I've been running Orca Security in our multi-cloud production environment (AWS, Azure, a bit of GCP) for about nine months now, with the primary goal of using its agentless vulnerability scanning capabilities. After seeing a lot of marketing claims, I wanted to share what I've found actually works in practice, and where I've had to adjust my expectations.
From an audit and compliance perspective (SOC 2, ISO 27001), the agentless approach is its strongest suit for us. Here's what functions reliably:
* **Comprehensive asset discovery and persistent inventory.** It maps our cloud accounts thoroughly, giving us a single pane for vulnerabilities across VMs, containers, registries, and serverless functions. This is invaluable for audit evidence.
* **CVE correlation with runtime context.** It doesn't just list CVEs; it tells us which ones are actually exposed to the internet or have active network traffic, which helps prioritize fixes in production.
* **Image scanning in registries (ECR, ACR).** This works seamlessly and has been integrated into our CI/CD gates. The lack of an agent to manage here is a clear win.
However, "agentless" doesn't mean "effortless." Here are the key considerations and what I'd call workflow pitfalls:
* **Permission sprawl is your biggest risk.** The Orca SideScanner needs a deeply permissive IAM role/entra id app registration. You *must* treat this like a high-privilege service account. We locked it down using a just-in-time access model for the onboarding role after initial deployment, following a zero-trust principle.
* **Scan depth vs. cloud costs.** The agentless model pulls data from cloud APIs and can incur egress charges. We had to fine-tune scan frequencies for certain data-heavy services to avoid unexpected costs.
* **The "no false positives" claim needs nuance.** It's excellent for OS and language packages on compute instances. For deeper application-layer checks, we still supplement with a dedicated DAST tool.
My question to the community: For those of you using Orca or similar agentless platforms in production, how have you structured your IAM roles to balance security and functionality? Have you hit any specific compliance snags (e.g., around data residency for the data it collects) during your audits?
- Jane
Jane
Great point about the runtime context filtering being a true differentiator. That prioritization is what makes an agentless scan *actionable* in production, rather than just a giant list of CVEs.
I'd add a caveat to the seamless registry scanning, though: the scan frequency can become a bottleneck. With agentless tools pulling images from the registry API, you're often constrained by API rate limits on the cloud provider side, especially with large multi-tenant registries. We had to build a small cache layer to avoid throttling during our peak build times. So while it's agentless, it's not always "set and forget" from an operations perspective.
What's your experience been with scan latency for newly provisioned assets? We've noticed a 10-15 minute delay before they appear, which can be a gap in fast-moving, ephemeral environments.
CompareKing
Yep, the audit trail from that single pane of glass is a huge time-saver. I'd push back a bit on the "invaluable for audit evidence" though - we still have to manually tag certain assets and export specific views for our auditors. The tool's inventory is great, but it's not always formatted exactly how external compliance teams want to see it.
Have you run into issues with the scan's depth on serverless functions? I've found it sometimes misses dependencies packaged beyond the first layer in Lambda layers, which created a false sense of security.