Before Orca, every pentest seemed to tread the same ground: familiar misconfigurations, identity issues the team already knew about, and a focus on traditional workloads instead of the AI agents doing the real work on our behalf. With Orca in place, we used this context to clean up the most exploitable paths involving the agents ahead of the test—from over-permitted agent identities to exposed endpoints and risky tool stacks.

As our agents reason over regulated data—customer records and financial datasets—we needed confidence that they weren’t crossing residency or compliance boundaries. Orca shows where each agent runs, which data stores it can reach, and how those access paths align with our regulatory and policy constraints. That level of visibility lets us quickly spot an agent that could read out-of-region data or touch a store that should be locked down to specific roles.

We used to split our view of risk: AppSec tools looked at the code, cloud tools looked at the infrastructure, and nobody owned the full picture for the agents that sit on top of both. In reality, the marketer was writing the Python, the analyst was shipping the agents, and those agents call the APIs, touch the containers, and invoke serverless functions across clouds. Orca ties the application, cloud, and agent context together in one unified model. When there’s an issue, we can see the agent, the vulnerable code it relies on, the service it runs on, and the data it touches—all in a single view.