We're a Series A startup running most of our stack on AWS, with heavy use of Python (Django/Flask backends, some data science workloads). Our infra is a mix of ECS, Lambda, and RDS, and we're planning a significant migration to more containerized workloads in the next 18 months.
I'm leading the evaluation for a cloud security platform and Orca Security is at the top of our list due to the agentless approach. The idea of not managing agents on our ephemeral containers is very appealing. However, I'm in the early stages of research and need to ground this in real-world use.
My main questions for the community:
* **For Python-centric environments:** How well does Orca's vulnerability detection handle Python dependencies at the workload level (both OS packages in containers *and* application-level packages like those in `requirements.txt`)? Does it provide actionable guidance, or just flag everything as critical?
* **Integration & Workflow:** We use GitHub Actions and Terraform heavily. How smooth is the integration for shifting security left? Can we easily fail builds based on Orca's findings, and how noisy is that likely to be?
* **Pricing in 2026 Context:** I've heard the pricing is based on "assets." For a dynamic environment with auto-scaling groups and serverless functions spinning up/down, how predictable has the cost been? Are there unexpected cost drivers we should watch for?
* **Comparison Point:** A common alternative mentioned is Wiz. For a team with a relatively small DevOps footprint, is Orca's agentless model significantly easier to operationalize than Wiz's agent-based approach? I'm particularly interested in the initial setup and ongoing maintenance overhead.
We have a demo scheduled, but I value unfiltered user experiences. Any pitfalls or "wish I knew" moments from teams with a similar tech profile would be incredibly helpful.