SECURITY ATLAS / EVALUATION BRIEF Orca Security Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/orca-security/ THE ATLAS TAKE Orca is worth examining when a cloud team wants workload and configuration context before deploying instrumentation throughout the estate. SideScanning supplies an out-of-band assessment path; the separately documented Sensor adds runtime visibility and protection. Atlas would make that distinction the center of the proof of value. A disk-derived finding can be useful without observing the exact process that is executing now. Evaluate the permission, encryption, freshness, and sensor requirements for a representative workload, then ask whether the combined evidence changes a remediation decision. Broad agentless coverage language should never substitute for an observed coverage ledger. SCOPE SideScanning and Orca Sensor serve different purposes. Confirm snapshot or disk access, supported workload types and runtime sensor requirements. Agentless assessment should not be described as continuous process prevention merely because it identifies a vulnerable package. WORTH A LOOK WHEN Cloud security teams seeking out-of-band workload assessment with a deliberate, separately validated runtime sensor rollout. THINK TWICE WHEN An agentless scan is expected to prevent every process action, or encrypted and unsupported workloads are excluded from the coverage discussion. IMPLEMENTATION 1. Prove the assessment path Select a workload with representative disk encryption and cloud permissions; record the actual observed inventory and scan completion. 2. Add runtime deliberately Deploy Sensor to a small supported workload group with ownership, health monitoring, and a tested removal procedure. 3. Unify remediation evidence Record the original risk, owner decision, changed resource or image, and both assessment and runtime evidence after remediation. OPERATING REALITY Cloud owners maintain the integration and access to supported workload data; security teams triage risk combinations and manage exceptions. Runtime coverage adds sensor deployment and health responsibilities. Atlas would require teams to distinguish the last successful assessment from a current runtime observation when investigating short-lived infrastructure or verifying that a fix reached production. COMMERCIAL CONSIDERATIONS Obtain a written quote for the specific platform and Sensor scope. Public platform descriptions do not establish universal workload counting rules, regional processing arrangements, or an all-inclusive price. - Contracted cloud and workload populations plus selected platform capabilities - Runtime sensor scope and deployment services - Cloud permissions review, assessment infrastructure, and remediation effort EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Challenge an encrypted workload Acceptance evidence: Keep the disk and key configuration, granted permissions, scan result, and a deliberate denied-access case. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Separate scan and runtime evidence Acceptance evidence: Create a harmless lab artifact and a permitted runtime event; show which component observes each and when. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Verify a disappearing risk Acceptance evidence: Remediate a test condition and preserve reassessment timestamps, remaining blind spots, and the owner’s acceptance of the result. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - Which storage or snapshot information is accessed, copied or processed during scanning? - What changes could occur between scans without appearing in a posture finding? - Which operating systems and workload types support the required sensor behavior and response action? EVIDENCE GAPS - Public product material and a technical brief were reviewed; restricted deployment documentation and the proposed support matrix still need vendor confirmation. - No independent overhead, prevention, scan-completeness, or remediation-speed benchmark was conducted. SOURCES Orca SideScanning technical brief (Product information) https://orca.security/wp-content/uploads/2024/11/Orca-SideScanning-Technical-Brief-Digital.pdf Orca Sensor runtime visibility and protection (Product information) https://orca.security/platform/runtime-sensor/ Orca cloud security platform (Product information) https://orca.security/platform/ Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.