Orca Security Reviews

We are a solution provider and Orca Security is one of the products that we implement for our clients. Most of them are start-ups and scale-ups that are building their software on the cloud platform. If they don't have cloud services, they cannot use Orca, so that's the first requirement. They need to use a cloud platform like Amazon Web Services or Microsoft Azure or Google Cloud.

Then to use Orca, they need to make a connection with the cloud platform's API. This means that they don't need to install any software or hardware. At that point, the site-scanning technology in Orca Security will check for vulnerabilities in the environment, and then check whether there are any configuration issues.

Our clients can see the progress in compliance after they implement Orca. For example, there is a weekly report to show how things change. Most of the time, our clients start with perhaps 30% compliance. It gives you the option to select which standards you want to comply with, for example to the ISO standard, or the GDPR standard. Orca Security also has its own standards for specific cloud platforms.

You can see that the security improves by changing the configuration and tightening your cloud set-up. Similarly, when you start reducing the vulnerabilities that you have, the number of alerts you are receiving will decrease compared to what it was in the beginning. It takes some time to achieve a healthy state of cloud security but once a baseline is achieved, you will immediately see the problem if there is a critical alert. When a new vulnerability appears, it can be solved as soon as possible.

Orca's platform provides an agentless data collection facility that collects information directly from the cloud using APIs, with zero impact on performance. This is something that is very important because now, there is a need to have full visibility of your cloud security every day. One cannot rely on only a penetration test once a year, because our customers are start-ups and scale-ups that are really innovating. They are deploying code almost every day. They make changes to the configuration of their clouds using automated tools like Terraform, and they really need to have a solution like Orca to have the guarantee and the confidence that there is nothing new and critical being configured or added to that environment. For me, it's a no-brainer to have Orca running in your cloud.

By using the agentless approach, our clients avoid the need to deploy and maintain multiple tools. Also, if you're using an agent then you need to have it installed. This means that you have something running in your production environment, so that can have an impact.

Secondly, if you forget to deploy the agent on the new machine, you will not know that machine is there. You will not have a complete picture, and that's an important thing to consider. With Orca, you will have a full inventory of all of your assets, your configuration, your network setup, even assets that are not internet-facing. The old-school agent approach will not work, because even if you have the agents installed, you will still need to have something in the cloud doing scans. You will also need something that will look at the configuration of your cloud platform, which is not possible if you are just installing an agent on a VM.

Prior to Orca, our clients had considerably less coverage for their environments. When we compared the results of Orca against a typical vulnerability scan using Tenable, for example, the classical solutions only found 20%. This is because Orca is scanning behind the security configuration of your cloud provider, which is possible with integration using the API.

The compliance dashboard is one of the features that our customers find very interesting. Instead of having to run checklists and provide access to auditors, you can just generate a report from Orca.

The automation and alerting capabilities are very good. When there is a new vulnerability or a new issue, you can get an automated alert in Microsoft Teams or in Slack.

The visibility that Orca gives into the environment is really in-depth because of their site-scanning technology. They provide full visibility into everything running in the cloud environment. They can look at virtual machines; they can look at serverless; they can look at the configuration of users and roles. They can also see, for example, that a specific administrative user has no multifactor authentication configured. It covers the full stack and not only one specific item.

The alerting capabilities are now being added, which is a very good evolution.

The integration with SIEM tools is now in place, which is a nice feature.

I would like to see an option to do security checks on a code level. This is possible because they have access to all of the code running in the cloud provider, and combining their site-scanning solution with that would be a nice add-on. This would guarantee our customers that whatever is running in their cloud production is secure on all layers.

It would be nice if this solution had the capability of fixing issues. As it is now, it only reports them. Having a button to patch a product, disable a service, or delete a VM would be nice. At this point, this is something they might not want to do because they are only doing audits rather than making changes. It is also something that would require having additional permissions, including write access using the API.

I have been working with Orca Security for more than two years.

In the beginning, when we started to work with them more than two years ago, they were still just in the first phase of going live. At that point, we had some problems with the user interface and some bugs, but they have been developing very hard to solve those issues. For example, they migrated to a new version of the user interface, which is very good.

When there is a problem with stability, we can contact their support and they solve it immediately. These days, most issues have been solved and they're adding more functionality because they now have more developers working on it.

In terms of scalability, we have customers that have a lot of assets, and some that only have a few. Of course, the more assets you have, the more vulnerabilities you have, and the more work that has to be done to solve those issues. That is something that takes time.

Our largest customer used to have more than 250 assets.

The customer is responsible for solving problems but because of Orca, we can track the progress and we can follow up on the vulnerability management and remediation.

Technical support is very good. I would rate them a ten out of ten.

When you send an email, you get an answer immediately. They really try to determine what the problem is and identify the root cause. Either it's because it's something that we didn't know of or were unable to find in the documentation, or it's a bug or feature that is not known yet.

We have seen customers moving from other solutions to Orca. When you are running your entire software solution in the cloud, and you make a lot of changes, have new deployments and new features, as well as configuration changes, your classical vulnerability scanners will miss things. 

For example, a traditional scanner will miss scanning a specific IP address or domain. When you are working in the cloud, everything is more elastic. Another problem is that you have new IP addresses not being used, but get allocated to another cloud customer. You can have a situation where you're scanning with those classical solutions, and it is actually somebody else's infrastructure. This is not the ideal situation.

These are some of the reasons that we have moved to Orca Security, replacing those classical mobility scanners.

Using Orca has helped consolidate vendors and services because it gives a better overall view. It's much easier to install and maintain than the typical vulnerability scanning approach. Our clients have replaced solutions such as Tenable, Qualys, and manual consultancy. In this last instance, if you don't have Orca or another product and you need to have a compliance check, then a security consultant will need to use a checklist and perform a manual inspection of all of the configurations.

Consolidating services has saved our clients both time and money. For instance, if you need to generate a compliance report every quarter, it will normally consume five to ten days. However, using Orca, it's checked every day and you can generate a report whenever you want.

Alternatively, you can use open-source tools but you don't always know what they are doing. 

The initial setup is very straightforward. Everything is clearly documented and there is a video. They just need to log in and provide the API keys, which is very easy.

We have customers that first start with a trial or proof-of-concept, and then they immediately see the added value of the solution.

With the right access to the cloud platform, the deployment can take about 15 minutes.

Our customers are responsible for doing the setup because we don't have access to their cloud platform.

Orca is a SaaS product that is always up to date.

The pricing depends on how many assets you have running in your cloud and how many environments you have. If you have a dev environment, test environment, and a production environment then it's really important that you have coverage for all of them. But, you can start gradually because you can analyze one environment at a time. For example, you can begin with the production environment and fix all of the vulnerabilities there first. Then, add the test or acceptance environments, and then add your dev environments.

You really need to learn how Orca helps to improve your attack surface, and you don't want to start with everything at once. Instead, you want to start small and progress gradually, otherwise it will be a lot of work.

Pricing also depends on how you use your cloud provider. If you are working very cloud-native then it is much cheaper than a situation where you have a lot of virtual machines configured and running.

We generally look at the most innovative solution and start using it. We do not do benchmark testing because we don't have time for it.

We normally set up customers on a trial basis to show them what the product is capable of. When you run a trial for a specific customer environment, you immediately see the benefits and value. You see that it does what they say it will and there are no hidden features. You immediately see the results in the dashboard, and how it works.

My advice for anybody who is considering Orca Security is to start with a proof of concept, as it will only take five minutes to set it up. Let it run for a few days and then look at the results. It will show you how it benchmarks against your existing tools, including things that you didn't know of and you need to solve. After the evaluation, purchase it to make sure that it keeps monitoring your existing environments.

I would rate this solution a ten out of ten.

We use Orca Security in the cloud to protect all of our cloud-based AWS applications.

It secures all of our perimeter and AWS, as well as all of our databases, applications, and transport. For every facet of AWS, right down to operating systems, we use Orca to take a look at it.

Orca provides the capability for agentless data collection directly from your cloud configuration and from the workloads' runtime block storage, which is one of the massive advantages of the tool. The tool gives us the ability to monitor things as we spin them up and as we tear them down. I can't state emphatically enough how important the agentless tool is.

For example, when most people move their applications from on-premises to the Cloud, which is what we in IT call a forklift, they just copy it over or re-create it there. Very seldom do people actually re-engineer or re-architect their applications to take full advantage of the cloud.

With the cloud, you can create serverless applications and serverless databases, so that when you need something you can spin it up and use it. When you don't need it, you can tear it down or destroy it so that it's gone. This not only saves money and is very efficient but from a security perspective, it's critical because every time you have something running somewhere, it could be attacked. This is what is referred to as an attack surface.

By using serverless tools and agentless monitoring, you can tear it down when you're done and that reduces your attack surface dramatically. Without a tool like Orca, that's agentless, you would not be able to do that. You would have to install software on the application and keep it running in order to monitor it, which really defeats the whole purpose of the cloud.

In terms of performance, because it's agentless, it's not stealing cycles from your application. It's not what's called a heavy application.

The agentless and direct collection of data enables Orca to see assets within its environmental and business contexts and prioritize truly critical security issues. This is one of the huge advantages of Orca. It sees everything in the environment and through its AI, properly categorizes what the threats are and shows them to you in a much better way. It aggregates all of the alerts and determines what's really important, and then shows them to you. It greatly reduces the need for additional staff to pore through all of the alerts to try and determine what's real, what's critical, and what the real problems are. It does all of that work for you.

Prior to Orca, our cloud visibility was perhaps 20% of what it is now. This is the reason that we were delaying moving to the cloud. The additional coverage has allowed us to move critical applications to the web that we had been holding off on because of the lack of cloud visibility. We have now moved multiple critical applications and we're able to view them in a way that we would not have been able to without Orca.

An important thing to consider is that Orca is a one-size-fits-all solution, which is very rare in the security world where everything is piecemeal. Normally, to protect something, you need five or six different tools or products. In this case, one product gives you all of the visibility that you need for your landscape, into all of your cloud properties. It is really the best of all worlds.

It's critically important to keep things simple, and it helps that Orca has everything included out-of-the-box. You only need one tool and it's helpful because there are so many security solutions on the market that a lot of security people get confused and they end up with products that overlap each other. Part of the reason for this is that all of the security solutions are trying to expand into other areas, and become more useful on the whole.

When you end up with these overlaps in products, it confuses people including end-users and support staff. Oftentimes, you end up with redundancy or things that conflict because the software isn't designed to be compatible with all of the other tools that are out there in the market. You end up with a messy collage of tools trying to accomplish something and it doesn't work well. It ends up with gaps, overlaps, and it just creates problems for security.

With Orca, it's as if they took a whiteboard and set out to fix all of that, and do everything in one tool. What they built architecturally is a beautiful, simple, and easy-to-use product. 

We are frequently audited by our clients, which are Fortune companies in the finance, automotive, utility, and telecom industries. They audit us from a security perspective quite frequently. By using Orca, we can prove to them that we are secure in all of the core areas that they're looking at.

Like a lot of cloud SaaS tools, which is the new generation of technology, you expect things to be automatically updated for you. It's like using Chrome, where when you decide to take an update, you don't have to pay for it. You assume that the company behind the product is constantly updating it on your behalf. This is a model that is critically important from a security perspective.

Imagine buying an antivirus product and the company says that they're not giving you updates until you pay for them. A lot of companies do that but more of the newer companies will instead license you the product for a year or two at a time. During the license period, you get all of your version updates and everything you need. It's included and it's done automatically. That's the model that Orca chose and from a security perspective, it's the best model for a customer like me.

Orca provides X-ray vision into everything within the cloud properties, whereas normally, this would require multiple tools. As an analogy, for on-premises equipment, you would need different tools to be able to see the performance of a system, determine what versions of software applications are installed, and look at the security. You would need yet another one to give you a holistic view of all of the hardware inside of the system.

From this one platform, we can get visibility right down into the hardware through all of the applications, and through the operating system. One application provides an entire view of our security. Gartner coined the name Cloud-Native Application Protection Platform, in reference to this product, because Orca created did not exist previously. Orca literally invented a whole new way to view security in the cloud.

Because the interface is so simple, you don't need people that have tons of experience. You can take a lower-level person and give them basic instructions on what to watch for. If anything comes up with a high-level or medium-level alert, then they have to contact somebody else. It's literally that easy.

As with all software, the user interface can always be made simpler to use. It would be helpful for people with very little knowledge, like somebody sitting behind the SOC, to allow them to be able to drill down into things a little bit easier than it is currently.

I have been using Orca Security for approximately two and a half years.

We haven't had a single stability issue. From my perspective, it's awesome.

Scalability is built into the product. We've scaled this pretty tremendously up and down as we've needed to, based on serverless needs across VPCs, across servers, and across various instances. It scales perfectly across our environment.

It monitors all of our AWS instances. We give it everything. In fact, as we add more and more to the cloud, Orca is there already, ready to protect us, so we're scaling it. Every month we add more to it.

We have been in touch with technical support a few times. It's been very few and far between but it was to ask about the meaning of some of the error messages that we saw.

I would rate the technical support a nine out of ten. We don't use it very much and as such, I don't have enough touchpoints to be able to assess it. I'm leery about rating something the highest possible score without having enough visibility into it.

There was a situation where we provided feedback to the vendor and they incorporated it into the product very quickly. We were very surprised that they listened and acted upon it so quickly and I think that this is more important than support because no product is perfect. They were eager to improve their product because they strive to be better. I can't say enough good things about them.

There was nothing on the market, anything like their solution, prior to Orca coming along. It literally created a whole new category. It was the right tool at the right time and they had the vision to create it.

We were using a myriad of bolt-on tools at the time, to try to cobble things together, but we never really accomplished very much using them. That is why we went looking for the product that we did. Ultimately, we weren't moving anything to the cloud because we couldn't find the visibility that we wanted.

In order to move to the cloud, you need a tool like Orca to have visibility of all of your real estate, architecture, and applications that are out there. Without it, you literally have gaps you don't know about and you are running blind. It's like running with blinders on and you can only see where you're looking, versus being able to look 360 degrees around you. It gives you that level of visibility. It's truly X-ray visibility.

The initial setup was amazingly easy. You don't have to really do anything outside of creating an account with them. It was absolutely simplistic. It exceeded our expectations from an installation perspective. It couldn't be easier.

Because there are no agents, you have no deployment time. Another beauty of it is that you don't have to sit there and try to install agents on every device and every server and every application and every instance or every VPC. It's just automatically done.

Once you give them access and they scan your environment, it's done for you. You don't have to do anything at all. It learns about your environment. You don't have to install anything, so it saves your time because you really don't do anything at all. It's the way that all software should be. They should do all of their learning on their own without you having to install things the whole way.

We implemented it with our in-house team.

This product has saved us tremendous amounts of time and money.

I would just say that you're doing yourself, your business, and your customers a disservice if you're not using Orca, or a tool like it, that provides a deep X-ray-like view into your environment to properly secure it.

We would not be in the cloud or have as much in the cloud without this tool. It's really a precursor to moving anything major into the cloud. In that regard, it's our future. Cloud is our future and without Orca carrying that future, we can't do the things that we want to do. It's very difficult for me to put a return on investment on it because it's so intertwined with everything that we do. We wouldn't be able to do the things that we do without it.

Our search for this product began because we wanted to move to the cloud and we knew that we were vulnerable if we moved up there. We didn't have the visibility that we needed so I actually went looking for this solution. I looked throughout the industry. I talked to everybody I knew and there was nothing. Everybody was cobbling solutions together, trying to achieve some sort of visibility.

A lot of people didn't even know that they were vulnerable or that they had gaps. We did and we saw it. We figured it out and we went looking for a solution.

Coincidentally, I was speaking with somebody at a conference who had recently learned about Orca and they told me about the product. Within a couple of months, he put me in contact with their co-founder and we entered discussions from that point.

The analogy that I like to use when discussing Orca is similar to that of purchasing a used house. When you look at it from the street or after doing a walkthrough, you have no idea what is going on under the floors, or above the ceiling, or behind the walls. There can be all kinds of problems like faulty wiring or leaking plumbing, and you wouldn't know that they existed. This is where the beauty of Orca and the X-ray vision comes in.

You can see all of these things right down to the chip that's used in your cloud instance. It's literally an amazing perspective that to my knowledge, no other tool prior to Orca provided. In my analogy about the house, there is no tool that you can use to see behind everything before you buy a house. However, with Orca, you can see everything.

Everything is laid bare to you before you move your apps up there, or once you move them to the cloud and you begin to build out your real estate. Without a tool like Orca, you're flying blind like a pilot in an airplane without radar. You just can't do that.

When I first looked at Orca, I was somewhat skeptical about whether it could do everything that they claimed. In fact, I'm always skeptical to a degree. In this case, it's different. It literally blew me away based on what I could see. If I consider the analogy of the house, I expected to be able to see under the floor. What I didn't expect was to be able to see behind all of the walls and through the ceiling and through the roof and into the basement, and everywhere. I thought to myself that we couldn't live without this tool. That's how good it is.

If I could rate this product a 15 out of 10, I would. It has well exceeded my expectations and I remember that when I first looked at the Orca environment, I thought that it was amazing. I was able to click, drill down, do everything that I wanted to be able to do, and more.

I would rate this solution a ten out of ten.

Our use case is very simple. Orca Security is used to monitor and have control over your client's cloud environment, specifically the CP-CFPM.

One of the most valuable aspects is the agentless feature. Orca Security doesn't use agents at all.

Maybe the presentation of the data in the dashboard. It's a little bit chaotic. There is room for improvement.

I have been using Orca Security for one and a half years. 

I would rate the stability a ten out of ten. I never faced any problem with stability. Our client base is more SMB.  

I would rate the scalability a ten out of ten. It can easily scale and control a huge environment comprising thousands of VMs. 

The support is very good.

Positive

The initial setup is very easy. We have deployed the solution on the public cloud. However, there is a roadmap, a feature to deploy also in private environments and on-prem environments.

The deployment process takes at least an hour. To onboard, the process is very smooth. You have to collect some information from your cloud environment, specifically as an admin user of your cloud subscription. Then, you have to follow a three-step process inside the Orca platform because Orca will automatically create all the policies and data needed to onboard your subscription.

Orca Security is cheaper compared to other solutions in the same space. 

I would recommend trying this solution once, at least for a month. It is a very good product. 

Overall, I would rate the solution a ten out of ten.

Some of the customers use it to actually look at their assets in the cloud.

It's for protection. It's an agentless tool. We don't need to install anything at a customer's premises. We can just scan the entire assets in the cloud.

It helps increase cloud visibility on different platforms. And also in terms of the security vulnerability in the cloud space. They recommend specific steps as well. 

Actually, it's not all clouds that they are currently onboarded with. For instance, they are not yet with public cloud and many other private clouds.  

Therefore, there is room for improvement, and more private clouds should be added. For the private cloud, we need to install agents into the environment.

I have been using it for two years. 

So far, we haven't faced any complaints at all after two years. 

So, it has been a stable solution.

Many enterprises that have lesser workloads in the cloud, so there's no point in them monitoring themselves.  So those who have heavy workloads on the cloud need this tool too.

So it can handle large loads of information.

There is another company who copies them, like people from Wiz.

Theinterface is different, and we don't have a lot of updated stuff. They are copying Orca Security, and they are not the patent holder. The patent holder is Orca.

This product is very fast to onboard; it takes just five minutes. 

You just need to input the admin credentials for the cloud provider, meaning AWS, Azure, and Google. You can just pull it on, and then Orca covers the entire report already.

There's no need for integration because everything is on the cloud. That's why it's agentless.

Just a few steps for onboarding. It is really quick to deploy.

Orca Security charges are based on cloud workloads. So, it's based on workloads.  

If we look at one feature, it might be expensive. But if we're considering all the features they offer in monitoring and scanning, there aren't many tools out there that can do all they do in one tool. So if you compare that, then this is not really expensive. But if we compare just one feature, then it is more expensive than the others.

The user needs to utilize it as a package. 

I would recommend it. Overall, I would rate the solution an eight out of ten because it needs to expand more to support all the markets. They are not there yet.

Not all private clouds are supported, for example, SAP Cloud.