The custom field workaround is a pragmatic solution. We did something similar, but found that any custom data in Orca gets excluded from their pre-built compliance dashboards and evidence packages. You have to export everything and rebuild the visuals yourself if you want that context included in official reporting.
Separating legacy findings into a different queue was the only way we could maintain clear metrics for managed assets. Even with that, we had to build a separate reconciliation process to ensure something moved from the "pre-HIPAA" queue into the main system once it was actually assessed, or we'd lose track of it entirely.
The HIPAA mapping is detailed on paper. The problem is evidence consistency for audits. The dashboard and compliance report can show different states due to data lag.
Their remediation steps are clear but generic. You'll need your own mapping to teams and deployment patterns for anything beyond tagged cloud resources.
If you proceed, run a PoC that checks historical report snapshots after fixing a test misconfiguration. Don't trust their evidence package is immutable.
Trust, but verify
Nobody mentioned cost yet.
Their mapping is detailed but you'll pay for every scanned asset, cloud or on-prem. Agentless doesn't mean cheap. Get a firm quote per asset per month before your PoC.
Their generic remediation steps often lead to over-provisioned fixes that inflate your cloud bill. You'll spend more money "securing" a low-risk legacy VM than the thing is worth.
Deep dashboards are useless if the data is wrong, as others said. But they're also useless if the cost to fix every flagged item bankrupts your project.
show me the bill
Ran it for a year on a mix of AWS and some on-prem VMware.
Granularity is fine, you can drill down to specific controls. The real problem, as others have hinted, is trusting the data. We had to run our own nightly export to S3 just to get a static snapshot for audits because their "historical" reports weren't reliable.
Remediation steps are clear but generic. For cloud assets tagged with an owner, it's fine. For anything in our legacy on-prem environment, the guidance was useless because it couldn't map the finding to our team structure. You'll end up building that layer yourself.
I can't argue with the nightly export. It's the admission price for trusting any of these platforms. The real question is what's left for the vendor to do after you've built your own immutable snapshot layer, your own team mapping, and probably your own remediation playbooks.
You're essentially paying them for a very expensive, and occasionally laggy, data collection service.
Show me the data
You've gotten a lot of great warnings here about data consistency, which is spot on. I can answer your specific question about granularity and remediation steps, though.
The HIPAA and HITRUST mapping in the dashboard is impressively granular, and the remediation steps are very clear, sometimes too much so. You'll get step-by-step console clicks for AWS or Azure.
But here's the kicker for a "locked-down environment" like yours: that clear guidance is almost entirely built for pure, tagged cloud resources. When it hits a legacy on-prem VM or a poorly tagged hybrid asset, the action item becomes a generic "enable encryption" or "restrict access" with no path to *how* in your specific environment. You're still left building that internal mapping from finding to responsible team.
So the dashboards are deep, but their utility hinges on your infra being modern and perfectly tagged. If it's not, you're buying a fancy scanner and building the workflow engine yourself.
Beta tester at heart
That "false sense of readiness" is the dangerous bit. Their dashboards look so complete that leadership assumes the evidence is packaged and ready to go. It's not.
We saw the same gap with auditor expectations. They don't just want a list of flagged findings. They want to see the decision thread for each one. Orca gives you the what, but you're left scrambling to manually attach the why and the who approved it for every single exception. That narrative gap turns a quick review into a manual documentation scramble.
Cloud costs are not destiny.
This point about the auditor's decision thread is crucial. We had to create a parallel log just to capture the justification, owner, and approval date for every exception we accepted. It completely duplicated effort.
Orca's package shows you're compliant on paper, but it leaves the entire audit trail of human decisions as a separate manual burden. That gap is where projects stumble.
Keep it civil, keep it real.
You're absolutely right about the opportunity cost being a double hit. We measured it as a direct project delay.
While they were manually reconciling Orca's findings with our internal risk register, a scheduled implementation of new detective controls for our patient portal was pushed out by a full quarter. That's a tangible security delay attributed directly to the tool's reporting overhead.
The overtime cost is visible on a spreadsheet. The delayed project is a silent but critical impact on your actual security posture.
Buy once, cry once.
It's telling that you're asking about granular dashboards and remediation clarity, because those are the exact surfaces Orca polishes to a high shine to sell you on the promise of automated compliance. The problem is that you'll be paying for dashboard depth while inheriting massive gaps in audit readiness.
The granular mapping exists, but as others have covered, it doesn't map to your internal ownership or your legacy systems. Their clear, step by step remediation for a tagged AWS resource is a distraction from the sea of generic, unactionable flags you'll get for your on prem or hybrid assets. You'll spend more time and money building the internal process to triage their findings than you will actually fixing things. Their 'actionable' guidance creates a false economy where your team is busy following their prescriptive cloud steps while your actual risk in legacy environments goes unaddressed because the tool can't speak to your specific environment.
So your deciding factor shouldn't be dashboard depth. It should be the total cost of building the missing layers of evidence immutability, team mapping, and exception tracking that Orca omits. If deep dashboards are your priority, prepare for a deep hole in your budget and a shallow audit narrative.
Skeptic by default
The dashboards are deep, but they're a compliance liability for the exact reason you're asking about.
You get step-by-step console guidance for a clean AWS S3 bucket. For anything on-prem or poorly tagged, you get generic warnings with no path to remediation. Your locked-down environment is where the guidance fails hardest.
The real audit cost isn't the tool. It's the manual work to build the decision thread and ownership mapping that Orca completely ignores. You'll pay for the dashboard and then double-pay your team to make it usable.
Show me the bill
Exactly. The compliance liability is a function of your environment's entropy. If you're running a pure greenfield cloud setup with strict tagging from day one, the dashboard depth is genuinely useful. The moment you introduce a single legacy VM or an unmanaged container, the entire value proposition fractures.
We documented a case where a single unpatched Windows 2008 server, which Orca correctly flagged, generated a remediation step to "Use AWS Systems Manager Patch Manager." The server was in a colo. That single piece of nonsensical guidance invalidated the entire control report for our PCI scope because the auditor questioned the accuracy of every other mapped finding. You don't just pay your team to build the missing decision thread, you pay them to constantly validate that the platform's "context" isn't actively misleading.
Show me the benchmarks.