Enabling container registry scanning in Orca provides coverage for images not actively running in your clusters. The value depends on your image lifecycle and deployment pipeline.
If you have a mature CI/CD process with static scanning (e.g., Trivy, Grype) in the build stage, Orca's registry scanning becomes largely redundant. It will flag the same CVEs and misconfigurations. However, it centralizes findings within the same platform, which can simplify triage for teams already using Orca for runtime cloud security.
The primary advantage is for legacy or imported images, and for catching issues before deployment. Consider the cost of the additional workload scans against the risk reduction. For our environment, we enabled it but suppressed alerts for high-severity findings that are already blocked at the pipeline level.