Sold by: Orca Security CNAPP
Deployed on AWS
Free Trial
Vendor Insights
Quick Launch
Agentless Cloud Security in a Single, Complete Platform with 100% Coverage
4.7
Overview
Orca Security is the true Cloud Native Application Protection Platform (CNAPP) that identifies, prioritizes, and remediates risks and compliance issues across all of your workloads, configurations, and identities on AWS. Orca offers the industrys most comprehensive cloud security solution in a single platform, eliminating the need to deploy and maintain multiple point solutions.
FAST TIME TO VALUE: The Orca CNAPP Platform is agentless first, and connects to your environment in minutes using patented SideScanning™ technology that provides deep and wide visibility into your cloud environment, without requiring agents. In addition, Orca offers a lightweight agent for organizations that require real-time protection for critical workloads.
RISK PRIORITIZATION: Orca effectively prioritizes risks by applying a granular risk score to each alert, and recognizes when seemingly unrelated issues can be combined to create dangerous attack paths straight to your crown jewels.
FULL SDLC SECURITY: The Orca platform shifts security left by seamlessly integrating into the CI/CD process so that applications can be secured from code to cloud and back.
AI-POWERED: Orca is at the forefront of leveraging Generative AI for simplified investigations and accelerated remediation, reducing required skill levels and saving cloud security, DevOps, and development teams time and effort, while significantly improving security outcomes.
PURPOSE-BUILT CNAPP: Orca unifies many different point solutions in one platform, including CSPM, CWPP, CIEM, DSPM, Container security, API security, AI-SPM, and much more.
Sign up for a demo to uplevel your cloud security and get the fastest time to value available in the industry: https://orca.security/demo/
Additional platform licensing options are not shown in this listing but are available via Private Offer. Please email aws@orca.security .
Highlights
- Visibility to all your IAAS and PAAS assets including EC2, Containers, S3 buckets using account level read only permissions
- Detect compromises, vulnerabilities and risky configuration within minutes
- No impact on your assets, grows automatically with your cloud account
Get personalized pricing in minutes - New
If qualified, an express private offer gets you custom pricing and terms. Finalize your purchase in the AWS Marketplace console.
Details
Sold by
Categories
Delivery method
Deployed on AWS
Features and programs
Trust Center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Quick Launch
Leverage AWS CloudFormation templates to reduce the time and resources required to configure, deploy, and launch your software.
Skip the manual risk assessment. Get verified and regularly updated security info on this product with Vendor Insights.
Security credentials achieved
(2)
ISO27001
AWS Security Specialization
Pricing
Free trial
Try this product free according to the free trial terms set by the vendor.
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/month |
|---|---|---|
Small | Small starter pack of concurrent workloads (EC2) per month | $7,000.00 |
Small-Medium | Small-Medium starter pack of concurrent workloads (EC2) per month | $12,000.00 |
Medium | Medium starter pack of concurrent workloads (EC2) per month | $17,000.00 |
Large | large starter pack of concurrent workloads (EC2) per month | $30,000.00 |
Vendor refund policy
Contact us
Custom pricing options
Request a private offer to receive a custom quote.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Support
Vendor support
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Orca Security CNAPP
By Aqua Security Software Inc.
Top
10
In Monitoring, Application Development
Top
25
In Observability, Software Development
Top
10
In Container Workloads
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Agentless Cloud Security Architecture
Agentless-first approach using patented SideScanning technology that provides deep visibility into cloud environments without requiring agent deployment
Risk Prioritization and Attack Path Analysis
Granular risk scoring applied to each alert with capability to identify and correlate seemingly unrelated issues into dangerous attack paths
Unified Cloud Security Platform
Single platform consolidating multiple security functions including CSPM, CWPP, CIEM, DSPM, Container security, and API security
CI/CD Integration for Application Security
Seamless integration into CI/CD process to secure applications from code to cloud deployment
AI-Powered Investigation and Remediation
Generative AI capabilities for simplified security investigations and accelerated remediation workflows
Offensive Security Engine
Simulates external exploits to produce Verified Exploit Paths for prioritizing exposures that are reachable by outside attackers and reducing cloud attack surface.
Cloud Security Posture Management
Continuously monitors and manages security of AWS configurations to prevent public exposure and ensure compliance.
Secrets Scanning
Identifies more than 750 types of secrets across public and private repositories.
Cloud Infrastructure Entitlements Management
Detects and manages excessive or unused permissions to mitigate the risk of privilege escalation.
Real-Time Malware Detection
Detects malware including zero-days in milliseconds with scanning performed directly in cloud environment for object storage services like Amazon S3 and file storage services.
Multi-Workload Security Coverage
Unified platform securing containers, serverless, Kubernetes, and AI workloads across AWS, on-premises, and multi-cloud environments
Runtime Threat Detection and Enforcement
Runtime protection to detect threats, block malicious activity, and enforce compliance in production across all cloud native workloads
AI and LLM Security Governance
Purpose-built AI workload security to govern large language models and generative AI applications with model abuse detection and policy enforcement
Full Lifecycle Security
Security coverage across the entire software development lifecycle from code development through production deployment
Compliance and Authorization Standards
FedRAMP High authorization enabling compliance with rigorous security and regulatory standards
Validated by AWS Marketplace
FedRAMP
GDPR
HIPAA
ISO/IEC 27001
PCI DSS
SOC 2 Type 2
-
-
-
-
-
No security profile
-
-
-
Standard contract
No
No
No
Customer reviews
Logan Gray
Cloud risk context has improved and prioritization now streamlines patching decisions
Reviewed on Jul 20, 2026
Review provided by PeerSpot
What is our primary use case?
My main use case for Orca Security is to protect our cloud infrastructure. Specifically, I scan our cloud workloads with Orca Security to detect vulnerabilities and help determine what to prioritize for patching and upgrading.
What is most valuable?
Orca Security helps me decide what to prioritize for patching and upgrading with its workload protection features that work really well and help contextualize and prioritize the issues it finds.
The best features Orca Security offers are cloud security and its shift-left features. The shift-left features of Orca Security help detect issues earlier in the software development lifecycle, benefiting my team day-to-day.
Orca Security has positively impacted my organization by helping us become more secure by flagging and prioritizing issues.
My impressions of the risk detection and identification capabilities of Orca Security are that they are very good because it helps contextualize and prioritize the issues for us to work on.
Orca Security has helped in preventing risks and attacks across my application lifecycle by highlighting insecure configurations or vulnerabilities that do not yet have an exploit so that we can resolve those issues before they become more critical.
My impression of Orca Security's ability to analyze risks contextually and holistically is that it seems quite good because it has visibility of our entire cloud infrastructure and can gather additional context to help prioritize and inform on issues.
What needs improvement?
Sometimes with Orca Security, it is a little bit hard for me to differentiate between different ephemeral cloud workloads and what the actual root cause of a particular issue is. I rate it a nine because of the issues with ephemeral workloads that I mentioned, which kept it from being a perfect ten.
For how long have I used the solution?
I have been using Orca Security for four years.
What do I think about the stability of the solution?
Orca Security is stable.
What do I think about the scalability of the solution?
The scalability of Orca Security is very good.
How are customer service and support?
I find the customer support for Orca Security to be good.
Which solution did I use previously and why did I switch?
I did not previously use a different solution.
How was the initial setup?
My experience with pricing, setup cost, and licensing is that the pricing was about on par with other options, the setup was very easy, and licensing is quite straightforward.
What was our ROI?
Although I do not have well-defined ROI with Orca Security, it has prevented us from needing additional employees, and it has certainly saved time.
What's my experience with pricing, setup cost, and licensing?
My experience with pricing, setup cost, and licensing is that the pricing was about on par with other options, the setup was very easy, and licensing is quite straightforward.
Which other solutions did I evaluate?
Before choosing Orca Security, I evaluated other options, which included Google Security Command Center, Prisma Cloud, and Qualys.
What other advice do I have?
Orca Security has helped my organization reduce the time it takes to address cloud security alerts; since bringing Orca Security in, it has improved our time to resolve by about fifty percent.
I find it very easy to prioritize risks using Orca Security.
Regarding Orca Security's AI capabilities, I think their governance and security are pretty good because I use those capabilities as well.
I have not seen any issues with the accuracy and reliability of Orca Security's AI output; it seems accurate.
My advice to others looking into using Orca Security is to try to consider organizing assets by business units just to help organize and prioritize findings relevant to different teams. I rate Orca Security a nine overall.
Alvaro V.
Orca Makes Least Privilege Practical with Clear Permission and Usage Visibility
Reviewed on Jul 17, 2026
Review provided by G2
What do you like best about the product?
Least privilege is always the goal, but in a world where the marketer writes the Python and the analyst ships the agents, it was hard to know where to start. Orca shows the effective permissions and the actual usage across agents and identities tied to the systems our team builds, so the effort can go first to the agents and roles with the largest blast radius around the assets that drive the business. That makes the CISO’s least-privilege goal something the team can realistically chip away at each sprint—for agents and humans—instead of leaving it as a theoretical aspiration.
What do you dislike about the product?
We took care to test the changes around some legacy applications and the older agents before tightening access based on the Orcas findings, which helped us roll out least privilege safely.
What problems is the product solving and how is that benefiting you?
It turns least privilege for AI agents into a practical, incremental approach that fits how builders actually work, instead of treating it like a blanket rule that would slow everything down. Over time, that means agents and their identities steadily become safer, without putting a brake on creation.
Rafael Bueno
Cloud security has gained full visibility and real-time remediation for our small team
Reviewed on Jul 16, 2026
Review provided by PeerSpot
What is our primary use case?
I use Orca Security to have a complete view of our cloud environment at the company.
I needed to know what assets were vulnerable and how to fix them, and it was very helpful to have Orca Security because it has some AI features that helped our developers fix the vulnerabilities while coding and understand which vulnerabilities require more attention and resources.
OrcA Security automates remediation because we could install a plugin in the developer's IDE , so while they were coding, it actually helped them fix vulnerabilities in real time, which was very helpful.
What is most valuable?
The AI fix for vulnerabilities that we found is the best feature because it gives us more time to focus on other things.
The dashboards were very helpful, and I could personalize them for our case, which helped me show my leadership where the main points were and how to address them, allowing us to focus on what was really important. It was very easy to change the dashboards and personalize everything.
OrcA Security improved our collaboration because we could explain better to everyone at the company what we were doing and how it positively impacts our security posture. We could also measure our risks and vulnerabilities better, enabling us to think more strategically about improving our cybersecurity posture.
We have faster fixing of vulnerabilities with our DevOps team, and we could have fewer attacks.
It was really good because we could see threats coming before they materialize, which I think is a really good way to protect ourselves, our resources at the company, and all our assets.
We are a small team, and I did not feel any difficulty in the work using Orca Security, so I believe it saved us more employees and other costs, helping us save in different ways.
What needs improvement?
Some dashboards could be a little more personalized for each company and have more options to show the real data we need for our leadership.
For how long have I used the solution?
I have been using Orca Security for a year.
What do I think about the stability of the solution?
I believe it is stable, and we did not have any availability problems with them.
What do I think about the scalability of the solution?
It is very scalable. We have a small environment, but it was very scalable when the Orca Security engineers were explaining the tool to us.
How are customer service and support?
It was really good. We had direct access to some commercial people and also the engineers, and they helped us every time we needed.
Which solution did I use previously and why did I switch?
It was Prisma Cloud, and we stopped using it because of the costs, and the results were not that organized or easy to use as Orca Security.
We jumped directly to Orca Security without comparing it with any other platform.
How was the initial setup?
We installed the Orca Security plugin in the developers' machines, and when they were coding, they could see the vulnerabilities with the Orca Security plugin and fix them in the code before it was put into the production environment. This allowed us to fix vulnerabilities before they reached our productive systems, which was very helpful.
What about the implementation team?
We are not working with a partner or reseller.
What was our ROI?
Eight out of ten.
What's my experience with pricing, setup cost, and licensing?
I believe it can be improved, but it is also a really good platform to use.
Which other solutions did I evaluate?
Someone asked me on LinkedIn to talk about Orca Security.
What other advice do I have?
It was really accurate and gave us the right answers.
The advice I give is to talk with the support team. They help us and listen to us about features and things that made sense for our environment and our specific case, and they consider applying them to the final product.
I rate this product a 10 out of 10.
Bilal J.
Orca Makes Shadow AI Agents Visible and Governable Across Our Cloud
Reviewed on Jul 16, 2026
Review provided by G2
What do you like best about the product?
We’re used to talking about shadow infrastructure, but now the real story is shadow AI. Almost anyone in the company can spin up an AI agent that talks to real systems, calls APIs, and acts on behalf of users. Many of those agents were created without a formal process and quietly became part of our attack surface. Orca discovers AI agents wherever they appear across our cloud estate, shows which identities they run as, which systems they can reach, and what data sits behind those paths. Shadow AI agents go from invisible to mapped in a way we can actually govern.
What do you dislike about the product?
We chose to invest some time in tagging agents with the owners and the business units in Orca, and it turned visibility into clear accountability for each shadow agent we discovered. That work also made every follow-up conversation much more concrete and easier to act on.
What problems is the product solving and how is that benefiting you?
It turns shadow AI from a vague concern into a specific, manageable set of agent identities and data paths we can actually control. Instead of guessing where unauthorized or untracked agents might be, we can see them clearly, assign owners, and apply the same discipline to these agents that we already use for human and service identities—without slowing down builders.
Prathamesh B.
Agentless Cloud Visibility That’s Easy to Deploy
Reviewed on Jul 15, 2026
Review provided by G2
What do you like best about the product?
I like the fact that it has an agentless way of providing full cloud visibility without requiring much effort or adding extra work to day-to-day operations.
What do you dislike about the product?
I dislike the slow auto-recommendation and the slow detection, especially in the 24-hour cycle, which makes the response harder. There are also limits in the integration, reporting, and analysis.
What problems is the product solving and how is that benefiting you?
It helps me solve the problem of poor cloud visibility. Teams often can’t see all their malware, vulnerabilities, and configuration risks, and this makes it harder to stay on top of issues. This also lowers the agent overload, along with the alert noise.