Orca Security: who they are, what they sell and what CISOs should ask

What Orca Security sells

Orca Security sells a cloud security platform, delivered as a software service, to organisations that run workloads in public clouds. The company was founded in 2019 by a group of former Check Point employees, including Avi Shua and Gil Geron, CTech reported. Its press releases carry a Portland, Oregon dateline (company release). It is venture-backed. Its about page states it raised "nearly $630 million in combined funds at a $1.8 billion valuation" (about page), and a July 2026 release named Temasek, CapitalG, ICONIQ Capital and Redpoint Ventures among its investors (company release).

The platform page groups the product into five areas: reducing cloud risk, securing AI, code security, workload protection, and detection and response (platform page). Several named components sit underneath. SideScanning does the agentless scanning. The Orca Sensor provides what the page calls "Runtime observability & protection". There is also an AI layer, Orca AI. A Unified Data Model correlates findings, and risk prioritisation adds attack path analysis (platform page).

The company says SideScanning collects data from a workload's runtime block storage without agents and rebuilds its file system in a read-only view for analysis (SideScanning page). Its posture product lists 2,500+ configuration controls. It also checks configurations against more than 150 industry and regulatory frameworks (CSPM page). The data model, by the company's account, maps assets across AWS, Azure, GCP, Alibaba, Oracle, Tencent and other providers (Unified Data Model page). On the response side, it describes a Threat Investigation Agent that reconstructs the sequence of events and proposes a likely root cause (detect and respond page).

On delivery, the company says the platform connects through the cloud provider's shared virtualization infrastructure and reads block storage out of band, rather than running on the workload (SideScanning page). It names Slack, Jira and SIEM tools among its integrations (platform page), and it also offers an MCP server so its data can feed copilots and other AI tools (Unified Data Model page). For government buyers, the FedRAMP Marketplace lists the platform for AWS GovCloud, AWS US East/West and Azure Government.

The company's own pages also say what the product is not. Orca describes the platform as "agentless-first", not agentless only, with the Sensor added for runtime signal (Unified Data Model page). The SideScanning page says the scan runs "without sending a single packet over the network or running a single line of code in your environment", and the same page says Orca collects metadata from cloud accounts and workloads (SideScanning page). The posture page also separates Orca from what it calls traditional posture tools, which it says see only the control plane (CSPM page). Definitions of the categories are in our glossary.

Figure: Orca Security's home page, captured 2026-10-29. Source: About Us - Cloud Security Innovation | Orca Security.

The founders

Orca Security's two co-founders on our record both came from the Check Point group noted earlier. Gil Geron is chief executive and Avi Shua is chief innovation officer. The two have swapped the top job once.

Before co-founding the company, the page states, he "directed a large team of cyber professionals at Check Point Software Technologies". When Orca announced his appointment as CEO, Geron described his focus in customer terms: "From day one at Orca, my passion has always been solving real-world cloud security problems for customers and enabling their success." The same release said Shua would move to the newly created role of chief innovation officer and remain on the board.

The page says he was CEO from 2019 to 2023, and it credits him and Geron jointly with the patented SideScanning technology and the Unified Data Model.

Why they started. The company frames the founding idea as its own view: the founders "understood that modern computing technologies and the cloud required a re-architecture of security", its about page states. Shua's clearest public account came when Orca left stealth. He told SecurityWeek: "It is an almost impossible task for CISOs to answer security questions about their organizations’ sprawling cloud deployments." He added that organizations "shouldn’t be forced to choose between slowing down innovation and accepting unseen and unmanaged risks."

In the release announcing a $210 million Series C, Shua said the company was "solving a fundamental problem that has been broken since the inception of cloud security" and that "organizations can’t be burdened with installing and maintaining agents and sidecars."

Geron's more recent public comments have turned to AI. Presenting the company's 2026 State of AI Security Report, he said: "AI is no longer an experiment. It’s production infrastructure."

The wider founding team. CTech reported that the founding group was larger than the two names on our record, listing senior architects Matan Ben Gur and Liran Antebi alongside Shua and Geron, along with several engineers who had also worked at Check Point. Other Orca executives appear in our people listings.

What the product does

Orca sells a cloud security platform that collects data two ways, holds it in one model, and turns it into ranked findings a team can act on.

Collection. SideScanning, the agentless method covered earlier, is the default. Once it has read a workload's storage, Orca says it reconstructs the file system "in a virtual read-only view" and runs a full risk analysis against that copy rather than the live machine (Orca). The company says this covers Linux and Windows VMs as well as containers and serverless functions (Orca). For live activity there is a second component, Orca Sensor, which the company says adds "the real-time runtime signal where active detection demands it" (Orca).

Orca says it maps every asset, configuration, identity, network path and data store across AWS, Azure, GCP, Alibaba, Oracle, Tencent and other providers (Orca). Because runtime detections are written into the same model, the company says a team sees not only that an alert fired but what the affected asset can reach (Orca). Orca also says the model can trace a runtime exposure back to the repository and the commit that produced it (Orca).

Prioritization. Findings are scored on several factors. Orca lists severity, including CVSS and EPSS scores, then exploitability, accessibility and business impact, such as whether an asset holds PII or sits next to one that does (Orca). It draws attack paths as a visual graph that shows the end target and each step. For each path it marks which risks must be fixed to break it (Orca).

Posture and compliance. On the configuration side, Orca's page cites more than 2,500 configuration controls across 10 or more categories. It also cites checks against more than 150 industry and regulatory frameworks, including CIS benchmarks (Orca).

What the analyst does. Analysts can query the environment in plain language. Orca's example question is "Do I have any vulnerabilities that are public facing?" (Orca). For active incidents, the company says a Threat Investigation Agent contextualizes detections, reconstructs the sequence of events and proposes a likely root cause (Orca). That leaves the confirmation call with the analyst.

The team also decides how remediation runs. Orca says users can configure automation rules that fix alerts as soon as they are detected. The alternative is to copy remediation code into a command line or infrastructure-as-code tool, or to follow steps in the console. Instructions for each alert are generated with the platform's built-in generative AI (Orca). Findings can also go out to the ticketing and chat tools noted earlier.

Figure: Orca Security's product page, captured 2026-10-29. Source: Trusted Cloud Security Platform | Orca Security.

How it works and what it connects to

Orca's own pages describe the scanner by how it gets access, not by what it installs. The SideScanning FAQ says the platform "integrates via a cloud provider's shared virtualization infrastructure and reads the workloads' run-time block storage out of band" instead of running on the workload (Orca Security). The same page says Orca collects metadata from cloud accounts and workloads. It lists security groups, network configurations, vulnerabilities and policies, and gives IAM configuration and permission lists as one example (Orca Security). When the company came out of stealth in 2019, SecurityWeek reported Orca's statement that the product relied on read-only access (SecurityWeek).

For detection, the company says it monitors cloud provider logs and threat intelligence feeds around the clock. It says it combines that feed with its existing view of risks and of where critical assets sit (Orca Security). The government listing on the FedRAMP Marketplace adds that attack paths carry references to the MITRE ATT&CK framework (FedRAMP).

On integrations, the platform page names alerting via Slack, ticketing in Jira and streaming data to a SIEM (Orca Security). The Unified Data Model page says Orca connects through native integrations and an MCP server, so risk context can reach a developer, a pipeline or a customer's own LLM. The same page says Orca AI and outside agents are grounded in that single model (Orca Security). Google Cloud's partner page lists native integrations with Google Workspace, Chronicle, Security Command Center, SSO and Pub/Sub. It also describes generative AI search and remediation powered by Gemini Enterprise Agent Platform (Google Cloud). Orca's public GitHub organisation holds a Terraform provider and GitHub Actions for IaC security, image scanning and SAST (GitHub).

On deployment, the FedRAMP listing gives the service model as SaaS and the deployment model as Government Community Cloud. It covers AWS GovCloud, AWS US East/West and Azure Government (FedRAMP). The sources do not say where commercial customers' scan data is stored or in which regions it is processed.

On runtime reach, Orca's entry in the Cybersecurity Stars Awards states that Orca Sensor had passed 150,000 deployments (Cybersecurity Stars Awards).

The company's pages mostly describe the limits of other tools rather than of its own. One boundary is stated plainly: response routes into existing ticketing workflows, and auto-remediation is supported for defined scenarios (Orca Security). That reads to us as a scope narrower than full automation, though the page does not say which scenarios are excluded. For readers comparing approaches, the glossary and vendor profiles set out the categories without ranking them.

Where it sits in the market

CISO Tribune's record files Orca Security under four categories. Cloud-native application protection (CNAPP) covers platforms that combine posture, workload, identity and code-to-cloud risk analysis for cloud environments in one product. Cloud security posture management (CSPM) is continuous checking of cloud account configuration against security policy and compliance frameworks. Cloud identity entitlements (CIEM) is the analysis and reduction of permissions granted to human and machine identities in cloud platforms. Cloud workload protection (CWPP) is runtime protection for virtual machines, containers, Kubernetes and serverless functions. Orca's own pages treat the first as the umbrella for the other three. An FAQ on its Unified Data Model page states that "CNAPP actually combines the capabilities of CSPM", CWPP and CIEM, along with data security posture management and other functions.

The chart counts the other vendors on CISO Tribune's record in each of the four categories Orca is filed under. A vendor can appear in more than one.

The other vendors on the record in one or more of those categories are AccuKnox, Act Security, Aqua Security, Britive, CrowdStrike, Cyscale, Data Theorem, Modelyo, Oligo, Palo Alto Networks, Plerion, RAD Security, RapidFort, Raven.io, SAIC, Skyhigh Security, Sonrai, Sweet Security, Sysdig, Trend Micro, Uptycs, Upwind, Veza, VMware, Wiz and Xcitium. Some sell into a single category and others into several. The list is alphabetical and implies no order. Each has its own entry in vendors.

Orca draws its line against adjacent products mainly on deployment method. Its platform page states that "first generation CNAPP vendors take a heavyweight agent approach to cloud or bolt on modules from acquisitions", and that Orca was built for applications that move through CI/CD pipelines. Its SideScanning page says vendors that add an agentless option to an agent-based product "often have hidden limitations". The same page says that, on average, Orca found less than 50% of assets covered by agent-based tools. The company describes itself as "agentless-first" rather than agentless only. Its detection page says the Orca Sensor adds a real-time runtime signal where active detection needs it. The company also says it monitors idle, paused and stopped workloads and devices that cannot run agents.

Against standalone posture tools, its CSPM page argues that traditional CSPMs "lack insight into cloud workloads" and cannot see vulnerabilities, malware or exposed secrets. The same page says CSPM tools do not manage permissions or entitlements, which is the gap CIEM addresses. It then states that Orca combines workload, configuration, identity and entitlement, container, data discovery and detection functions in one platform.

On detection, Orca names endpoint, network, threat and extended detection and response as alternatives to cloud detection. It says those tools lack cloud telemetry and are "siloed tools without any contextual insight" into existing cloud risks. On coverage, the company says its model maps assets across AWS, Azure, GCP, Alibaba, Oracle, Tencent and others. These are the company's own claims. CISO Tribune has not tested them against the neighbours named above. Definitions of the four categories are in the glossary.

Funding, investors and growth

Orca's disclosed funding came in four rounds plus one extension between 2019 and 2021. It emerged from stealth with $6.5 million in seed funding from YL Ventures. A $20.5 million Series A followed in May 2020, and a $55 million Series B closed that December. In its 2020 review, the company said the two rounds added $75 million and brought its total to $82 million, from ICONIQ Growth, GGV Capital, YL Ventures and Silicon Valley CISO Investments (SVCI).

The chart shows the seed, Series A, Series B and the October 2021 Series C extension in millions of dollars, as reported by CTech, and does not include the $210 million initial Series C.

Chart data: SecurityWeek; NHI Governance; CTECH - www.calcalistech.com.

The Series C was $210 million, led by CapitalG and Redpoint Ventures, and it followed the December 2020 B round. Existing investors GGV Capital and ICONIQ Growth took part. SVCI, which the release calls "an angel syndicate of 50 prominent CISOs", invested again. The company put its total at nearly $300 million at a $1.2 billion valuation. It said the money would fund agentless, workload-deep security and staff growth. It had opened an office in Austria and planned one in Australia. It claimed more than 1,000 percent year-over-year growth in 2020, a year in which it said it reached over 40 paying clients.

In October 2021, Orca extended the Series C to $550 million, led by Temasek. CTech reported that the extension added $340 million. The company said the round raised its valuation 50 percent in seven months to $1.8 billion. The other participants were CapitalG, Redpoint Ventures, GGV, ICONIQ Capital, Lone Pine Capital, Stripes, Adams Street Partners, Willoughby Capital and Harmony Partners, with strategic investments from SAIC and Splunk Ventures.

The company tied the money to international expansion:

• It planned over a dozen employees in APAC by the end of 2021.
• It was opening a London office with sales staff and an R&D center, its first outside Tel Aviv.
• It aimed for over two dozen employees in London by year end.

It claimed 800 percent year-over-year growth at the time.

Orca's about page now states it has raised nearly $630 million at a $1.8 billion valuation. In December 2021, CTech reported that SentinelOne had been in advanced talks to buy Orca for $2.5 billion before the deal fell through. Orca responded: "The company is not for sale" (statement). A 2026 company release describes Orca as trusted by hundreds of organizations, including SAP, Autodesk, Gannett, Lemonade and Digital Turbine.

Customers, partners and public evidence

Most of the customer evidence for Orca comes from Orca itself. Its case-study library in June 2026 opened with C6 Bank, Blue Yonder, Autodesk, Swiggy and Sisense, and its filtered list included Elo, Jubilant Foodworks, Wayflyer and Pump. The headlines carry the claims. Swiggy "Scales Cloud Security Across 10,000+ Containers". Wayflyer "Clears Its SAST Backlog in 30 Days". Paidy, in a study linked from the platform page, "Saves Two FTEs and $500,000/Year". These are customer stories as the vendor published them, not independent audits.

Named security leaders appear on product pages. Lemonade CISO Jonathan Jaffe is quoted on the CSPM page saying "with Orca SideScanning there is zero impact on systems." The detection page quotes Barak Blima, CISO at CHEQ, crediting Orca with reducing "our overall security risk by 35%". Vivek Menon of Digital Turbine is quoted on the case-study page: "Orca adds value practically from the first day of use." In 2021 the company said it had signed Robinhood, Databricks, Unity, Live Oak Bank and BeyondTrust in 2020. BeyondTrust's CTO and CISO at the time, Morey Haber, said Orca was protecting "more than 4,000 cloud customers" of his company.

Orca promotes a TAG Analysts return-on-investment study, updated in 2026, under the headline "Orca Cloud Security Platform Delivers 198% ROI" (SideScanning page). The study itself was not among our sources, so the figure stands as Orca's presentation of it.

On partners, the 2021 Series C release stated that SAIC would use Orca in its consulting work on federal cloud migration, risk assessment and remediation. The same release listed Orca for purchase on the AWS and Google Cloud marketplaces. Google Cloud's own partner page says Orca integrates with Google Workspace, Chronicle, Security Command Center, SSO and Pub/Sub.

For government buyers, the FedRAMP Marketplace listed the Orca Cloud Security Platform as FedRAMP Certified as of 10 February 2025, at Class C (Moderate). The listing covers AWS GovCloud, AWS US East/West and Azure Government.

Recognition is mostly vendor-reported. A company release said Gartner named Orca a representative vendor in its 2023 Market Guide for CNAPP, and that Orca was named AWS Global Security Partner of the Year. Orca's 2020 recap listed a SINET 16 award. Orca also appeared as a 2026 Cybersecurity Stars Awards winner. That entry states that Orca Sensor had passed 150,000 deployments and that more than 20% of customers used AI-SPM. Readers comparing cloud vendors can find others on the record at /vendors.

Research, open source and public work

Orca's published research runs from early vulnerability surveys of third-party software to annual reports built on telemetry from its own customers' environments.

In 2020, the company says, it "tested products for known vulnerabilities and risks from 540 software vendors". That work produced two reports, the 2020 State of Public Cloud Security Risks Report and the 2020 State of Virtual Appliance Security Report. The appliance study drew trade-press coverage under headlines such as "Study Finds 400,000 Vulnerabilities Across 2,200 Virtual Appliances" and "Only eight percent of virtual appliances are free of vulnerabilities". Both headlines are listed in the company's 2020 review. The same post says Orca received a cease-and-desist letter after it published a hands-on comparison with Palo Alto Networks Prisma Cloud. It also says Avi Shua spoke on podcasts and wrote bylines for Dark Reading, CPO Magazine and Cyber Defense Magazine.

The most recent report in our sources is the 2026 State of AI Security Report. The company says it drew on "aggregated, anonymized telemetry from more than 1,200 production organizations collected during Q2 2026" (press release). The company stated these headline findings:

• 81% of organizations using AI packages had at least one known vulnerability, up from 62% in its 2024 report.
• 50% of AI package vulnerabilities had a publicly available exploit.
• 99.9% of AI vulnerabilities with an available fix remained unpatched.
• 56% of organizations had deployed AI agents into production.

Some figures improved. Since the previous AI report, Amazon SageMaker environments running with root access fell from 98% to 76%, and insecure IMDSv2 configurations fell from 77% to 48%. Orca also lists a 2025 State of Cloud Security Report, subtitled "Hunting threats in the age of relentless risk", on its detection page. Reports from across the record are collected under reports.

The company says the Orca Research Pod, a group of cloud security researchers, maintains its open-source projects on GitHub (open source page). Three projects are featured:

• IAM APE. It calculates effective permissions for an AWS entity and is published on GitHub and PyPI.
• KTE. A Kubernetes testing environment for EKS, GKE and AKS.

The company's main GitHub organisation listed 38 repositories. They include orca-skills, described as "Skills and plugins to accelerate security workflows with the Orca Cloud Platform", a GitHub Action for IaC security, and hardened, FIPS-enabled builds of the frpc client from the frp project. In our reading of the repository list, most of these are integration tooling for the platform rather than standalone research.

Individual research appears on the leadership page. CTO Yoav Alon was recognised on Microsoft Security Response Center's Most Valuable Research List at BlackHat 2019, according to the about page.

What a CISO should ask before buying

This list is our reading of what a proof of concept should test. Each question is built from a claim or design choice that Orca Security describes in its own material.

1. What exactly does SideScanning read, and where is it processed? The company says SideScanning works by collecting data from the workloads' runtime block storage without requiring agents. Ask which cloud permissions this needs, which region the analysis runs in, and how long reconstructed data is kept.

2. What leaves our accounts? Orca's page states that it collects metadata from cloud accounts and workloads, including security groups, network configurations and policies. Ask for the full data inventory, including how findings about sensitive data are stored.

3. Does the timeline hold on our estate? The same page says buyers will see an asset inventory in minutes and security gaps prioritized in 24 hours. Start a clock on connection day.

4. Are stopped and orphaned assets found? The company says it discovers and monitors idle, paused, and stopped workloads and orphaned systems. Leave a stopped VM and an orphaned disk in place before the trial and check whether both appear.

5. Where is the line between agentless and the sensor? Orca states that SideScanning provides complete posture visibility while Orca Sensor adds the real-time runtime signal. Ask which detections need the sensor, and what it uses in CPU and memory on a loaded host.

6. How is a score built, and can we change it? The prioritization FAQ asks of each issue, "What is the CVSS and EPSS score?" alongside exploitability, accessibility and business impact (Orca). Have Orca walk through the score of one known-vulnerable asset and show how you mark your own critical assets.

7. Does the noise claim survive our backlog? The company says its engine separates the 1% of alerts that demand quick action from the 99% that don't. Feed it an existing backlog and compare its short list with what your team would act on.

8. Does code lineage work with our repositories? The Unified Data Model page says teams can trace runtime exposure back to the code commit that caused it. Test with your own IaC templates and source control, not a demo repository.

9. What can the MCP server reach? Orca says it connects through native integrations and an MCP server so risk context can reach your own LLM. Ask how that access is scoped, logged and revoked.

10. What write access does remediation add? In 2019 Orca said the product relied on read-only access. Its CSPM page now offers automation rules that remediate alerts as soon as they are detected. Ask which permissions that requires, what approval gates exist and how a change is rolled back.

11. Is the investigation agent right? The company says its Threat Investigation Agent proposes the likely root cause of a detection. Replay a past incident and compare its account with your analysts' findings.

Timeline

The list below runs oldest first. It draws on Orca's own releases, press coverage and a third-party company profile, and states each figure as the company or the outlet gave it at the time.

The chart counts, by year, the milestones cited across this profile, so its totals differ from the entries in the list above.

Chart data: Milestones cited in this profile; most from NHI Governance: Orca Security NHI Profile: Agentless Cloud and CIEM.

• 2019: Orca was founded by a group of former Check Point employees that included Avi Shua and Gil Geron, CTech reported.
• June 2019: The company came out of stealth with a $6.5 million seed round from YL Ventures (NHI Governance). At that point the platform was in beta for select customers, SecurityWeek reported.
• May 2020: A $20.5 million Series A (NHI Governance).
• December 2020: A $55 million Series B (NHI Governance), a date the company's own release also gave.
• March 2021: A $210 million Series C at a $1.2 billion valuation, led by CapitalG and Redpoint Ventures (CTech).
• 5 October 2021: The Series C was extended to $550 million at a $1.8 billion valuation (NHI Governance). Temasek led the extension, and SAIC and Splunk Ventures made strategic investments (Orca).
• December 2021: CTech reported that SentinelOne had been in advanced talks to buy Orca for $2.5 billion and that the talks fell through. Orca's statement to the outlet was that the company was not for sale (CTech).
• 2023: Gil Geron became CEO (NHI Governance). Avi Shua moved to a new chief innovation officer role and stayed on the board (Orca).
• 13 May 2025: Orca acquired Opus, a company that built cloud remediation automation. Terms were not disclosed (NHI Governance).
• 2025: According to the company's awards entry, Orca launched AI-SPM detections during the year and introduced the Orca Sensor for runtime visibility.
• 16 March 2026: Orca announced the Threat Investigation Agent, an AppSec Triage Agent and Runtime AI Threat Detection (NHI Governance).
• 2026: Orca published its 2026 State of AI Security Report, based on telemetry from more than 1,200 production organizations collected in Q2 2026 (Orca).
• 29 July 2026: Orca announced AI AppGen Security and Orca Code Security Auditor, two capabilities for applications built with AI tools. Both were due for release later in 2026 (NHI Governance).
• 16 September 2026: Orca launched a new partner programme and partner platform (NHI Governance).