Tool profile
Orca Security: cost, fit and limits
Orca Security is an agentless cloud security platform made by Orca Security Ltd. of Tel Aviv, Israel, that inventories cloud assets and AI models, scans code and workloads, maps attack paths and offers an AI reasoning layer for security questions.
What to know first
Orca Security publishes no pricing on the pages read; the pricing URL returned 404 and no free trial was found, so it is quote only. Its approach is agentless, using SideScanning, and it groups posture, identity, workload, data and runtime findings in one risk view. The registered address in the privacy policy is in Tel Aviv, and offices are listed in London, Tel Aviv and Portland.
Orca Security at a glance
| Maker | Orca Security, Israel |
|---|---|
| Free plan | No |
| Entry price | Quote only |
| API access | No |
| Category | Best AI Cloud Security (CSPM and CNAPP) Software in 2026, rank 3 of 12 |
| Website | orca.security |
Who Orca Security is best for
Teams that cannot install agents
SideScanning deploys without agents, so security can cover accounts and workloads without asking application teams to change hosts or images.
Teams tracking shadow AI
The AI inventory finds AI models, packages and agents across the cloud, including shadow AI. The vendor claims a complete inventory in under 30 minutes, a claim not tested here.
Analysts who work inside Claude or ChatGPT
Orca names an MCP server for Claude and a ChatGPT plugin that bring cloud risk context into those assistants, which suits analysts who already query tools that way.
Orca Security plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Custom quote | Not published on the pages read | Capabilities named on the product page: AI inventory, unified risk view, code scanning, attack path analysis, agentless deployment and remediation workflows. |
Checked October 2026.
What Orca Security does
- AI inventory
- Finds AI models, packages and agents across the cloud, including shadow AI, and is the starting point for judging which AI services carry sensitive data.
- Unified risk view
- Combines cloud posture, identity permissions, workload security, sensitive data at risk and runtime threats in one view rather than in separate consoles for each concern.
- Code scanning
- Scans code, dependencies, infrastructure as code, images and secrets and scores findings against live cloud context, so a flaw in a deployed service ranks above one in a dormant repo.
- Orca AI and MCP
- Orca AI is described as the reasoning engine for AI agents, and Orca AI inside ChatGPT and Claude brings cloud risk context into those tools through an MCP server and plugin.
How Orca Security handles your data
The privacy policy gives the registered address as Orca Security Ltd. in Tel Aviv. It makes no AI or model training statement and gives no fixed retention periods. The pages read do not name hosting regions or list certifications, so the vendor's policy was not checked for those points. Because the platform scans customer cloud accounts, ask which metadata leaves the account and where it is stored.
Where Orca Security falls short in practice
- Price not visible. No pricing is published on the pages read, and the pricing URL returned 404, so budgets cannot be set before a conversation with the vendor's sales team.
- Vendor claims untested. The under 30 minutes inventory figure is the vendor's own claim from the product page. A trial on a large account is the way to test it.
- No developer API found. The pages read name an MCP server and a ChatGPT plugin but no public developer API, which matters to teams that want to script findings into their own tooling.
Works with
Alternatives to Orca Security
Orca Security: common questions
Does Orca Security need agents?
No. Orca deploys agentless through SideScanning, per its product page. That means no software on each workload. The trade-off is that agentless methods read what the cloud account exposes, so teams that want in-process runtime detail should ask what the runtime threat coverage consists of.
Where is Orca Security based?
The privacy policy gives the registered address as Orca Security Ltd., 3 Tushia St., Tel Aviv, Israel. The home page lists offices in London, Tel Aviv and Portland, Oregon without naming a headquarters, so use the registered entity for contract questions.
What does Orca integrate with?
The pages read name Slack, Jira, ServiceNow, Splunk, GitHub, Okta, Datadog and Claude. Claude connects through an MCP server, and a ChatGPT plugin brings cloud risk context into that assistant. Confirm the depth of each connector, since the pages only name them.
Is there a price list for Orca?
No. The pages read give no pricing, the /pricing/ URL returned 404, and no free trial was found. Treat it as quote only and ask for scope-based pricing, including what the quote covers, before comparing it with other tools. Ask whether the quote scales by assets, accounts or workloads.
Does Orca train AI on my cloud data?
The privacy policy contains no AI or model training statement, and it gives no fixed retention periods. That is silence, not a denial. Request written terms on model training and on retention before onboarding a production account. Ask for the contract language on both points.