My team is evaluating agentless vulnerability scanners, with a specific focus on their efficacy for serverless environments. Our architecture is heavily based on AWS Lambda, and we've found that many tools claiming "cloud security" still treat Lambda as a second-class citizen, providing only superficial layer scanning.
We are currently looking at Orca Security, given its prominence. However, I need to move beyond marketing claims. For those running Lambda-heavy workloads, how does Orca's agentless approach actually perform in pinpointing vulnerabilities within function code, layers, and associated permissions? I'm particularly interested in its ability to contextualize risks within the serverless workflow itself, not just present a list of CVEs.
The total cost of ownership is a key factor. With serverless, the attack surface is dynamic. How does Orca's pricing model hold up when you have thousands of ephemeral functions that spin up and down? We want to avoid punitive scaling costs that mirror the very inefficiencies we moved to serverless to escape.
Finally, I'm concerned about vendor lock-in with these proprietary platforms. What does the data extraction and exit process look like if we need to migrate findings or shift strategies? Concrete experiences on support SLAs and the practicalities of data privacy in their handling of our cloud snapshots would be valuable.
Trust but verify — especially the fine print.
That's a really smart question about vendor lock-in. I hadn't even considered the data extraction part, I was just focused on getting a tool onboarded. Makes me wonder what happens if you need to leave, are you stuck with a bunch of unreadable reports or can you actually get your raw scan data out?
On pricing, I've heard whispers about tools charging per asset-hour, which seems like it could get wild with auto-scaling Lambda. Did the Orca rep give you a straight answer on that, or is it the usual "contact sales" runaround?
The data extraction question is the sleeper issue nobody asks until they're trying to leave. Most platforms give you pretty PDFs and a "dashboard," but the raw findings are locked in their schema. You need to check if their API exposes the actual data relationships, like which vulnerability is tied to which specific function version and layer SHA, or if you just get a flattened CSV that's useless for rebuild.
On the pricing, "contact sales" is the only answer you'll get because per-asset-hour pricing with Lambda is a financial nightmare waiting to happen. Imagine getting a bill spike because your event-driven function scaled during a marketing campaign. Any vendor serious about serverless should have a model based on static scans of deployed artifacts and periodic permission checks, not live invocation time. If they can't explain that upfront, walk away.
keep it simple
Your point about vendor lock-in is huge, and totally tracks with my experience. We ran a proof of concept with a different scanner last year and hit that exact wall. The moment we asked for a raw data dump to integrate with our own reporting, the conversation got very fuzzy.
On Orca specifically, I heard from a peer that their Lambda scanning does go fairly deep into layers and even checks for IAM drift on the attached roles, which is promising. But that contextual risk you're looking for? That's still a bit of a weak spot. You might get a CVE flagged in a layer, but the tool won't always map out if that function is publicly exposed via API Gateway, which is the real priority.
The pricing model is the real make-or-break. If they're charging per hour a function exists, run. You need a vendor that bills on scanning the deployed artifact and its configuration, not the runtime. Ask them point-blank: if a Lambda triggers 10,000 times in a day, does that impact my bill? The answer tells you everything.
Keep it simple.