Understanding Orca Security

Orca SideScanning

SideScanning is how Orca sees inside cloud workloads without deploying agents. It reads each workload’s runtime block storage out of band and rebuilds the file system as a read-only view, which suits teams that cannot install or maintain software on every machine.

• Covers Linux and Windows VMs, containers and container images, serverless functions and storage buckets
• Collects metadata such as security groups, network configuration, IAM permissions and running assets

Orca Sensor

Where teams need to see what is actually running, the Sensor adds lightweight eBPF-based runtime visibility and protection.

• Alerts on active threats and can be set to terminate processes
• Shows which vulnerable packages are really executing, so patching effort goes where it counts
• Detects malware and in-memory exploits that only appear in production
• Flags risks to AI workloads, including attempted model exfiltration, prompt injection patterns and unusual inference traffic

Cloud Infrastructure Entitlement Management (CIEM)

CIEM helps cloud and identity teams get permissions under control. It monitors every identity, role, group, permission and policy in the environment and alerts when least privilege is broken.

• Just in time access for AWS, with time-bound, role-specific grants and an audit log
• IAM policy right-sizing based on 90 days of actual usage
• Detection of exposed, unmanaged or stolen access keys

Cloud Detection And Response

This module watches cloud provider logs and threat intelligence feeds around the clock and raises alerts when changes or anomalies point to malicious intent. It adds signature and heuristic malware detection for all workloads, automated workflows, suggested remediation steps for each alert, and ticket creation in Jira and ServiceNow.

Posture, Vulnerability And Compliance Modules

For broader hygiene, the platform includes CSPM, CWPP, container and Kubernetes security, vulnerability management, multi-cloud compliance, API security, application security, AI AppGen security and DSPM. Compliance query templates map to more than 185 frameworks and CIS benchmarks.

AI Security

AI security answers a common question for security teams: what AI is running in the cloud, and who deployed it. It builds an inventory of every model, pipeline, training dataset and AI package, in a reported 30 minutes, and finds unsanctioned shadow AI services and agents. It also tracks MCP server activity.

Orca AI Agents

Agents are grouped into pods. The Red Pod, with a Code Security Auditor and an Attack Surface agent, tests exposed assets and validates findings before reporting them. The Blue Pod, with an AppSec Triage Agent and a Threat Investigation Agent, investigates and triages alerts. The Green Pod handles the route to resolution, including ownership and fixes. Custom Agents let customers build their own on the same reasoning engine.

AI Assistant And Remediation

Orca AI offers chat and natural language search that draw on the full cloud context, writes code fixes and can open a pull request. Requests are anonymised and sensitive data is masked before processing.

MCP Server And AI Skills Hub

The Orca MCP server brings Orca’s reasoning into Claude, Codex, Cursor, VS Code and other MCP clients. The AI Skills Hub offers open source, prebuilt skills that teams can fork and adapt. There is also an Orca ChatGPT plugin and an integration with Claude’s Compliance API.