Before Orca, every pentest seemed to tread the same ground: familiar misconfigurations, identity issues the team already knew about, and a focus on traditional workloads instead of the AI agents doing the real work on our behalf. With Orca in place, we used this context to clean up the most exploitable paths involving the agents ahead of the test—from over-permitted agent identities to exposed endpoints and risky tool stacks. Review collected by and hosted on G2.com.

The first cleanup cycle before the pentest required some focused effort, especially around agents whose access had expanded over time, but it ultimately gave us a much cleaner baseline going into the exercise. Review collected by and hosted on G2.com.

We are constantly creating with AI agents, and compliance used to feel completely disconnected from that reality. Teams ship agents to production, analysts wire agents into workflows, PMs push agent-backed features, and then audit season arrives with the spreadsheet. Orca continuously maps our cloud workload and agent posture to the frameworks we care about, tied directly to the resources and agents that power what we build. Review collected by and hosted on G2.com.

We fine-tuned how Orca’s controls map to the way our auditors phrase agent and AI governance requirements, which helped align its evidence directly with our own review style. Review collected by and hosted on G2.com.

Orca has changed how we approach security discussions at the leadership level. Rather than spending time wading through endless findings and reports, we can focus on understanding the risks that truly matter. The platform gives us the visibility and context we need to support business initiatives while still maintaining strong security standards. It’s helped shift security from being viewed as a blocker to being a partner that enables growth. Review collected by and hosted on G2.com.

Overall, the reporting capabilities are solid, but I’d like to see more streamlined executive dashboards that make it easier to deliver clear, board-level updates. Review collected by and hosted on G2.com.

What I appreciate most is how quickly we gained clear visibility into our cloud environment. The agentless approach eliminated many of the usual deployment concerns, and the platform started surfacing meaningful findings right away. The risk prioritization feels practical and makes it easier to distinguish truly critical issues from lower-priority items. Having security, compliance, and vulnerability information consolidated in one place is also a major advantage. Review collected by and hosted on G2.com.

The interface is generally easy to use, although some of the more advanced features take a bit of extra exploration to figure out. I’d also appreciate more customization options for reporting, as that would make it easier to tailor reports to my needs. Review collected by and hosted on G2.com.

As our agents reason over regulated data—customer records and financial datasets—we needed confidence that they weren’t crossing residency or compliance boundaries. Orca shows where each agent runs, which data stores it can reach, and how those access paths align with our regulatory and policy constraints. That level of visibility lets us quickly spot an agent that could read out-of-region data or touch a store that should be locked down to specific roles. Review collected by and hosted on G2.com.

We updated a few of our compliance dashboards to incorporate Orcas agent views, which has made our conversations with risk and legal far more concrete. Review collected by and hosted on G2.com.

Orca gives us a clear view of vulnerabilities, misconfigurations, and security risks across our cloud environment. Because it’s agentless, the setup was straightforward, and we were able to get it implemented and start monitoring resources quickly. I also appreciate the risk prioritization, which helps us focus on the most important findings rather than spending time chasing low-impact issues. Review collected by and hosted on G2.com.

The platform offers a wide range of capabilities, which can feel a bit overwhelming at first. A clearer starting point or guidance would help with the initial learning curve. Also, some reports could be more customizable to better match specific business requirements. Review collected by and hosted on G2.com.

The agentless approach has been one of the biggest advantages for us. We were able to connect our cloud accounts quickly and start monitoring workloads right away, without having to deploy any additional software. The platform provides clear, centralized visibility into vulnerabilities, exposed secrets, and configuration issues all in one place. Its risk-based prioritization also helps cut down on unnecessary noise and keeps us focused on what matters most. Review collected by and hosted on G2.com.

Some of the more advanced reporting features could be easier to customize. Overall, the interface is solid, but there are a few sections that take a bit of time to fully understand and get comfortable with. Review collected by and hosted on G2.com.

More people across the organization are now contributing to building and deploying solutions, and that shift has changed how we need to think about security. Orca gives us clear visibility into those activities without adding unnecessary friction. The platform helps us spot issues such as excessive permissions and risky configurations early, before they turn into bigger problems. Most importantly, teams can keep working at their normal pace without feeling slowed down or blocked by security processes. Review collected by and hosted on G2.com.

Helping less technical users understand the findings tied to their work took some extra internal guidance and support to make everything clear. Review collected by and hosted on G2.com.

We run data validation pipelines and corporate cloud hosting for our clients. Because we process millions of transactions, zero-latency cloud performance is non-negotiable. Orca’s agentless side-scanning is brilliant for this. Installing traditional security agents on heavily utilized databases creates unacceptable CPU overhead. Orca connects directly to our Azure and AWS environments via API, which fits our setup well. Review collected by and hosted on G2.com.

When we connected Orca to a client’s legacy cloud infrastructure during initial onboarding, the scan generated an overwhelming number of alerts because Orca scans everything, including orphaned staging servers and forgotten backup environments. The dashboard instantly filled with thousands of low-level misconfigurations, and it took weeks to manually filter through them. Review collected by and hosted on G2.com.

The CISO here is accountable for everyone who ships: the developer, the data scientist, the analyst deploying the agents, the PM, and even the marketer writing Python. Last month, an analyst spun up an agentic workflow with access to multiple internal systems, and nobody had told Security. Orca surfaced it, mapped what the agent could reach, and we were able to govern it before it became an exposure. Review collected by and hosted on G2.com.

With so much consolidated into one platform, we decided to rethink some internal team boundaries around who owns agents and their policies. More than anything else, that shift has improved clarity. Review collected by and hosted on G2.com.