We’re used to talking about shadow infrastructure, but now the real story is shadow AI. Almost anyone in the company can spin up an AI agent that talks to real systems, calls APIs, and acts on behalf of users. Many of those agents were created without a formal process and quietly became part of our attack surface. Orca discovers AI agents wherever they appear across our cloud estate, shows which identities they run as, which systems they can reach, and what data sits behind those paths. Shadow AI agents go from invisible to mapped in a way we can actually govern.

I like the fact that it has an agentless way of providing full cloud visibility without requiring much effort or adding extra work to day-to-day operations.

Before Orca, every pentest seemed to tread the same ground: familiar misconfigurations, identity issues the team already knew about, and a focus on traditional workloads instead of the AI agents doing the real work on our behalf. With Orca in place, we used this context to clean up the most exploitable paths involving the agents ahead of the test—from over-permitted agent identities to exposed endpoints and risky tool stacks.