Orca Security Due Diligence

Run due diligence on Orca Security: check compliance and get alerts when suppliers or ownership change.

United States · owned by Independent (United States) · orca.security · 35 vendors

Orca Security is an AI-powered cloud security platform and Cloud-Native Application Protection Platform (CNAPP) that provides comprehensive security coverage across multi-cloud environments. The company uses agentless technology to detect vulnerabilities, misconfigurations, and threats across cloud workloads from build to runtime. It serves enterprises seeking unified visibility and protection across AWS, Azure, Google Cloud, and other cloud providers.

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 35 sub-vendors.

Insights

Last updated 2026-05-05 · revision 6

35 direct vendors, 279 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

5 in-scope frameworks identified; showing 3.

GDPR (source) — Evidence found

Evidence: https://trustcenter.orca.security/, https://orca.security/privacy-policy/

ISAE 3000 (source) — No public evidence

SOC 2 (source) — Evidence found

Evidence: https://trustcenter.orca.security/, https://orca.security/

Financials

Three-year financials

Financial Resilience Score: 6/10

Orca Security is a venture-backed private company with strong cash reserves from approximately US$700M+ raised across Series A–E rounds, supported by top-tier investors including GGV Capital, ICONIQ Growth, CapitalG (Alphabet), Redpoint, and Temasek. The company has built a diversified enterprise customer base (SAP, Autodesk, Lemonade, Carlsberg, RSA Security, etc.) and holds key compliance certifications (FedRAMP Moderate, SOC 2 Type II, ISO 27001) that open both regulated commercial and US-Government markets. Its differentiated agentless SideScanning™ technology and hyperscaler partnerships (AWS Strategic Collaboration Agreement, Azure, GCP) provide commercial defensibility. However, financial resilience is constrained by intense competition in the CNAPP space, particularly from Wiz (acquired by Google for $32B in 2025), Palo Alto Prisma Cloud, CrowdStrike, and Microsoft Defender for Cloud. The valuation has remained flat at ~US$1.8B since the October 2021 Series C, signaling that ARR growth has not kept pace with original investor expectations. Two reported rounds of layoffs (2023 and 2024) and a CEO transition reflect belt-tightening. With no audited financial statements, no disclosed EBIT, and presumed material cash burn typical of venture-stage SaaS, plus no announced IPO path, the company's resilience depends on continued investor support and execution against well-funded competitors.

Key strengths: Approximately US$700M+ total funding raised across Series A–E, Marquee enterprise customer base diversified across geographies and verticals, Patented agentless SideScanning™ technology reducing onboarding friction, Strategic Collaboration Agreement with AWS (March 2026) and strong hyperscaler partnerships, Comprehensive compliance certifications (FedRAMP Moderate, SOC 2 Type II, ISO 27001, IRAP, PCI), Product breadth expanded via M&A (RapidSec 2022, Opus Security 2025), Top-tier investor syndicate (GGV, ICONIQ, CapitalG, Redpoint, Temasek)

Risk factors: Intense competition from Wiz (Google), Palo Alto Prisma Cloud, CrowdStrike, Microsoft Defender for Cloud, Flat valuation at ~US$1.8B since 2021 Series C indicates decelerating growth vs. expectations, Two reported rounds of layoffs (2023 and 2024), No audited financial statements or disclosed EBIT/revenue figures, No publicly announced IPO path; liquidity dependent on IPO window or strategic sale, Patent lawsuit against Wiz creating distraction, Presumed material negative EBIT typical of venture-stage SaaS, Cash-burn opacity for lenders and partners

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report