Orca Security Reviews

We used Orca Security for Cloud Security Posture Management (CSPM), vulnerability assessment, and several other security controls, including Shimless Security. It helped us consolidate our security tools and provided a central view for organization-wide visibility.

The best features of Orca Security include its ability to perform a lot of security controls without requiring any installation of agents, making it very easy to set up. This feature allowed us to replace a lot of tools with one comprehensive platform, enhancing our ability to consolidate the security footprint on a large scale. 

It provided us with visibility from a central point, increasing our view from the previous thirty percent to a full one hundred percent of our cloud environment. This comprehensive view facilitated improvements in our security posture.

We are using it for cloud security posture management to detect vulnerabilities, misconfigurations, threats, and malware in our cloud environment.

Orca has helped us reduce the time it takes to address cloud security alerts because of its risk-based calculation and immediate notifications for critical assets and popular vulnerabilities.

I am primarily using Orca Security for cloud security. Being part of the vulnerability management team, I utilize Orca Security for generating vulnerability alerts on cloud assets.

One aspect that stands out is the seamless integration. Once our organization is configured, any cloud account under that organization is automatically detected in Orca Security, along with all the assets associated with it. 

Another valuable feature is the side scanning technology using a snapshot mechanism. This technology allows for coverage of almost all cloud assets without interrupting their operations.

Our clients use Orca Security for various reasons. We implement it for the clients.

Orca Security has helped reduce the time it takes to address cloud security alerts. It has reduced alerts by almost 30% to 40%. It was initially 300 alerts, and recently with one customer, it reduced to 30% to 40%, which is a good value add for this.

It takes approximately three to six months to see time to value.

I use Orca Security as a CSPM tool primarily for cloud security and posture management. I utilize its CIEM and CDR features extensively. CIEM focuses on cloud infrastructure and entitlement management, and CDR deals with cloud detection and response.

I find Orca Security's CIEM feature invaluable, as it focuses on entitlement and posture management, identifying assets with older OS versions, and asset misconfiguration. 

The CDR feature is also critical, focusing on detection and response, triggering alerts like brute force attacks and malware. It provides alert and asset details, which include multiple remediation actions. It combines functionalities of multiple security tools and collects alerts and logs from them.

We use the solution to show misconfiguration. Often, users lack knowledge about their assets' fingerprints and their cloud provider's configurations.

Orca Security has patented technologies. It's an agentless solution, so you don't need to install an agent. Instead, it contacts your account provider and fetches metadata, eliminating the need for snapshots or reserved space to copy client infrastructure.

The multi-cloud capability displays essential information and potential vulnerabilities with granular detail. For instance, it identifies paths that attackers might exploit to gain root or admin access to machines.

It is comprehensive, covering a wide range of software needs. They also integrate with CI/CD pipelines, enabling developers to ensure security from the early stages of code deployment. This integration provides a 100% guarantee on security, safeguarding images, configurations, and other crucial information throughout the development process.

I use it for our cloud security posture. Initially, the idea was to increase visibility because we had zero visibility into our cloud environment.

Orca provides agentless data collection directly from your cloud configuration and from the workload runtime block storage. They call it SideScanning. What it does is it copies the image of the assets and then the solution does all its analysis on the side. It just records the image and then looks at it. It sees everything that is installed on the image, like type of data, packages, applications, and the audit log. It can even see into ODD and other activity logs that are not collected by default by DevOps. It provides you with great visibility into each asset, including containers, storage devices such as RDS, CCS, and EC2, and S3—all the basic and major components in cloud environments. And that's true not only for AWS, but for all three cloud providers.

This agentless approach means there is zero performance impact. That's the whole idea. The only thing it does is copy the image and then it does the scan which is a read-only operation. It doesn't use the computing resources. That makes it very lightweight.

The agentless collection of data enables Orca to see assets within their environmental and business contexts and prioritize truly critical security issues. It sees things very clearly and you get a notification, alerts to Slack or whatever system you are using. We have also exported the alerts to our Splunk environment, to cross-reference them with other systems as well. It provides great focus on the right and the most important topics that we should attend to first.

In terms of consolidating vendors, Orca solved a few issues for us. Because we came across it very early in the process of picking tools for our cloud environment, we saved a lot of money by not having to pick multiple different tools to cover different aspects of cloud security. We had good timing when we picked Orca, rather than various tools to do the same job. If you have multiple scanners and you install Orca, you can remove the other ones. That's great and will save you money and a lot of working hours. A lot of the work we did previously was done manually. Now, we get good visibility and it saves manpower as well.

We didn't have anything, and Orca solved three or four different problems in a single tool. If I had had to buy three different tools, obviously it would cost more, but I can't estimate how much the difference would have been. What I can say is that Orca has saved us at least half of a SecOps FTE, at least in the beginning when I didn't have a team and did most of the work and the monitoring myself. It has saved me a lot of time, because I needed a lot of DevOps resources to help me before we had Orca. When I installed Orca, I became very independent. That was really a great feeling.