CNAPP

Key Features

• Agentless SideScanning™ – Reads cloud block storage and metadata out‑of‑band to discover assets, vulnerabilities, malware, secrets, misconfigurations and data exposure across workloads, including idle or paused assets that agents often miss.

• Unified CNAPP coverage – Single platform and data model for CSPM, CWPP, CIEM, DSPM, container/Kubernetes, API security, vulnerability management and compliance.

• Contextual risk & attack‑path analysis – Correlates issues across config, workloads, identities, network reachability and data sensitivity to surface dangerous “toxic combinations” and attack paths to crown‑jewel assets.

• Data Security Posture Management (DSPM) – Discovers and classifies sensitive data in buckets and volumes, maps where it resides and how it’s exposed, and prioritizes misconfigurations that put it at risk.

• Cloud Infrastructure Entitlement Management (CIEM) – Analyzes IAM policies, roles and principals to find excessive permissions, dormant accounts, risky trust chains and lateral‑movement opportunities.

• Shift‑left & SDLC integration – Integrates with git and CI/CD pipelines to scan IaC (Terraform, CloudFormation, etc.), container images and code, then links runtime findings back to their source for faster remediation.​​

• Orca AI & remediation – Uses GenAI to summarize findings, answer natural‑language queries, generate remediation code/snippets for IaC/CLI and guide least‑privilege policy tuning.

Ideal For & Use Cases

Ideal For

• Mid‑to‑large organizations running multi‑cloud (AWS, Azure, GCP) and Kubernetes that want broad, rapid coverage without pervasive agents.

• Security teams seeking to consolidate CSPM, CWPP, CIEM, DSPM and container/API security into a single, context‑aware platform.

• DevSecOps and platform teams needing continuous posture plus pipeline scanning and code‑to‑cloud traceability.

Key Use Cases

• Continuous cloud posture & compliance – Enforce baselines, detect drift and map controls to CIS, NIST, PCI, SOC 2, ISO, etc.

• Cloud vulnerability & malware management – Find exploitable vulns and malware in VMs/containers without agents, including dark or unmanaged assets.

• Least‑privilege & identity risk reduction – Rightsize roles, remove unused permissions and break risky trust relationships uncovered via CIEM analysis.

• Data exposure reduction – Locate sensitive data, tighten access and fix public or weakly protected storage and databases.

• Breach likelihood reduction – Use attack‑path views to prioritize fixes that most reduce blast radius and attacker reach.

Deployment & Technical Specs

• Connection Model: Read‑only cloud API access plus SideScanning of storage snapshots; no inline proxies or packet capture.

• Supported Environments: AWS, Azure, GCP; managed and self‑managed Kubernetes; containers, serverless, VMs, storage, DBs and messaging services.

• Data & Risk Model: Unified graph database of assets, configs, identities, connectivity and data locations, powering attack‑path and reachability analysis.

• Form Factor: Multi‑tenant SaaS; optional lightweight Orca Sensor (eBPF‑based) for advanced real‑time detection on selected workloads.

• Integration Surface: SIEM/SOAR, ITSM (Jira, ServiceNow), messaging (Slack, Teams), SCM/CI‑CD tools, ticketing and reporting systems.

• Performance & Scale: Designed for large multi‑cloud estates; agentless approach avoids performance impact on workloads and provides coverage for idle/orphaned assets.

Pricing & Plans

• Licensing Model: Simple, all‑inclusive CNAPP SKU priced primarily per cloud workload (VMs, containers, serverless) rather than per feature module.

• Included Capabilities: CSPM, CWPP, CIEM, DSPM, container/K8s, API security, vulnerability management and compliance generally included in a single license.

• Commercial Terms: Annual (or multi‑year) contracts sized by workload count and cloud footprint; volume discounts for large estates; POCs available.

• Procurement: Direct from Orca or via cloud marketplaces such as AWS Marketplace, simplifying legal and billing.

Positioning is in the enterprise CNAPP tier: higher than point tools but competitive with peers like Wiz or Prisma Cloud, with savings potential from consolidation and reduced ops overhead.

Pros & Cons

Pros

• Fast time‑to‑value via agentless onboarding; full visibility in days instead of months of agent rollout.

• Deep contextual prioritization & attack‑path focus significantly reduces alert fatigue versus siloed CSPM/CWPP tools.

• Broad CNAPP coverage (CSPM, CWPP, CIEM, DSPM, container/API) in one platform simplifies security stack and workflows.

• Good fit where agents are hard (regulated, legacy, or highly ephemeral environments).

Cons

• Not a full EDR/XDR replacement; oriented to posture, visibility and context, not deep host‑level response.

• Cost can be significant for very large footprints; ROI depends on actually consolidating tools and using risk‑based prioritization.

• Read‑only posture means you still need inline controls (WAF, gateways, runtime agents) for blocking and active enforcement.

Final Verdict

Orca Security Cloud Native Application Protection Platform (CNAPP) is a strong choice for organizations that want agentless, unified cloud visibility and intelligent, attack‑path‑aware risk reduction across AWS, Azure, GCP and Kubernetes. Its SideScanning and unified graph data model deliver context and prioritization that many stitched‑together CNAPP offerings lack, and the all‑inclusive SKU avoids the add‑on sprawl typical in this market.

It is best positioned as the central cloud security and posture platform, consolidating CSPM/CWPP/CIEM/DSPM, while complementing—rather than replacing—endpoint and inline controls. For mid‑to‑large multi‑cloud estates ready to rationalize tools and lean into risk‑based remediation, Orca deserves a top spot on the CNAPP shortlist.