What stands out most to me is the agentless approach. We were able to get visibility across our cloud environment without having to ask teams to install agents or change the way they work. As development cycles have sped up, it’s become even more important for security to keep pace without introducing delays. Orca provides the insights we need while still letting teams deliver at their usual speed. Review collected by and hosted on G2.com.

During the initial rollout, the platform surfaced more risks than we expected. That level of visibility was helpful, but it also took us some time to sort through the findings, set clear priorities, and decide which items needed immediate action. Review collected by and hosted on G2.com.

Before Orca, every pentest seemed to tread the same ground: familiar misconfigurations, identity issues the team already knew about, and a focus on traditional workloads instead of the AI agents doing the real work on our behalf. With Orca in place, we used this context to clean up the most exploitable paths involving the agents ahead of the test—from over-permitted agent identities to exposed endpoints and risky tool stacks. Review collected by and hosted on G2.com.

The first cleanup cycle before the pentest required some focused effort, especially around agents whose access had expanded over time, but it ultimately gave us a much cleaner baseline going into the exercise. Review collected by and hosted on G2.com.

We are constantly creating with AI agents, and compliance used to feel completely disconnected from that reality. Teams ship agents to production, analysts wire agents into workflows, PMs push agent-backed features, and then audit season arrives with the spreadsheet. Orca continuously maps our cloud workload and agent posture to the frameworks we care about, tied directly to the resources and agents that power what we build. Review collected by and hosted on G2.com.

We fine-tuned how Orca’s controls map to the way our auditors phrase agent and AI governance requirements, which helped align its evidence directly with our own review style. Review collected by and hosted on G2.com.

Orca has changed how we approach security discussions at the leadership level. Rather than spending time wading through endless findings and reports, we can focus on understanding the risks that truly matter. The platform gives us the visibility and context we need to support business initiatives while still maintaining strong security standards. It’s helped shift security from being viewed as a blocker to being a partner that enables growth. Review collected by and hosted on G2.com.

Overall, the reporting capabilities are solid, but I’d like to see more streamlined executive dashboards that make it easier to deliver clear, board-level updates. Review collected by and hosted on G2.com.

What I appreciate most is how quickly we gained clear visibility into our cloud environment. The agentless approach eliminated many of the usual deployment concerns, and the platform started surfacing meaningful findings right away. The risk prioritization feels practical and makes it easier to distinguish truly critical issues from lower-priority items. Having security, compliance, and vulnerability information consolidated in one place is also a major advantage. Review collected by and hosted on G2.com.

The interface is generally easy to use, although some of the more advanced features take a bit of extra exploration to figure out. I’d also appreciate more customization options for reporting, as that would make it easier to tailor reports to my needs. Review collected by and hosted on G2.com.

As our agents reason over regulated data—customer records and financial datasets—we needed confidence that they weren’t crossing residency or compliance boundaries. Orca shows where each agent runs, which data stores it can reach, and how those access paths align with our regulatory and policy constraints. That level of visibility lets us quickly spot an agent that could read out-of-region data or touch a store that should be locked down to specific roles. Review collected by and hosted on G2.com.

We updated a few of our compliance dashboards to incorporate Orcas agent views, which has made our conversations with risk and legal far more concrete. Review collected by and hosted on G2.com.

Orca gives us a clear view of vulnerabilities, misconfigurations, and security risks across our cloud environment. Because it’s agentless, the setup was straightforward, and we were able to get it implemented and start monitoring resources quickly. I also appreciate the risk prioritization, which helps us focus on the most important findings rather than spending time chasing low-impact issues. Review collected by and hosted on G2.com.

The platform offers a wide range of capabilities, which can feel a bit overwhelming at first. A clearer starting point or guidance would help with the initial learning curve. Also, some reports could be more customizable to better match specific business requirements. Review collected by and hosted on G2.com.

The agentless approach has been one of the biggest advantages for us. We were able to connect our cloud accounts quickly and start monitoring workloads right away, without having to deploy any additional software. The platform provides clear, centralized visibility into vulnerabilities, exposed secrets, and configuration issues all in one place. Its risk-based prioritization also helps cut down on unnecessary noise and keeps us focused on what matters most. Review collected by and hosted on G2.com.

Some of the more advanced reporting features could be easier to customize. Overall, the interface is solid, but there are a few sections that take a bit of time to fully understand and get comfortable with. Review collected by and hosted on G2.com.

More people across the organization are now contributing to building and deploying solutions, and that shift has changed how we need to think about security. Orca gives us clear visibility into those activities without adding unnecessary friction. The platform helps us spot issues such as excessive permissions and risky configurations early, before they turn into bigger problems. Most importantly, teams can keep working at their normal pace without feeling slowed down or blocked by security processes. Review collected by and hosted on G2.com.

Helping less technical users understand the findings tied to their work took some extra internal guidance and support to make everything clear. Review collected by and hosted on G2.com.

We run data validation pipelines and corporate cloud hosting for our clients. Because we process millions of transactions, zero-latency cloud performance is non-negotiable. Orca’s agentless side-scanning is brilliant for this. Installing traditional security agents on heavily utilized databases creates unacceptable CPU overhead. Orca connects directly to our Azure and AWS environments via API, which fits our setup well. Review collected by and hosted on G2.com.

When we connected Orca to a client’s legacy cloud infrastructure during initial onboarding, the scan generated an overwhelming number of alerts because Orca scans everything, including orphaned staging servers and forgotten backup environments. The dashboard instantly filled with thousands of low-level misconfigurations, and it took weeks to manually filter through them. Review collected by and hosted on G2.com.