A lot of attention goes to containers these days, but there are still plenty of VMs and long-lived hosts, and those were exactly where our old scanning was the patchiest. Orca covers them in the same model as everything else, showing which host vulnerabilities sit on internet-facing machines, which are tied to privileged identities, and which are genuinely reachable versus buried behind existing controls. That added context lets us prioritize host patching based on real exposure instead of relying on raw CVSS scores.

Our business moves fast. Developers, analysts, and PMs are constantly shipping, and AI agents are woven into many of those workflows. We needed visibility that could keep up with that pace—not a slow rollout that would still be incomplete by the time the next agent went live. Orcca connected to our cloud account, and within days it gave us a real risk picture, including the AI agents: the identities they run as, the endpoints they expose, and the data they could touch. We didn’t have to chase teams to get a clear understanding of our agent services.

The thing that really changed how we work is the attack path view. Instead of a list of separate findings, Orca shows the full chain: an exposed asset, the vulnerability on it, the identity it can assume, and the sensitive data at the end of that path. Seeing the entire route makes it obvious which single fix can break the whole chain, so we stopped trying to patch everything and started cutting the links that actually matter.