DSPM
Orca Security DSPM (Data Security Posture Management) is an agentless, cloud‑native data security layer within Orca’s CNAPP that discovers and classifies sensitive data (PII, PHI, PCI, IP) across cloud data stores, VMs, containers and buckets, then prioritizes only those data risks that sit on real attack paths. It helps security teams locate shadow and misplaced data, see who and what can reach it, and reduce data‑breach risk and compliance exposure without deploying extra tools or agents.
Orca DSPM extends Orca’s SideScanning and unified graph to the data layer, continuously scanning block storage, object storage, databases and managed data stores across AWS, Azure, GCP and other supported clouds to find sensitive data wherever it lives—running, idle, paused or stopped. It classifies data into “crown jewel” categories such as PII, financial data, healthcare data and intellectual property, and shows exactly which assets store that data, how they’re configured and how they can be reached from the internet or other compromised workloads. Because DSPM runs on the same context engine as Orca’s CSPM, CWPP and CIEM, data findings are automatically correlated with misconfigurations, vulnerabilities, malware and excessive identities, so teams see complete attack paths to sensitive data instead of isolated storage alerts. Orca also surfaces anomalous data‑related events and suspicious behaviors, helping security teams shrink the data attack surface and meet privacy and regulatory requirements with minimal additional tooling or deployment effort.
Key Features
-
Agentless sensitive‑data discovery – Scans “hidden corners” of workloads (VMs, containers), cloud storage buckets and managed/self‑hosted data stores to detect at‑risk sensitive data across multicloud estates.
-
Rich data classification – Detects PII, PHI, PCI and other business‑critical data (addresses, emails, credit‑card numbers, SSNs, IP, financial info) and lets customers tag additional “crown jewel” assets.
-
Context‑aware risk prioritization – Considers accessibility (public‑facing? exposed via misconfig?), workload state, co‑located vulnerabilities and secrets, and class of data to separate noise from truly critical data risks.
-
Shadow & misplaced data detection – Finds data stores and files security teams may not know exist (shadow data), including data left on forgotten VMs, test buckets or legacy databases.
-
Masked samples & reduced false positives – Provides masked samples and precise file locations, using statistical/heuristic scans (e.g., many 16‑digit numbers vs. one random string) to reduce false positives.
-
Attack‑path & breach‑impact view – Links data locations into Orca’s attack‑path graph so teams see which misconfigurations and compromised assets lead directly to sensitive data.
-
Compliance & privacy support – Helps meet data privacy and protection mandates by locating and monitoring regulated data, surfacing unencrypted or over‑exposed stores, and supporting audits.
Ideal For & Use Cases
Ideal For
-
Organizations with sensitive or regulated data in public clouds (finance, healthcare, SaaS, e‑commerce) struggling to answer “where is our important data and how exposed is it?”
-
Teams that already use or are considering Orca CNAPP and want data‑layer visibility tightly integrated with posture, workload and identity risk.
Representative Use Cases
-
Cloud data‑breach risk reduction – Find high‑impact combinations like public buckets or internet‑facing VMs that store PII/PHI/PCI and have exploitable vulns.
-
Shadow‑data cleanup – Identify forgotten snapshots, test databases and old buckets that still hold sensitive records.
-
Compliance and privacy readiness – Build and maintain inventories of regulated data, check encryption and access, and document controls for auditors.
-
“Crown jewel” protection – Tag business‑critical datasets and prioritize any attack paths or misconfigurations that endanger them.
Deployment & Technical Specs
-
Architecture: DSPM capabilities are built into the Orca Cloud Security Platform; they leverage the same agentless SideScanning (storage snapshots + APIs) and unified asset graph—no separate agents or sensors.
-
Data Sources Covered: Cloud storage buckets, managed/self‑hosted databases, VM/instance disks, container layers and other cloud data stores across AWS, Azure, GCP and Alibaba/Oracle where supported.
-
Discovery & Classification Engine: Content‑aware scanning with pattern/heuristic and statistical analysis for emails, credit cards, SSNs, names, addresses and other identifiers, with masking for sensitive samples.
-
Risk Modeling: DSPM findings feed Orca’s graph, which correlates data, misconfigs, vulns, malware and IAM access to compute risk scores and attack paths to sensitive data.
-
Performance: SideScanning operates out‑of‑band on cloud snapshots, so there is zero performance impact on live workloads; coverage includes running, stopped and idle resources.
-
Management & Integration: Uses the same Orca console, APIs and Discovery search as the rest of the platform; integrates with SIEM/SOAR and ticketing through global alerting and workflows.
Pricing & Plans
-
Licensing Model: DSPM is included as part of Orca’s single, all‑inclusive CNAPP SKU—there is no separate DSPM license; pricing is primarily based on the number of protected cloud workloads.
-
Indicative Costs: Vendr data shows a median Orca contract value of about USD ~$84–86K/year across the full CNAPP stack (including DSPM). AWS Marketplace starter packs range roughly from $7K–$30K/month for 100–1000 concurrent EC2 workloads.
-
Public‑sector / G‑Cloud: UK G‑Cloud listing explicitly includes “Data Security and Posture Management” among the CNAPP features, priced per licence with education discounts and free trials.
Bottom line: you get DSPM when you buy Orca CNAPP; you don’t pay a separate DSPM SKU, though overall pricing is very much enterprise‑oriented.
Pros & Cons
Pros
-
Broad, agentless coverage of sensitive data across workloads, storage and databases in multiple clouds.
-
Context‑rich prioritization that ties data issues to real attack paths instead of isolated bucket or DB misconfigs.
-
Part of a unified CNAPP, simplifying tooling and ensuring data risk is viewed alongside posture, workload and IAM risk.
-
Low operational overhead thanks to SideScanning and centralized console—no separate DSPM agents or products to deploy.
Cons
-
Enterprise‑grade pricing and CNAPP‑wide licensing can be overkill if you only want a narrow DSPM tool.
-
Effectiveness depends heavily on good tagging and data‑owner processes; without them, remediation can stall even if risks are well‑surfaced.
-
Pattern‑ and heuristic‑based classification can still produce false positives/negatives, requiring teams to review masked samples and tune workflows.
Final Verdict
Orca Security DSPM is a strong choice for organizations that already see Orca as their central CNAPP and want data‑layer visibility and protection tightly integrated with cloud posture, workload and identity security. Its agentless discovery and context‑aware prioritization do a good job answering the hardest questions—where is our sensitive data, how exposed is it, and what is the most likely path an attacker would take to reach it?—without adding another standalone product.
It is less compelling if you just need a lightweight DSPM or spreadsheet‑style data catalog; pricing and deployment make more sense when you use Orca’s broader capabilities (CSPM, CWPP, CIEM) and treat DSPM as the data pillar of a unified cloud‑risk program. For data‑heavy, regulated or breach‑sensitive organizations already in multi‑cloud, Orca DSPM deserves serious consideration as part of a consolidated cloud security strategy.