Lacework, Orca Security, Sysdig and Wiz

About Orca Security

The Orca Cloud Security Platform discovers risks across code, cloud, runtime, and AI. The platform unifies cloud posture, identity permissions, workload security, sensitive data at risk, and runtime threats into one connected view. Orca applies a risk score to each alert, considering severity, accessibility, exploitability, and business impact. Orca evaluates and prioritizes the paths to crown jewels, combining misconfigurations, identity risks, lateral movement and more.^[4]

Orca Security offers a product area for knowing cloud exposure and proving to the board that risk is under control. Orca Security offers a product area for governing every AI system in the cloud. Orca finds every AI model, package, and agent running across a cloud, including shadow AI. AI AppGen Security is posture management for applications built on AI app generator platforms like Replit, Lovable, Vercel, and Bolt. AI AppGen Security continuously discovers apps built on those platforms, identifies the misconfigurations they ship with by default, and connects each finding to the surrounding cloud environment. AI AppGen Security is a capability within Orca's existing AI Security, not a standalone tool. Orca AI includes Core Agents, a natural-language AI Assistant, and an MCP Server, all grounded in Orca's Unified Data Model.^{[4][8][10][11]}

Orca scans code, dependencies, IaC, images, and secrets agentlessly and prioritizes each finding by what is reachable and exposed in the running cloud. Orca scores every code vulnerability against live cloud context: reachability, internet exposure, identity permissions, and proximity to sensitive data. Orca generates SBOMs and flags vulnerable and license-risky open-source packages before they ship. Orca pushes findings and context straight into the IDE, repos, and ticketing tools that developers use. For high-impact issues, Orca drafts AI-generated fixes and opens pull requests. Orca's AppSec Triage Agent uses code context to automatically deprioritize false positives and escalate true positives.^[12]

Orca Security offers a product area for hardening every cloud workload without slowing pipelines down. SideScanning™ technology covers VMs, containers, and serverless, and cloud infrastructure resources such as storage buckets, VPCs, and KMS keys. Orca Security offers a product area for catching cloud and AI attacks as they unfold and containing the blast radius. Orca Sensor provides runtime visibility and protection that extends the capabilities of the Orca Cloud Security Platform. Orca Sensor monitors runtime activity across public cloud, private cloud, and on-premises environments. Orca Sensor secures workloads across Linux, Kubernetes, and Windows environments, including servers and workstations. Orca Sensor uses eBPF-based technology to deliver runtime visibility and protection. Orca Sensor includes a library of runtime detections that alert on active threats and can be configured to terminate processes. Orca Sensor identifies whether a vulnerable package is actually being executed. Orca monitors AI workloads at runtime, detecting model exfiltration attempts, prompt injection patterns, unusual inference traffic, and configuration drift.^[1][4][8]

Orca offers API Security to identify, prioritize, and address API misconfigurations and security risks across a cloud estate, without agents or network changes. Orca provides security teams with a full inventory of APIs and related web domains in their cloud estate, and API-related security and compliance risks, without agents. Orca continuously monitors API behavior and usage and alerts teams to potentially unwanted API drift. Orca scans a cloud estate and surfaces potentially hazardous API security risks, providing actionable data and remediation suggestions. Orca provides linked alerts for adhering to compliance frameworks like PCI-DSS.^[12][14]

Orca states that, since Orca is agentless-first, scanning can start as soon as cloud provider accounts are connected, without the need to install agents. Orca offers three deployment options: a SaaS platform, hosting in the customer's own boundary, and running from government cloud such as FedRAMP. Orca connects to Slack for alerting, Jira for ticketing, and SIEM platforms for streaming data.^[8]

Orca Security is FedRAMP® Moderate and GovRAMP® authorized and TX-RAMP certified. The Orca Platform is FedRAMP Moderate and StateRAMP authorized and holds SOC 2 TYPE II, ISO/EC 27001, ISO/EC 27017, and ISO/EC 27018 certifications. Orca supports 150+ compliance frameworks and CIS benchmarks, including NIST SP 800-53, NIST CSF, DISA STIG, and ISO 27001. Access to the Orca Platform can be procured from partners including Carahsoft, SAIC, GuidePoint Security, Lumen technologies, Braxton Grant technologies, and Optiv+Clearshark. Orca Security is available on the GSA Multiple Schedule through its partner Guidepoint Federal. Orca has full-time dedicated technical support staff based in the US. Orca Security's customers range from Fortune 500 enterprises to cloud-native disruptors. Orca Security supports customers in the Americas, Asia Pacific, and Europe. Orca Security brought its platform to market in 2019. Orca Security has raised nearly $630 million in combined funds at a $1.8 billion valuation. Orca Security's investors include Capital G, ICONIQ, GGV, and SVCI.^{[2][3][4][8][15][16]}

About Sysdig

Sysdig delivers real-time defense for cloud, containers, and AI agents. Sysdig captures live system calls at the kernel level, which shows what is actually running in the cloud.^[3]

Sysdig offers an agentless approach that provides visibility into cloud security posture, covering vulnerabilities, misconfigurations, in-use permissions, and threats. Sysdig delivers real-time threat detection across workloads, identities, cloud services, and third-party apps by combining drift control, machine learning, and Falco rules curated by the Sysdig Threat Research Team. Cloud Attack Graph correlates assets, activity, and risks across domains to uncover hidden attack paths and accelerate incident detection and response. Sysdig combines runtime insights, such as in-use vulnerabilities and in-use permissions, with static assessments, including misconfigurations and known security flaws, to generate a prioritized list of the riskiest findings.^[1][5][6]

Sysdig uses a graph model that continuously ingests and correlates data from cloud APIs, configurations, identity permissions, and runtime insights. Sysdig maintains an inventory of cloud resources, enriched with compliance violations, vulnerabilities, and IAM misconfigurations. For workloads, Sysdig detects workload and container threats in real time with out-of-the-box detection rules, powered by Falco and curated by the Threat Research Team. For vulnerabilities, Sysdig prioritizes vulnerabilities tied to in-use packages, enriched with context like exploitability, exposure, and asset criticality. CVE360 offers a complete picture of each vulnerability, including its source, affected resources, and how to fix it. Sysdig identifies high-impact fixes at the source, such as a patch to a base image that resolves dozens of downstream vulnerabilities. Sysdig Sage provides AI-powered remediation guidance with step-by-step instructions in natural language.^[6][7][8]

Sysdig delivers real-time detection across Linux and Windows servers, containers and Kubernetes, cloud logs and trails, and Serverless (FaaS). Sysdig correlates identity activity patterns with workload exploits to detect compromised identities and stop attacks at the first sign of privilege escalation and account compromise. Sysdig server threat detection starts with a lightweight agent, fueled by the Falco detection engine. The Sysdig agent streams kernel-level events, cloud service logs, and Kubernetes metadata in real time. For infrastructure as code, Sysdig automatically scans infrastructure code during development to detect misconfigurations, policy violations, and vulnerabilities in Terraform, CloudFormation, Kubernetes manifests, and other IaC templates before they reach production. Sysdig enforces security standards directly in the development workflow using OPA-based policies.^[9][10][11]

The Sysdig GenAI Assistant, formerly Sysdig Sage, is powered by an autonomous agents architecture and employs multi-step reasoning and contextual awareness. The Sysdig GenAI Assistant can respond to user queries on cloud detection and response, posture management, and vulnerability management. The Sysdig GenAI Assistant is available as a conversational assistant and embedded directly into the UI. Secure AI extends the Sysdig Secure platform with an expert AI security team. Secure AI can run inside the agents a team already uses, take on the work, or answer questions along the way. Sysdig connects its platform to the AI agents a team already uses through curated agent skills and an MCP server. Sysdig Secure lets users define desired outcomes while autonomous agents handle the work.^[3][12]

Sysdig Monitor provides visibility into Kubernetes clusters, namespaces, workloads, pods, and containers, regardless of cloud platform. Sysdig Monitor collects metrics about an environment, then correlates and enriches those metrics. Sysdig grew out of open source and supports open standards. The Sysdig Threat Research Team monitors emerging attacker behaviors and cloud-native threats and turns real-world insights into actionable detections. Sysdig's Threat Research Team has spent years uncovering novel cloud attacks, from JADEPUFFER to SCARLETEEL.^{[1][3][13][14]}

Sysdig describes a product for defending Kubernetes, containers, and hosts in on-premises, air-gapped, and private cloud environments. Sysdig cloud detection and response is designed to provide advanced capabilities across multi-cloud, hybrid, and on-premises infrastructures. The security and engineering teams at BigCommerce use Sysdig to identify and eliminate misconfigurations and streamline compliance. Neo4j needed a cloud security platform that provided unified coverage across its cloud environment. Apree Health uses Sysdig for security and incident response and for visibility into its Kubernetes deployment.^{[3][5][6][7][8][10][11]}

About Wiz

Wiz sells a cloud and AI security platform that connects code, cloud, and runtime into a single security graph. Wiz says the graph provides the end-to-end context required to automate risk reduction and threat response. Wiz says traditional tools provide siloed views, leaving critical AI risks unseen.^[3][11][15]

Wiz AI-APP is described as the platform to secure AI applications from code to runtime. The Wiz AI-Application Protection Platform provides end-to-end visibility and protection for cloud and AI systems across development, infrastructure, data, and runtime. Wiz AI-APP provides visibility and protection across infrastructure, models, data, and applications.^[3]

The Wiz Security Graph analyzes the relationships between technologies running in a cloud environment. Wiz connects in minutes via API and achieves full coverage across cloud and AI resources across PaaS, virtual machines, containers, serverless functions, agents, models, repositories, and pipelines. Wiz Cloud correlates risk on the Wiz Security Graph, validates real exposure, and drives prioritized remediation. Wiz Cloud connects within minutes using API connectors to scan and take inventory of a cloud and AI environment. Wiz Cloud is aimed at eliminating critical risk across cloud, AI, SaaS, and on-prem.^[3][12]

Runtime protection from the Wiz Sensor stops threats and provides deep, real-time threat detection with context for better prioritization. Wiz Sensor runtime protection is combined with agentless coverage. Wiz uses the Wiz eBPF Runtime Sensor, combined with analysis of cloud and SaaS logs and application and code context. Wiz describes runtime protection that can stop AI-native threats including prompt injection, rogue agents, and malicious AI behavior at runtime. Wiz says it can continuously discover AI models, agents, MCP servers, and services across cloud and SaaS.^[3][11][13]

Wiz Code connects code, cloud, runtime, and adversarial validation to identify exploitable attack paths. Wiz Code finds complex business logic flaws and syntax based errors in first party code. Wiz Code finds and fixes hardcoded secrets in code, IaC templates, and container images. Wiz Code detects and eliminates malware in a codebase before it reaches CI runners and cloud environments. Wiz Code scans IaC for misconfigurations and validates against 1,000+ rules for Terraform, CloudFormation, Azure Resource Manager, Kubernetes, Docker, and more. Wiz Code aggregates and correlates findings from built-in and third-party scanners, SAST, SCA, DAST, and more. Wiz meets developers in the pull requests, IDEs, and pipelines they already use.^[15][16][25]

Wiz offers Mika, which brings the intelligence of the Wiz Graph and specialized agents into daily tools. The Wiz MCP Server lets teams plug the Security Graph directly into custom agents, internal knowledge bases, and developer IDEs. Wiz describes one agent that continuously simulates real attack paths across a cloud and AI stack. Wiz describes another agent that autonomously investigates alerts across cloud and code. Wiz lets teams direct Mika and specialized agents with a visual, no-code canvas. Wiz correlates running cloud resources back to the code, pipeline, and developer that created and built it. Wiz can generate a 1-click fix in code with a pull request in a version control system. Wiz Integration (WIN) platform enables bi-directional sharing of security findings across the cloud security ecosystem.^{[3][11][25][26]}

Wiz automatically assesses compliance posture against more than 100 industry compliance frameworks or custom frameworks. Wiz analyzes cloud entitlements and auto-generates least privilege policies across a cloud. Wiz offers SBOM capabilities that give agentless visibility into packages, open-source libraries, and their versions.^{[12][28][30][31]}

Wiz states that its compliance coverage names AWS, Azure, GCP, OCI, Alibaba Cloud, VMware vSphere, Kubernetes, and Red Hat Openshift. Wiz reports ISO 27001, ISO 27017, ISO 27018, and ISO 27701 recertification. Wiz has SOC 2 Type II plus HIPAA and SOC 3 reports. Wiz published a PCI DSS v4.0.1 Attestation of Compliance.^{[3][11][13][15][16][17][18][25][27][28][29][32]}