No free plan. The cheapest way in is paid plan at Contact Sales. Consider free alternatives in the enterprise agents category if budget is tight.
Orca is granted a read-only role in your cloud account and uses cloud-provider APIs to take point-in-time snapshots of workload block storage and metadata. It analyzes these snapshots out-of-band in Orca's environment, extracting OS packages, installed software, vulnerabilities, malware, secrets, sensitive data, and configuration details — without installing agents, sending network traffic through proxies, or impacting workload performance.
Wiz is Orca's closest competitor and uses a similar agentless, graph-based CNAPP approach; the two differ primarily in data model, UX, and depth in specific modules like DSPM and AI-SPM. CrowdStrike is agent-first and stronger for runtime endpoint/EDR use cases. Snyk is developer-first and focused on code, open-source, and container image scanning rather than full cloud posture. Orca's sweet spot is unified, agentless coverage across the entire cloud estate with prioritized attack paths.
Yes. Orca's AI-SPM module inventories AI services and models across Amazon Bedrock, Azure OpenAI, Google Vertex AI, SageMaker, and self-hosted models, detects shadow AI usage, flags training-data and model-file exposures, and checks misconfigurations against emerging AI security frameworks.
Orca ships with continuous checks for CIS Benchmarks, PCI-DSS, HIPAA, HITRUST, SOC 2, NIST 800-53, NIST CSF, ISO 27001, GDPR, FedRAMP, and cloud-provider-specific frameworks (AWS Well-Architected, CIS AWS/Azure/GCP). Custom frameworks can be authored by combining built-in controls.
Most customers connect their first cloud account in under 30 minutes using a CloudFormation template, Terraform module, or native role. Initial scan results — including critical vulnerabilities and misconfigurations — typically appear within a few hours, with full asset inventory and attack-path analysis available within 24 hours.
See Orca Security plans and find the right tier for your needs.
See Pricing Plans →Still not sure? Read our full verdict →
Last verified March 2026