Report: Orca Security as a CNAPP Platform

Overview

This report examines Orca Security and the Orca Cloud Security Platform as a Cloud-Native Application Protection Platform (CNAPP). It looks at vendor claims, third‑party analyst views, and customer feedback to understand how well Orca functions as a CNAPP across posture management, workload/runtime protection, identity and data security, DevSecOps integration, and multi/hybrid‑cloud coverage.

Throughout, “Orca” refers to the Orca Cloud Security Platform (the SaaS CNAPP offering from Orca Security).

What makes Orca a "true" CNAPP compared to competitors?
Does Orca’s agentless SideScanning miss runtime threats?
How does Orca compare to Wiz and Prisma Cloud as CNAPP?
Is Orca CNAPP suitable for hybrid and on‑prem environments?
How do customers rate Orca Security as a CNAPP?
What are the limits of agentless CNAPP approaches?

---

CNAPP positioning and core promise

Claimed positioning. Orca markets itself explicitly as a purpose‑built CNAPP that unifies CSPM, CWPP, CIEM, DSPM, vulnerability management, API security, compliance and more in a single platform, powered by a unified data model and patented SideScanning technology for agentless visibility across AWS, Azure, Google Cloud and additional clouds.¹ Orca states that its platform is designed to consolidate multiple point tools and provide contextual risk prioritization rather than raw alert streams.²

Analyst recognition. Gartner’s CNAPP guidance cites Orca as a Representative Vendor in the CNAPP market and describes CNAPP as the convergence of CSPM, CWPP, KSPM, CIEM and related capabilities in a unified platform.³⁴ Independent analyst TAG Cyber’s assessment notes that Orca packages CSPM, CWPP, CIEM, DSPM and runtime capabilities through Orca Sensor and GenAI into a single offering, highlighting breadth as a core strength.⁵

Customer perception. Customer reviews on AWS Marketplace and Orca’s own published testimonials consistently describe Orca as a central CNAPP: a tool they use to gain a holistic view of multi‑cloud risk, with frequent comments about fast time to value and agentless deployment (“adds value practically from the first day of use”).⁶⁷

High‑level assessment: From both vendor and analyst perspectives, Orca is clearly positioned and recognized as a full CNAPP rather than a narrow CSPM or CWPP.

---

Capability coverage compared with CNAPP definitions

A typical CNAPP, per Gartner and other commentators, should combine:⁸

• Posture management (CSPM/KSPM)
• Workload and runtime protection (CWPP)
• Identity and entitlement management (CIEM)
• Data security (DSPM‑style capabilities)
• DevSecOps/shift‑left integrations

Posture management (CSPM / KSPM)

Evidence of strength

• Orca provides CSPM across major clouds (AWS, Azure, GCP, plus Oracle Cloud and Alibaba Cloud in research data), with continuous assessment against >100 frameworks and CIS benchmarks.⁹
• The platform inventories cloud assets, configurations and workloads, then correlates misconfigurations, vulnerabilities and exposure context in a unified data model to prioritize risk.¹⁰
• Analyst and vendor content highlight Orca’s combination of CSPM with agentless CWPP as a differentiator that reduces the operational overhead of separate tools.¹¹

Limitations / nuance

• Like all CNAPPs, Orca still depends on cloud provider APIs and configuration data for posture. Misconfigured or unsupported services can reduce coverage.
• Independent market guides point out that CNAPP tools in general (not singling out Orca) can struggle to cover all cloud services uniformly, especially as providers rapidly add new managed services.¹²

Takeaway: Orca aligns well with CNAPP expectations for CSPM/KSPM and is often described as particularly strong at multi‑cloud posture plus risk context.

Workload and runtime protection (CWPP)

Static and near‑real‑time coverage (agentless)

• SideScanning reads cloud workloads via underlying block storage snapshots (VMs, containers, serverless) to perform deep vulnerability and malware analysis without deploying agents.¹³¹⁴
• Orca markets this as delivering “100% continuous coverage” of workloads, including newly added assets, with no performance impact on workloads and no need for local agents.¹⁵

Runtime and hybrid coverage

• Orca has introduced an optional Orca Sensor runtime component for Windows runtime protection and broader runtime detection across hybrid, private and on‑prem environments, with detections for container escape attempts, privilege escalation, reconnaissance and “living off the land” techniques.¹⁶¹⁷
• Press and integrations (e.g., with Aqua Security for runtime protection) suggest that Orca augments its agentless approach with partnerships where deeper, kernel‑level runtime coverage is required.¹⁸

Critical perspectives

• Independent commentary on CNAPP as a category notes that vendors often struggle to span posture and deep runtime in a single platform; runtime coverage can lag behind posture features.¹⁹
• Orca’s own content on agentless vs agent‑based security concedes that agent‑based sensors offer stronger real‑time, in‑memory detection (e.g., fileless attacks) than pure agentless approaches, which rely on snapshots and external telemetry.²⁰

Takeaway: Orca delivers strong static and near‑real‑time workload visibility via SideScanning and is actively expanding runtime coverage (Sensor, hybrid support). For organizations that require deep, kernel‑level, continuous runtime EDR‑style protection everywhere, Orca may still need to be complemented with specialized runtime tools.

Identity and entitlement (CIEM)

Capabilities

• Orca’s CIEM features aim to detect identity misconfigurations, over‑privileged accounts and risky permission paths, with identity hygiene metrics and risk scores.²¹
• Integrations with Google Workspace, Chronicle, Security Command Center and SSO/IdPs extend identity visibility beyond IaaS into SaaS identity surfaces.²²²³
• Orca is referenced alongside other CIEM players in Gartner CIEM materials, and Orca emphasizes multi‑cloud CIEM coverage via a unified platform.²⁴

Limitations / nuance

• Specialist CIEM tools (and emerging AI identity‑security platforms) focus heavily on complex non‑human identities, dynamic permissions and fine‑grained governance. Critics of CNAPPs in general argue that bundled CIEM modules can lag behind best‑of‑breed identity platforms in depth of analysis and workflow automation.

Takeaway: Orca provides meaningful CIEM functionality folded into the CNAPP, sufficient for many teams. Organizations with extreme identity‑centric risk or complex IAM governance may still prefer a dedicated CIEM in addition.

Data security (DSPM‑style)

Capabilities

• Orca includes data scanning for sensitive data in cloud storage, databases and workloads, tying these findings into its unified data model for contextual risk prioritization.¹⁰
• Independent reviews call out Orca’s ability to protect sensitive data as a strength compared with some developer‑focused tools.²⁵
• Orca has also rolled out AI Security Posture Management (AI‑SPM) for AI services, models and packages running in the cloud, which overlaps with protecting data flows involving AI components.²⁶

Limitations / nuance

• Dedicated DSPM vendors invest heavily in advanced classification (LLMs, NER, DataDNA‑like approaches) and complex data lineage, often beyond what a CNAPP module provides. Third‑party commentary implies that CNAPP‑embedded DSPM features, including Orca’s, may not fully match those depth‑first capabilities.

Takeaway: Orca’s data and AI‑related posture features go beyond basic CNAPP posture, but enterprises with stringent data discovery, classification and lineage needs may still pair Orca with a dedicated DSPM.

DevSecOps and “shift‑left” integrations

Strengths

• Orca supports code and IaC scanning, CI/CD integrations and “cloud to Dev” tracing, so findings in production can be tied back to code owners and pipelines.²⁷
• Orca integrates with SCMs, IDEs and ticketing systems to push prioritized vulnerabilities and misconfigurations directly into developer workflows, which analysts view as key for CNAPP adoption.²⁸
• Customers and case studies (e.g., NGDATA, RSA) describe improved cohesion between security, DevOps and development teams using Orca as a shared platform.²⁹³⁰

Limitations / nuance

• Developer‑first platforms (e.g., SAST/DAST/ASPM vendors) may provide more sophisticated code‑level analysis or automated remediation patterns. Independent commentary emphasizes that some CNAPPs, including Orca, still lean “shift‑right” and must keep investing to stay competitive on the developer experience side.

Takeaway: Orca meaningfully participates in DevSecOps workflows and satisfies many organizations’ shift‑left needs, but highly developer‑centric teams might prefer pairing it with specialized application security tooling.

---

Architecture: agentless SideScanning and unified data model

SideScanning and agentless model

• SideScanning reads workload block storage (snapshots) from the cloud provider side to analyze OS, packages, configuration, malware and sensitive data without deploying in‑guest agents.¹³³¹
• This approach is repeatedly described by customers and analysts as dramatically simplifying deployment, eliminating friction of deploying/maintaining agents and providing broad initial coverage in minutes.³²³³
• The trade‑off, acknowledged even in Orca’s own content, is that agentless scanning cannot observe all in‑memory or ephemeral behavior; deep real‑time runtime detection still requires sensors or partner tools.²⁰

Unified data model and AI

• Orca consolidates telemetry from workloads, configurations, identities, APIs and data into a unified data model, then layers AI‑driven risk scoring and generative‑AI assistance on top.¹⁰³⁴
• Independent assessments highlight dynamic reachability analysis (agentless + runtime‑aware) as a capability that helps de‑prioritize >90% of vulnerabilities by focusing on those actually reachable from exposure paths.¹⁴³⁵
• Customers note that the unified model and AI Assistant make cloud risk investigation and remediation decisions significantly faster, reducing mean time to remediation and alert fatigue.[^orca-ai-blog]³⁶

Takeaway: The agentless‑first architecture and unified data model are widely seen as key differentiators for Orca as a CNAPP, with clear deployment and usability advantages, balanced by the usual agentless runtime blind spots.

---

Independent analyst and market views

Gartner and market guides

• Gartner’s CNAPP Market Guide and reviews of CNAPP solutions describe Orca as an agentless‑first CNAPP providing prevention, detection, response, remediation and forensics under one umbrella.³⁷
• Orca is named a Representative Vendor in Gartner’s 2025 CNAPP Market Guide, indicating it meets Gartner’s baseline CNAPP capability expectations.⁴
• Gartner and CSA also highlight structural challenges for CNAPP adoption: developer distrust of security tools that slow pipelines, and the complexity of fully integrating posture, runtime, identity and data in a single platform.[^gartner-6-insights]¹²

TAG Cyber and other assessments

• TAG Cyber’s independent assessment calls out the breadth of the Orca platform (CSPM, CWPP, CIEM, DSPM, runtime, GenAI) and argues that this breadth, combined with agentless deployment, is a major source of ROI (TAG estimates ~207% ROI for Orca CNAPP deployments).⁵³⁸
• Other analyst and investor research (e.g., Sacra, Convequity, Contrary) position Orca as a strong competitor in the CNAPP space, emphasizing its agentless architecture and unified risk prioritization as the core value proposition.³³³⁹

Takeaway: Analysts generally view Orca as one of the leading agentless CNAPPs, competitive with vendors like Wiz, Prisma Cloud and CrowdStrike in the CNAPP segment, particularly for organizations prioritizing fast deployment and broad multi‑cloud visibility.

---

Customer feedback: strengths and pain points

Reported strengths

From AWS Marketplace and published case studies:

• Fast time to value. Multiple customers say Orca “adds value practically from the first day of use,” contrasting it with tools that take months to show value.⁶
• Agentless deployment. Reviews highlight not having to deploy or manage agents across thousands of workloads as a major benefit, both in speed and in avoiding organizational friction.³²⁴⁰
• Visibility and prioritization. Customers praise Orca for clear visibility into vulnerabilities, misconfigurations and compliance risks, and for contextual prioritization that reduces noise compared with previous tools.³⁶
• Multi‑team alignment. Case studies (e.g., NGDATA, RSA) describe Orca as a shared platform uniting security, DevOps and compliance around a single risk view.²⁹³⁰

Reported or implied limitations

Direct negative reviews are less frequently published, but some themes emerge from broader CNAPP critiques and Orca’s own content:

• Runtime depth vs. agent‑based tools. Because SideScanning is agentless, organizations that need very deep runtime telemetry (e.g., in‑memory attack detection, kernel‑level eBPF visibility) may still deploy dedicated runtime agents or products alongside Orca.²⁰⁴¹
• Complex environments and scaling. General CNAPP commentary notes that large, complex multi‑cloud and hybrid environments can challenge any CNAPP in terms of scale, alert volume and integration, implying that careful tuning and governance are needed to avoid alert fatigue even with contextual prioritization.⁴²⁴³
• Not a full developer‑tool replacement. Developer‑first security platforms can provide richer code‑level analysis and remediation experiences than CNAPPs; some teams use Orca primarily for cloud/runtime and pair it with SAST/DAST/ASPM.⁴⁴

Takeaway: Real‑world customers generally evaluate Orca positively as a CNAPP, especially for agentless visibility, risk context and time to value. The main caveats align with the expected trade‑offs of any agentless, broad CNAPP platform.

---

Comparative positioning vs. other CNAPP vendors

Below is a synthesized comparison table based on verified claims and third‑party commentary. It is not exhaustive but captures typical differentiators.

Aspect	Orca Security	Wiz	Prisma Cloud	CrowdStrike CNAPP	Notes
Deployment model	Agentless‑first (SideScanning) with optional Sensor for runtime; SaaS CNAPP1316	Agentless‑first with optional agents for deep telemetry45	Mixed agent/agentless, strongly integrated with Palo Alto ecosystem	Agent‑heavy, strong EDR heritage	Orca and Wiz emphasize minimal friction; Prisma/CrowdStrike lean more on agents.
Scope of CNAPP features	CSPM, CWPP, CIEM, DSPM, runtime, API security, AI‑SPM in one platform126	CSPM+CWPP+CIEM, strong posture and runtime focus8	Broad CNAPP (CSPM, CWPP, CIEM, WAAS, etc.)	Strong CWPP/runtime, posture via CSPM modules	All four are recognized CNAPPs; Orca and Wiz are commonly cited as agentless leaders.
Multi‑cloud coverage	AWS, Azure, GCP, plus support for other clouds (e.g., Oracle, Alibaba in research) and containers/Kubernetes4647	AWS, Azure, GCP and more	Broad multi‑cloud	Broad; strong endpoint/host view	All support major public clouds; differences tend to be in depth per service.
Hybrid / on‑prem	Extends runtime protection to hybrid, private and on‑prem via Orca Sensor16	Hybrid support with agent options	Strong for hybrid via Prisma and firewalls	Strong EDR + cloud workloads	Orca is moving beyond cloud‑only via runtime Sensor; still newer than its public‑cloud posture core.
Runtime depth	Agentless snapshot + optional runtime Sensor; not a full EDR2017	Agentless with some runtime features; optional agents for depth	Strong workload/runtime coverage with agents	Very strong runtime/EDR; cloud posture as an add‑on	For maximum runtime depth, agent‑based EDR/CWPP can still be preferable.
Identity (CIEM)	Integrated CIEM with identity hygiene, risk scoring and SaaS identity integrations2122	CIEM integrated; strong cloud permission insights	CIEM integrated	Identity features via Falcon Identity and cloud modules	Depth vs specialized CIEM vendors should be evaluated per environment.
Data / DSPM	Sensitive data discovery, contextual risk; AI‑SPM for AI assets26	Data context and exposure analysis	Data security modules	Less central (depends on add‑ons)	Dedicated DSPM tools can provide deeper classification/lineage.
DevSecOps integration	CI/CD, SCM, IDE and ticketing integrations; “Cloud to Dev” tracing2728	Strong DevSecOps posture	Strong, especially in Palo Alto ecosystems	DevSecOps mainly via integrations with scanning tools	Orca’s value is in tying runtime/posture back to code and owners rather than replacing all app‑sec tools.
Time to value	Frequently cited as “value from day one” due to agentless onboarding632	Also praised for quick value; similar story	More setup; depends on existing Palo Alto footprint	Agents and tuning may lengthen time to value	Orca and Wiz have similar “fast start” narratives; large platforms can take longer to realize value.

More on Orca vs Wiz/Prisma as CNAPP

---

Typical fit and use cases

Based on vendor materials, analyst reports and customer stories, Orca tends to fit best when organizations:

• Run multi‑cloud (AWS/Azure/GCP) estates and want a single, agentless platform for visibility and risk prioritization.
• Are struggling with multiple point tools (CSPM, CWPP, vulnerability scanners, basic CIEM) and want consolidation with lower operational overhead.¹⁴⁸
• Need faster onboarding and time to value than is feasible with large agent‑based platforms.
• Want to bring security, DevOps, and development teams together around a shared cloud risk model, with contextual prioritization and clear ownership.²⁹³⁰

It may be less ideal as a sole solution when organizations:

• Require maximum, host‑level runtime telemetry and response across all workloads (e.g., regulated environments that standardize on EDR/agent‑based CWPP everywhere).
• Have extremely advanced identity or data‑security requirements that already justify dedicated CIEM or DSPM platforms.
• Are heavily focused on deep code‑level security in application pipelines and already standardized on robust SAST/DAST/ASPM suites.

---

Conclusion

From the available evidence:

• Orca is broadly recognized by analysts and customers as a genuine CNAPP platform, not just rebranded CSPM or CWPP.
• Its agentless SideScanning plus unified data model and AI are the primary differentiators, delivering rapid coverage and strong contextual risk prioritization across multi‑cloud estates.
• Runtime protection, identity and data security features are present and evolving, but organizations with very deep requirements in those domains may still pair Orca with specialized tools.
• In the CNAPP landscape, Orca competes most directly with Wiz and Prisma Cloud; it stands out especially for fast deployment, agentless coverage and ROI, at the cost of some of the ultra‑deep runtime and niche feature depth that best‑of‑breed point solutions can provide.

Overall, Orca is well‑aligned with the CNAPP concept and is a strong candidate for organizations prioritizing multi‑cloud visibility, consolidation of cloud security tools and rapid time to value, while accepting the usual trade‑offs of an agentless‑first, broad CNAPP platform.

---

Footnotes

1. Orca CNAPP positioning and feature list, Orca platform overview. ↩ ↩² ↩³

2. Orca risk prioritization description, AWS Marketplace listing. ↩

3. Gartner Innovation Insight and CNAPP Market Guide references via Orca blog. ↩

4. Orca named a Representative Vendor in 2025 Gartner Market Guide for CNAPP. ↩ ↩²

5. TAG Cyber independent assessment of Orca platform breadth and ROI. ↩ ↩²

6. Orca case studies quoting “adds value practically from the first day of use.” ↩ ↩² ↩³

7. AWS Marketplace reviews describing Orca as comprehensive cloud security/CNAPP. ↩

8. Wiz Academy description of what CNAPP is and required components. ↩ ↩²

9. Orca compliance framework coverage statements. ↩

10. Orca unified data model and telemetry claims. ↩ ↩² ↩³

11. TechCrunch/Orca material on combining CSPM and agentless CWPP. ↩

12. Cloud Security Alliance CNAPP survey on challenges and coverage. ↩ ↩²

13. Orca SideScanning technical brief describing block‑storage scanning. ↩ ↩² ↩³

14. AWS APN blog on Orca’s reachability analysis. ↩ ↩²

15. Orca statements about 100% coverage/continuous coverage with SideScanning. ↩

16. Orca press release on extending runtime protection to hybrid and private clouds. ↩ ↩² ↩³

17. Orca runtime sensor blog on hybrid cloud runtime security. ↩ ↩²

18. Aqua Security announcement on partnering with Orca for runtime protection. ↩

19. SoftwareAnalyst CNAPP guide discussing difficulty spanning posture and runtime. ↩

20. Orca’s own blog on agentless vs agent‑based security. ↩ ↩² ↩³ ↩⁴

21. Orca IAM risk/CIEM solution page. ↩ ↩²

22. Google Cloud page on Orca integration with Workspace, Chronicle, SCC, Vertex AI. ↩ ↩²

23. Orca blog on integrating with Google Workspace and CIEM expansion. ↩

24. Orca blog on new Gartner CIEM report and Orca’s CIEM role. ↩

25. G2 comparison noting Orca’s sensitive data protection strength vs Snyk. ↩

26. Orca blog on AI Security Posture Management (AI‑SPM). ↩ ↩² ↩³

27. Orca CNAPP platform page describing “Cloud to Dev” tracing and AppSec pipelines. ↩ ↩²

28. Orca blog on CNAPP and DevSecOps workflows / 2025 CNAPP Market Guide insights. ↩ ↩²

29. NGDATA case study on Orca enabling DevSecOps. ↩ ↩² ↩³

30. RSA Security case study on unifying cloud security with Orca. ↩ ↩² ↩³

31. SideScanning technical brief on simplifying deployment vs agent‑based tools. ↩

32. Orca review pages praising agentless architecture. ↩ ↩² ↩³

33. Sacra research on Orca’s business and agentless adoption. ↩ ↩²

34. Orca AI Assistant descriptions, including natural‑language investigation. ↩

35. Press/research on Orca’s agentless reachability reducing exploitable vulnerabilities. ↩

36. AWS reviews citing clear prioritization and visibility. ↩ ↩²

37. Gartner Peer Insights description of Orca as AI‑powered platform. ↩

38. Orca/ TAG Cyber ROI estimation (~207% ROI) for Orca CNAPP. ↩

39. Convequity analysis of Orca as CNAPP + shift‑right winner. ↩

40. AWS reviews praising agentless deployment and reduced friction. ↩

41. Falco and similar runtime tools as examples of deep runtime security. ↩

42. AccuKnox commentary on Sysdig CNAPP gaps (illustrating typical CNAPP pain points). ↩

43. Sysdig CNAPP Market Guide commentary on CNAPP benefits and limits. ↩

44. Aikido’s cloud security guide on developer‑first approaches and CNAPP context. ↩

45. Wiz Academy article comparing top CNAPP vendors (including Orca, CrowdStrike, SentinelOne, Fortinet). ↩

46. Orca overview for Google Cloud estates. ↩

47. Orca Research Pod report scanning multiple clouds. ↩

48. Orca CNAPP platform page on consolidating point tools. ↩