Orca Security Reviews & Product Details

Orca enabled us to have full visibility into our cloud environment. It is a powerful tool that provides the necessary details to properly secure your infrastructure. It gives you consistent up-to-date information. It is an incredibly easy to use platform. We were able to implement and start getting results within 24 hours. Orca is also extremely scalable. Review collected by and hosted on G2.com.

Orca provides a lot of information and can result in alert fatigue. There are some areas with vulnerability management that they can do better on. For instance, having the ability to not alert on vulnerabilities that are superseded. Review collected by and hosted on G2.com.

Agentless Approach and Deep Visibility. It doesn't require the installation of any agents or additional software, that’s why we need just minutes to onboard new accounts to Orca. After onboarding, Orca provides really comprehensive asset discovery, vulnerability scanning, and risk assessment. Also, I am impressed by Orca Security's continuous product development and its dedication to introducing new features. Review collected by and hosted on G2.com.

Usually, Orca performs scans every 24 hours, that's why alerts are not real-time. Also, it would be great if Orca expand its integration capabilities especially with Cloudflare Review collected by and hosted on G2.com.

The alerts are accurate and come through in a timely fashion. Review collected by and hosted on G2.com.

False positives are a bit high. I assume they are trying to generate more findings. Sometimes alerts repeat for previously closed incidents. Review collected by and hosted on G2.com.

Its runtime protection supports ecs and eks fargate now Review collected by and hosted on G2.com.

Anomaly Detection has so many false positives Review collected by and hosted on G2.com.

For me Orça is a completed CNAP solucionar, The Best one of The Market. The agentless feature is the best one I like.

I like too the compliance module, the attack path and data security. Review collected by and hosted on G2.com.

I think that API sec could be improved and focus on more features on that. Review collected by and hosted on G2.com.

Easy Onboarding, I don't need consider the agent implementation plan, or any rollback plan if any bad thing happens. Review collected by and hosted on G2.com.

lack of sandbox, or real-time protection Review collected by and hosted on G2.com.

I really appreciate that Orca brings together multiple aspects of cloud security in a single console. It covers everything we need, from vulnerability management to misconfigurations, compliance, entitlement management, IaC, and code security, all in one place. The integration options are also strong - especially the bi-directional integration with ServiceNow, which has been a huge help for us. Slack integration is another plus, making it easy for our team to discuss alerts across departments and coordinate remediation efforts without missing a beat.

One feature we’ve found especially valuable is Orca’s compliance management. The AWS CIS Benchmark tool has been a game changer for us. With Orca’s guidance and insights, we were able to identify compliance gaps we hadn’t even noticed and systematically address them. This took our compliance score from 58% all the way up to 100%. Now we’re not just meeting industry standards but have much more confidence in the security and compliance of our AWS setup. Review collected by and hosted on G2.com.

I wish Orca offered an endpoint agent for managing vulnerabilities on non-cloud devices. If this capability were added, we’d likely consider consolidating our vulnerability management into Orca, which would be more convenient than juggling multiple platforms. Currently, we’re running two overlapping solutions to cover vulnerabilities on our endpoints, which adds complexity.

Also, we found it necessary to adjust the default permissions assigned to the role used by Orca, as the out-of-the-box required permissions were too broad and didn’t align with our organization’s principle of least privilege. By tailoring the permissions more specifically to our needs, we were able to enhance security by limiting access only to what was essential for Orca’s operations in our environment. Review collected by and hosted on G2.com.

Very easy to configure and get start with.

Excellent support for the 3 main Cloud providers.

They invested a lot in their product and it is incredibly more extensive than it was a couple years ago.

The pricing is relatively reasonable for smaller organizations.

Excellent Customer Success and Executive Teams.

The flexibility of its API, Sonar Queries and automations.

The full revamp of the Discovery feature has been impressive.

So many new perks have been keep coming up as part of the Premium plan: Shifleft, DSPM, API security, ThreatOptix.

The support is incredibly quick even during weekend. I've in all honesty never experienced a vendor as prompt as Orca to support their customers. Review collected by and hosted on G2.com.

I'm still waiting for a dark mode since the UI change.

Automations don't use Sonar querying language yet.

Could be interesting to have a Terraform module to manage configurations.

The new pricing model is a bit confusing. Review collected by and hosted on G2.com.

It still has the best technology in the cloud security space. I've compared it to Wiz, side-by-side just recently, and still find Orca to have the

- Highest quality findings

- Most accurate prioritization

- Best integration with related systems

- Easiest—much, much easier—UI and best UX

- Implemenation ease, and

- Best customer support.

I and my team use Orca daily, multiple times a day. It's a foundational security product for us. After testing out Wiz for a month, side by side, I appreciate Orca even more. Review collected by and hosted on G2.com.

I would love to see Orca expand into the area of more automated remediation. Review collected by and hosted on G2.com.

I love how Orca brings everything together in one place, making it an excellent tool for someone specializing in vulnerability management. Its ease of use and ease of implementation streamline our work, and the number of features it offers is impressive. Orca has significantly helped us reduce vulnerabilities and address each item effectively. Although Orca sometimes flags any visible item as vulnerable, it’s still one of the best tools I've enountered so far.

The customer support is exceptional; I can get a support representative on a call within five minutes, which only enhances my desire to use it. Their support team has also been incredibly helpful with integrations, which has made the tool even easier to integrate and use frequently. This outstanding support and ease of integration contribute to our high frequency of use, making Orca an invaluable asset in our security toolkit. Review collected by and hosted on G2.com.

There are several minor issues in Orca that have accumulated into larger challenges. For example, the same vulnerability path is sometimes duplicated across multiple Orca alert IDs, which leads to confusion. Additionally, when a scan is performed on a server, it doesn't display the exact time the scan was completed, nor does it provide backend visibility into scan failures, making it difficult to troubleshoot assets effectively.

We've submitted multiple feature requests, including support for asset scanning on devices like Fortinet and Ivanti, which our organization heavily relies on but aren’t currently detected by Orca. Furthermore, we occasionally encounter issues with hardening scan reports for specific assets, and pulling an inventory report is challenging due to the vast number of assets—over 3 to 4 million. While it's understandable given the scale, it’s still a limitation. Another significant issue is the inability to fetch more than 10,000 alerts through the API when retrieving data for a particular CVE.

Despite these drawbacks, I appreciate Orca’s efforts to adapt to our needs and continuously improve the tool. Review collected by and hosted on G2.com.