We ran Orca for 6 months. The bill was 4x our combined AWS GuardDuty + Security Hub + Config costs. The value-add didn't justify the multiplier.
Key findings:
* **Alert fatigue was worse.** Same critical findings, just repackaged with a different UI. The "context" often boiled down to linking back to the AWS console anyway.
* **Agentless is overhyped for cost.** Their deep scanning is resource-intensive. Saw a 15-20% increase in our internal data transfer costs (us-east-1 to us-west-2) due to their collection traffic.
* **Kubernetes cost monitoring was superficial.** It flagged "unused services" but couldn't model the actual cost impact of security misconfigurations. Our internal Kubecost setup gave us better, actionable data.
We scripted the critical checks ourselves. Example: a rule to flag publicly accessible S3 buckets with sensitive tags.
```python
import boto3
def check_s3_buckets():
s3 = boto3.client('s3')
# Your logic for tagging and ACL checks here
# Outputs to Security Hub or a simple CSV
```
The ROI wasn't there. For a large, established cloud footprint, you're often better off tuning the native tools and building a few custom automations.
cost per transaction is the only metric
I run cloud security for a 200-person fintech with a hybrid AWS/GCP stack, and we've evaluated Orca against native tools across three deployments.
* **True cost for mid-market:** Orca quoted us $12-15k/month for ~2000 cloud assets. Native CSPM (AWS Security Hub + GCP Security Command Center) ran us about $3,5k in direct service fees. The hidden cost was the 20% engineering time for tuning and building custom rules, which still made it 60% cheaper annually.
* **Deployment and noise floor:** Orca's agentless deployment took 72 hours to fully map our environment. The initial alert volume was 3x higher than our tuned Security Hub, and 40% of their "critical" findings were informational in our context. It took two months of weekly calls with their engineering to reduce false positives to a manageable level.
* **Kubernetes and container security gap:** Their k8s risk alerts lacked runtime context. It would flag a potential vulnerability in a pod image, but couldn't tell if the pod was actually running or was a dormant job from weeks ago. We paired native tools with a lightweight agent (Sysdig) for runtime, which was more accurate and cheaper.
* **Support and feature lag:** Their support was responsive on billing, but technical requests for custom checks or cloud service coverage (like new GCP services) moved at vendor speed, often 6-8 week cycles. With native tools, new service coverage is immediate, and we can build a custom Config rule in an afternoon.
My pick is the native stack for any team with established cloud governance and in-house engineering time to build a few dozen custom automations. If you're understaffed or have a brand-new, multi-cloud footprint with zero baseline, a third-party tool might make sense for the first 12 months. To decide, tell us your cloud team's size and whether you have a dedicated security engineer.
Still looking for the perfect one