Orca Security Explained: SideScanning, Attack Path Scores and How to Run an Agentless CNAPP

Orca Security was one of the companies that made agentless cloud scanning mainstream. Its pitch, still central to how it is discussed in interviews, is that you can see inside every virtual machine in a cloud account without installing anything on it, by reading copies of its disks.

What it is

Orca is an independent cloud-native application protection platform (CNAPP). It combines cloud configuration, identity and workload data in what it calls a Unified Data Model, and uses it to find attack paths: combinations of individually modest problems that together reach something valuable. An optional Orca Sensor adds runtime detection, including on Windows servers and private or on-premises infrastructure since July 2025. The Orca CLI scans infrastructure code and container images in CI. In May 2025 Orca acquired Opus Security, which focuses on remediation and orchestration. In March 2026 it added AI agents for threat investigation and application security triage, runtime detection for AI services, and Orca Missions, which group related findings into remediation projects.

How it works

SideScanning reads each workload's block storage through read-only cloud APIs: it snapshots the disks, analyses the snapshots out of band, and deletes them shortly afterwards. Orca's phrase for this is that it does not run "a single opcode" on your environment. Configuration and identity data come from the same read-only API access.

Attack path analysis, launched in 2022, joins alerts into paths and gives each path a Business Impact Score from 0 to 99, using severity, accessibility, lateral movement risk, access level and business impact. Sonar is Orca's query language over its data, and the Discovery query builder lets you ask inventory questions without writing query strings.

How to use it

Day one: pick a deployment mode and connect

1. Choose SaaS, In-Account or BYOC with your data protection team. In-Account suits organisations that cannot share disk snapshots with a vendor account; BYOC keeps both data and metadata in your cloud.
2. Connect AWS with the CloudFormation template Orca provides, which creates cross-account read-only access; then add the role ARN in Orca. Connect Azure and Google Cloud the equivalent way, at the highest scope you can.
3. Check coverage against your cloud organisation's account list before you trust any dashboard.

Week one: work the attack paths

1. Start with the risk dashboard's top attack paths by Business Impact Score.
2. For each path, find the cheapest break: closing internet exposure, removing a permission, or patching the vulnerable package. One fix often breaks several paths.
3. Use Discovery queries for questions auditors and engineers ask, such as "which internet-facing machines run an end-of-life operating system".
4. Group the remaining work into Missions with owners.

Every day: route, gate and add runtime where needed

Route alerts to ticketing and chat with severity-based deadlines, run the Orca CLI in pipelines so new infrastructure code and images are checked before deployment, and deploy the Orca Sensor on workloads where you need real-time detection rather than periodic scans.

Where it stops

• Snapshots are periodic. SideScanning shows what is on disk at scan time; memory-only threats and short-lived workloads between scans need the sensor or log-based detection.
• No blocking from scans. Agentless scanning observes; prevention needs the sensor, admission control or pipeline gates.
• In-Account and BYOC shift cost. You run and pay for the scanner infrastructure.
• Scores are a model. A Business Impact Score depends on what Orca knows about the asset; tag business-critical systems so the score reflects reality.

How it comes up in interviews

• "Explain agentless scanning to a sceptical infrastructure lead." Snapshots, read-only access, data boundary options and what it cannot see.
• "Two vendors both claim attack path analysis. How do you compare them?" Run both against the same accounts with planted test paths and compare what each finds and how it explains the path.
• "Our compliance team says snapshots cannot leave our accounts." In-Account or BYOC scanning, with the cost trade-off.

Sources

Checked on 13 November 2026: Orca Security blog posts on SideScanning and on privacy in the cloud (22 January 2025); Orca press releases on deployment models (January 2025), attack path analysis and business impact score (31 March 2022), runtime protection for hybrid and private cloud (30 July 2025) and AI-first cloud defence (16 March 2026); Orca's AWS onboarding page; AWS Machine Learning blog on natural-language security queries at Orca; SiliconANGLE report on the Opus acquisition (13 May 2025).