just-in-time approach to IT security.”
• “You can only secure what you know you have and the first step towards securing these assets is to detect and record their existence.”
• “In the race to provide functionality, it is often the case that security takes second place.”
• “Whether critical application data is deleted by ransomware or by mistake, the CSP is not responsible.”
• “Orca's patent-pending SideScanning™ technology does not need to disturb workloads to inspect data.”
• “This provides deep visibility of cloud environments without needing any agents or network scanners.”
• “Its context engine combines workload and cloud configuration details to build a unified data model and visual map of all the organization's cloud assets.”
• “Orca leverages workload and cloud account configuration data to detect and prioritize misconfigurations across the complete cloud estate.”
• “Orca provides malware detection capabilities across the organization's cloud estate, including idle, paused, and stopped workloads, orphaned systems, and devices that can't support agents --- with zero performance impact.”
• “This approach reduces false positives and allows organizations to focus on the most important risks.”