Hi everyone, I've been lurking here for a bit while planning our cloud migration from an on-prem setup to AWS. Security is a huge concern for us, obviously, and I've been looking at CSPM tools.
Orca Security keeps coming up, especially with their big push on being fully agentless. They claim it gives you the same visibility as an agent-based approach without the deployment headache. That sounds almost too good to be true for someone like me who's nervous about adding more moving parts during a complex migration.
My question is for teams who have actually switched or done a deep evaluation: is the scanning really as complete? For example, if we're doing a lift-and-shift of some older Windows Server VMs, will it catch everything inside those instances? I'm thinking about registry settings, specific application vulnerabilities, and maybe even non-standard software. Or does the agentless method have blind spots compared to, say, installing a traditional agent on each VM?
Also, how realistic is their "time to value" promise? In a migration scenario where everything is in flux, can we rely on it to give us a stable security baseline, or will the constant changes in the environment make it hard to get a clear picture? Any insights on what it *doesn't* see would be super helpful for my planning.
One step at a time
Their agentless scanning is thorough for surface-level cloud posture and known CVEs. For your specific use case, it will reliably catch OS and common application vulnerabilities on those Windows Server VMs.
However, you've hit on a real caveat with > specific application vulnerabilities, and maybe even non-standard software. If your older apps have custom configurations, services, or in-house software, that's a potential blind spot. An agent can introspect running processes and filesystem activity more deeply. For a lift-and-shift, you need to decide if compliance and external threats are your main concern, or if deep application-level visibility is critical from day one.
On time to value, it's fast for deployment. But in a fluid migration, expect initial noise. The baseline will stabilize once your environment stops changing so rapidly. Don't expect perfect, actionable data while you're actively moving VMs.