There was a recurring problem with shadow data: production data getting copied into staging and dev accounts that were nowhere near as locked down, plus data stores nobody even remembered creating. Orca discovers sensitive data across managed, unmanaged, and shadow stores, including files on VMs, containers, and buckets, and then classifies it against categories like PII and payment data. Seeing a forgotten production snapshot sitting in a loosely controlled dev account, and having that tied to how exposed the account was, makes it obvious which copies are genuinely risky versus intentional. Review collected by and hosted on G2.com.

A bit of tuning was needed to distinguish sanctioned data copies from the risky ones, since some of the lower-environment data was there on purpose. That said, the configuration was quick to align with our internal workflows. Review collected by and hosted on G2.com.

A lot of attention goes to containers these days, but there are still plenty of VMs and long-lived hosts, and those were exactly where our old scanning was the patchiest. Orca covers them in the same model as everything else, showing which host vulnerabilities sit on internet-facing machines, which are tied to privileged identities, and which are genuinely reachable versus buried behind existing controls. That added context lets us prioritize host patching based on real exposure instead of relying on raw CVSS scores. Review collected by and hosted on G2.com.

A couple of the older hosts had the usual configurations that warranted a closer look, but the underlying findings were sound, and the added context made them straightforward to interpret. Review collected by and hosted on G2.com.

Our business moves fast. Developers, analysts, and PMs are constantly shipping, and AI agents are woven into many of those workflows. We needed visibility that could keep up with that pace—not a slow rollout that would still be incomplete by the time the next agent went live.

Orcca connected to our cloud account, and within days it gave us a real risk picture, including the AI agents: the identities they run as, the endpoints they expose, and the data they could touch. We didn’t have to chase teams to get a clear understanding of our agent services. Review collected by and hosted on G2.com.

The main follow-on work was organizing the findings to match how our teams and business units are structured, including grouping agents by owner and function. That organizational step has made ongoing reviews much clearer for leadership. Review collected by and hosted on G2.com.

The thing that really changed how we work is the attack path view. Instead of a list of separate findings, Orca shows the full chain: an exposed asset, the vulnerability on it, the identity it can assume, and the sensitive data at the end of that path. Seeing the entire route makes it obvious which single fix can break the whole chain, so we stopped trying to patch everything and started cutting the links that actually matter. Review collected by and hosted on G2.com.

In a large environment, the attack path graphs can hold a lot of detail, so we found it most effective to scope to the crown jewel assets first. Once we did that, the overall picture became clear and genuinely useful. Review collected by and hosted on G2.com.

Orca flagged malicious files and suspicious workflows across our workloads that none of our other tooling had caught, including scenarios where an abused AI agent could have been used to plant or trigger malware. It goes beyond simple hash matching, picking up things like cryptominers and web shells that agents might deploy or invoke as part of a compromised toolchain. Because scanning happens off the workload at the storage and configuration layer, there’s nothing for the malware to hide from on the box itself, and it also covers hosts and agent-linked paths we never would have pointed a dedicated scanner at. Review collected by and hosted on G2.com.

We aligned the Orca agent-aware malware and threat findings with our existing endpoint response processes, which helped us fold that context smoothly into the way the team already operates. Review collected by and hosted on G2.com.

We had a vague sense that credentials and secrets were scattered across our environment, but we didn’t have a clear map of which ones agents could actually see. Orca surfaced hardcoded API keys, SSH private keys, and database credentials in places agents or their tools might read—config files, storage buckets, and logs. It doesn’t just pattern-match; it uses entropy and the surrounding context to decide whether a string is truly a secret, which keeps the noise down. Seeing each secret in the context of agent reachability made it clear which exposures could be triggered by agents and needed immediate cleanup. Review collected by and hosted on G2.com.

We spent some time defining suppression rules for the test credentials in our sandboxes, so that agent-relevant secrets stayed front and center in the findings. Review collected by and hosted on G2.com.

Having Orca scan our infrastructure as code and our pipelines has been a genuine shift-left win for the AI agents. We started catching templates and configuration snippets that would have granted agents broad, long-lived permissions or exposed new agent endpoints before any of those changes ever deployed. Because Orca ties these IaC findings back to the same risk model it uses for the running environment, we can clearly see that a misconfiguration flagged in code is the same kind of agent exposure we’d otherwise be chasing down in production later. Review collected by and hosted on G2.com.

We worked closely with our platform team to integrate agent-focused checks cleanly into our build steps, and to decide which misconfigurations should trigger a warning versus block a deployment. Review collected by and hosted on G2.com.

Orca gave us a much clearer picture of where sensitive data actually lives in relation to our AI agents. It surfaced PII in storage, secrets in places agents might read, and old database snapshots sitting in accounts that newly created agents were able to reach. The real value is the context: each finding shows what the data is, whether it’s exposed, and which agents and identities can access it. That turned what could have been an overwhelming inventory into a clear, prioritized list of data our agents should never be able to touch, along with the paths we needed to close. Review collected by and hosted on G2.com.

We spent a bit of time upfront tuning the data classification and agent reachability settings to align with our own definitions of sensitive information, as well as the agent access paths we consider unacceptable. Review collected by and hosted on G2.com.

Our finance and enterprise risk teams wanted to understand AI agent risk in business terms, not just issue counts or an abstract idea of "agent exposure." Orca’s context—what data an agent can touch, whether it can reach internet-facing services, and which identities and systems sit behind its paths—lets us group agent-driven risks around business-critical assets and regulated workflows. It’s not a full quantitative risk engine, but it has given us a structured way to discuss which agent behaviors matter most to revenue, compliance, and our contractual obligations. Review collected by and hosted on G2.com.

We still add some business mapping on our side for certain agent-centric technical risks, so they line up neatly with the revenue streams and the contractual exposure. Review collected by and hosted on G2.com.

Our product team constantly runs experiments, turning features on and off with flags that are increasingly evaluated or executed by AI agents. Orca doesn’t try to live in the feature-flag layer; instead, it watches the underlying cloud identity and the agent posture. When an experiment gives an agent broader access than intended, or opens up a test path to sensitive data, Orca picks it up on its next assessment of the cloud and agent surface and flags it. Developers don’t have to change how they ship experiments, but security can still see where agent-driven flags might create unexpected exposure. Review collected by and hosted on G2.com.

Explaining to some product folks why the temporary agent-powered experiments still need proper access controls took a few rounds of education, even with the Orcas findings on hand. Review collected by and hosted on G2.com.