The standout part of Orca Security is the package approach. When they provide remediation or alerts, they also provide the exact path for a particular vulnerability or alert. They show us the specific path that needs to be fixed in order to remove the vulnerability or alert. They provide path information directly from the systems, so sometimes we don't need to log in directly and investigate ourselves. This feature is valuable, though there are occasional false positives, which is a normal part of security. Regarding prioritization and assigning risk, Orca Security was good at analyzing risks contextually and holistically. As the tool and product mature, they will definitely announce new features. On a scale of ten, I would rate this around seven or eight. I have not given a ten because there are a few false positives and some areas where the product needs improvement on a regular basis. Sometimes they release the product, but modifications could still be required on their side. It is good to prioritize risks with Orca Security because they are not only targeting the CVSS score but also the EPSS, which is the Exploit Prediction Scoring System. They monitor particular assets based on both approaches. On the CVSS side, they reference the National Vulnerability Database, and on the EPSS side, they target the Exploit Prediction Scoring System. So they are targeting both risk-based approaches as well as the CVSS approach.
