Agentless cloud security platform with strong attack path analysis and agentic remediation. Cloud only, and it markets exposure management less explicitly than its competitors.
Orca's patented side-scanning reads cloud workload storage out of band, so it inspects hosts, containers and functions without agents and without touching production performance. For cloud estates that resist agent rollout, this is the reason to look.
The unified data model turns those findings into a graph, and attack path analysis surfaces toxic combinations across misconfiguration, vulnerability, identity and exposed data rather than ranking each finding alone. That is prioritisation done the way CTEM asks for.
Mobilisation improved sharply after the Opus Security acquisition in May 2025: agentic remediation, automatic fixes, ownership routing and integration with Jira, ServiceNow, Slack and PagerDuty. An Attack Surface Red Agent, announced in August 2026, runs on-demand artificial intelligence penetration testing against public-facing assets; it is on-demand rather than continuous and the vendor does not yet state general availability, so treat validation as partial.
Scope is the constraint. Everything is cloud. There is no on-premises, endpoint or operational technology coverage, and Orca does not position itself as an aggregator of third-party findings. Notably, its product pages barely use the term exposure management, which tells you where its centre of gravity sits.
Check in a demo: how side-scanning handles your least standard workloads, and whether the graph ingests findings from tools outside the cloud estate you also need to prioritise.
Weak in one of these stages? The self-assessment tells you which stage to shop for first, and the directory shows who covers it.
Claim or correct this listing
Tell us what is wrong or what you want to confirm, and link a public source we can check. The owner reviews every claim. Nothing changes on the site until it has been reviewed, and a claim never changes a score or placement.
Get vendor updates monthly
One email a month: what changed in exposure management, which vendors moved, and one thing worth doing. No spam, unsubscribe any time.