Cloud Detection & Response

Orca Security Platform provides around-the-clock monitoring of cloud provider logs and threat intelligence feeds. Orca ingests this information and integrates it with our insights into existing risks across the cloud estate and the location of an organization’s most critical assets. This enables Orca to quickly detect potentially dangerous events that require immediate attention. 

With Orca’s CDR solution, you can detect, investigate, and respond to in-progress cloud attacks:

1. Detect: Get prioritized alerts about events that endanger your most critical assets. 
2. Investigate: Gain quick insights into security events, including whether they’re malicious and if they threaten your critical assets.
3. Respond: Remediate in-progress cloud attacks quickly with automated remediation steps and integrations.

Orca detects and prioritizes a broad range of cloud security risks, including vulnerabilities, misconfigurations, malware, lateral movement risk, sensitive data at risk, API risks, AI risks, overprivileged identities, and more.

Unlike solutions that simply report on the severity of each siloed security issue, Orca’s multi-dimensional approach prioritizes risks based on a consolidated assessment against multiple factors:

• Severity: What type of threat is it? What is the CVSS and EPSS score?
• Exploitability: How easy is it for someone to exploit this risk?
• Accessibility: Is the asset public facing? Is there a lateral movement risk?
• Business impact: Is the asset business-critical? Does it contain PII or is it adjacent to assets that do?

Alternative solutions to CDR include: 

• Endpoint Detection and Response (EDR): EDR solutions treat endpoints as potential attack vectors. They use agents to record endpoint activity and identify potential threats, and rely on anomaly detection, machine learning, and other approaches.

• Network Detection and Response (NDR): NDR detects threats by analyzing organizational network traffic. NDRs look for potential threats based on anomalous or unauthorized protocols, port utilization, odd timing and transfer sizes, and more.
• Threat Detection & Response (TDR): TDR typically gathers information most relevant to a current threat. Endpoint TDR tools record data about an identified threat or analyze if an event or process constitutes a threat. Analytical TDRs leverage existing data and apply analytics to identify threats.
• Extended Detection & Response (XDR): XDR platforms detect threats by ingesting endpoint agent data, network level information, and device logs. 

However these solutions don’t offer any actual cloud telemetry like CDR does and are siloed tools without any contextual insight into the existing cloud environment risks. Therefore these tools tend to have a higher rate of false positives since they cannot accurately assess the danger of certain actions.

Most organizations deploy five or more siloed security tools, many of them agent-based. This leads to alert fatigue, with a constant stream of (possibly duplicate) alerts that lack context and provide little insight into how and where to respond to the most critical threats. Agent-based security solutions are tedious to deploy and maintain, and only offer partial coverage. New agent installations are continually needed as the cloud environment grows, making it virtually impossible for security teams to keep up with DevOps.

As opposed to other solutions, the agentless-first Orca Platform deploys across your cloud estate in minutes, automatically discovers new assets as your environment expands, and has zero impact on your workloads. And Orca’s context-aware engine separates the 1% of alerts that demand quick action from the 99% that don’t, enabling security teams to avoid alert fatigue and fix the truly critical security issues before attackers can exploit them.