Orca Security

Scanning without agents

Orca scans cloud environments without installing software on workloads. Its SideScanning technique reads configuration data from cloud provider APIs and examines workload storage out of band, which lets it report vulnerabilities, misconfigurations, malware, exposed secrets and sensitive data across an account soon after it is connected.¹ The company describes itself as the pioneer of agentless cloud security and offers scanning in SaaS, in-account or bring-your-own-cloud modes.²

Marketplace tiers by workload count

Orca's own site routes buyers to a demo, but its AWS Marketplace listing publishes four monthly tiers based on how many EC2 workloads run at the same time: $7,000 a month for up to 100, $12,000 for up to 300, $17,000 for up to 500 and $30,000 for up to 1,000.⁸ A full year at the smallest tier comes to $84,000. The listing counts each running EC2 instance as one workload, and larger environments are priced through private offers.⁸

Fast growth, then a reset

Avi Shua and Gil Geron, both former Check Point executives, founded Orca in 2019; TechCrunch covered its $6.5 million seed round, led by YL Ventures, in June 2019.³ In October 2021 a Series C extension led by Temasek brought that round to $550 million and the valuation to $1.8 billion, and Reuters reported business had grown roughly nine-fold year on year.⁴ Orca says it has raised nearly $630 million in total.⁵

Globes reported that Gil Geron replaced Avi Shua as CEO in 2023, that Orca filed a patent suit against rival Wiz in July 2023, and that the company cut 15% of its roughly 430 employees in January 2024.⁶ Shua remains with the company as chief innovation officer.⁵ By June 2025 Orca said it had doubled its customer count and grown revenue 60% over the prior year,² and it acquired Opus in 2025 to add automated remediation.⁷ Customers shown on its website include SAP, Autodesk, Unity and Lemonade.²

Agentless scanning and runtime sensors

Orca's main rivals are the large cloud-native application protection platforms. Orca is known for agentless scanning that is quick to deploy, and Upwind argues that runtime sensors inside the environment produce more relevant alerts. Some teams buy both kinds of tool.

Smaller footprints and runtime-first needs

Teams running mostly on a single cloud with modest needs may find the native security tools from their provider sufficient. Organizations whose top concern is detecting active attacks inside running containers will want a product with strong runtime detection.