Our product team constantly runs experiments, turning features on and off with flags that are increasingly evaluated or executed by AI agents. Orca doesn’t try to live in the feature-flag layer; instead, it watches the underlying cloud identity and the agent posture. When an experiment gives an agent broader access than intended, or opens up a test path to sensitive data, Orca picks it up on its next assessment of the cloud and agent surface and flags it. Developers don’t have to change how they ship experiments, but security can still see where agent-driven flags might create unexpected exposure.

Our CISO used to get disparate stories about the AI agents: AppSec had one view, cloud security had another, and no one owned a single picture of how agent identities and the data all fit together. Orca’s top-level posture view now gives leadership one pane where every AI agent shows up alongside traditional services, with clear exposure, effective permissions, and blast radius. When the CISO walks into a meeting, they can see which agents carry meaningful risk, what data is at stake, and how that ties back to what the business is building next.

When we acquire a new business or bring a new cloud environment into the fold, we’re not just inheriting infrastructure; we’re inheriting their agents, their workflows, and their data paths. Orca lets us connect the new accounts quickly and immediately see which AI agents exist there, what identities they use, and which systems and data stores they can reach. Instead of months of manual discovery, we get a clear picture of inherited AI agent risk within days.