Teams across the company started spinning up AI agents that could call APIs, trigger workflows, and act on behalf of users, and a few of those agents ended up with far more access than anyone realized. Orca surfaces those agents alongside everything else in our cloud estate, showing which identities they run as, which services they can reach, and what data sits behind those permissions. Seeing that blast radius in a single view made it straightforward to decide which agents were actually needed, where scopes should be tightened, and where guardrails should be added before they caused any trouble. Review collected by and hosted on G2.com.

We chose to spend some time assigning clear owners to each agent in the Orcas view, and that effort gave us much better governance and accountability. Review collected by and hosted on G2.com.

We looked at platforms that had clearly retrofitted or acquired their AI security story. With Orca, AI agents and AI services are built natively into the same unified data model that has powered the platform from day one, from code to the cloud runtime. Instead of a set of stitched-together tools, agents now show up directly in our workflows, our data pipelines, and the product our customers use, and Orca treats that entire agent footprint as a first-class part of the attack surface rather than an afterthought. Review collected by and hosted on G2.com.

The platform is deep enough that we were still discovering agent-focused capabilities months in, which is a good problem to have and something we’re addressing by continuing to explore more of what it can already do. Review collected by and hosted on G2.com.

When we acquire a new business or bring a new cloud environment into the fold, we’re not just inheriting infrastructure; we’re inheriting their agents, their workflows, and their data paths. Orca lets us connect the new accounts quickly and immediately see which AI agents exist there, what identities they use, and which systems and data stores they can reach. Instead of months of manual discovery, we get a clear picture of inherited AI agent risk within days. Review collected by and hosted on G2.com.

We chose to standardize some basic tagging and ownership conventions for newly onboarded agents, and that upfront work has already made cross-business-unit reviews much smoother. Review collected by and hosted on G2.com.

Inside our company, the population of spun-up AI agents has increased a lot. Marketing is writing agents into campaigns, analysts are shipping autonomous workflows, and the PM team is trying agents in new features. Almost everyone in the building can now launch an agent that talks to real systems, and that used to raise serious concerns for our security team. Orca gives us visibility and context across every one of those agents. We can catch over-permissioned agent access or a misconfigured role before a workflow runs away or an attacker would, and the builder almost never has to slow down. Review collected by and hosted on G2.com.

It helped our non-technical builders understand the agent findings as they related to their work. We did need a bit of internal education on our side, but once they saw the results in the context of what their agents were actually doing, it clicked. Review collected by and hosted on G2.com.

The CISO here was accountable for everyone who ships: the developer, the data scientist, the analyst deploying the agents, the PM, and the marketer writing the Python. Last month, an analyst spun up an agentic workflow with access to multiple internal systems, and nobody had told security. Orca surfaced it, mapped what the agent could reach, and we were able to govern it before it became an exposure. That’s what the unified data model actually means in practice: code, cloud, AI services, and now agents, all in one place. Review collected by and hosted on G2.com.

With so much consolidated into one platform, we decided to rethink some internal team boundaries around who owns the agents and their policies. That change improved clarity more than anything else. Review collected by and hosted on G2.com.

Inside our company, the number of people shipping to production has exploded. It’s no longer just engineers anymore—analysts are running automations, PMs are prototyping on Friday and pushing on Monday, and AI agents are now embedded in almost every workflow. Security used to find our issues only after something had already shipped. Orca gives us visibility into everything that has been built, including every AI agent, the identities they run as, and the data they can reach, without asking teams to change how they work. For the first time, security is keeping pace with how fast the business creates, especially across the agent layer. Review collected by and hosted on G2.com.

Because Orca showed us so much so quickly, the first few weeks required some tuning to separate the most urgent risks from the rest. That focused effort helped us quickly zero in on the AI agents and the paths that mattered most, and it has paid off with much clearer priorities. Review collected by and hosted on G2.com.

The data scientist on our team deployed an agent backed by a model endpoint connected directly to production data. Orca immediately flagged the exposed inference endpoint, mapped the agent’s access, and gave us the context we needed to lock it down. The agent and the model stayed live; the risk didn’t. For an AI-heavy org, having a platform that understands agents, their model endpoints, and the data they touch as part of the attack surface was exactly what we needed. Review collected by and hosted on G2.com.

As new managed AI agent services come to market, we keep connecting them to Orca so our visibility stays in step with how quickly our teams adopt those services. Review collected by and hosted on G2.com.

Our agents can chain actions across systems—invoking tools, writing to storage, and updating records—and that kind of power carries real risk if the workflows aren’t properly governed. Orcas context makes it clear that agents may touch sensitive data, change configurations, or even reach the public edge, so we can see exactly where strong guardrails and human-in-the-loop checks need to sit. Rather than discovering risky agent behavior only after something breaks, we’re able to put policy in place where it matters most. Review collected by and hosted on G2.com.

We invested a bit of effort in aligning Orcas agent views with our internal guardrail policy and naming conventions, which made it easier for teams to understand and act on the insights. Review collected by and hosted on G2.com.

From a day-to-day operational center perspective, Orca’s native webhook integrations and alerting pathways are exceptional. We’ve wired Orca directly into our central IT notification channels and DevOps environments, so the exact second a high-priority risk or cloud misconfiguration is detected, Orca pushes a highly detailed data payload straight to our engineers. Review collected by and hosted on G2.com.

Navigating and configuring deeply nested, role-based access permissions within the master Orca Management console can feel overly complex, especially when attempting to provision highly restricted, read-only dashboard access for a regional business lead. It’s difficult to set things up so they can track only their specific sub-department’s cloud security posture without getting pulled into layers of permissions that are hard to interpret and configure correctly. Review collected by and hosted on G2.com.

Orca's SideScanning technology delivers total visibility across our entire multi-cloud environment (AWS, Azure, GCP) within minutes. Because it’s completely agentless, there is zero operational friction—no software to install, no performance impact on live workloads, and absolutely zero blind spots. Review collected by and hosted on G2.com.

Limited Dashboard & Reporting Customization: The out-of-the-box dashboards can feel somewhat rigid and more technical than executive-friendly. Customizing metrics or building bespoke KPI reports for non-technical stakeholders is difficult, often forcing our team to export raw data via API to external BI tools or spreadsheets to get the specific views we need. Review collected by and hosted on G2.com.