Least privilege is always the goal, but in a world where the marketer writes the Python and the analyst ships the agents, it was hard to know where to start. Orca shows the effective permissions and the actual usage across agents and identities tied to the systems our team builds, so the effort can go first to the agents and roles with the largest blast radius around the assets that drive the business. That makes the CISO’s least-privilege goal something the team can realistically chip away at each sprint—for agents and humans—instead of leaving it as a theoretical aspiration.

We’re used to talking about shadow infrastructure, but now the real story is shadow AI. Almost anyone in the company can spin up an AI agent that talks to real systems, calls APIs, and acts on behalf of users. Many of those agents were created without a formal process and quietly became part of our attack surface. Orca discovers AI agents wherever they appear across our cloud estate, shows which identities they run as, which systems they can reach, and what data sits behind those paths. Shadow AI agents go from invisible to mapped in a way we can actually govern.

I like the fact that it has an agentless way of providing full cloud visibility without requiring much effort or adding extra work to day-to-day operations.