Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Orca Security acquired Israeli cloud-security startup Opus Security on May 13, 2025, in a deal designed to move Orca beyond identifying and prioritizing cloud risk toward automated remediation and security orchestration. Financial terms were not disclosed. The acquisition gives Orca access to Opus’s remediation technology and team, but the announcement described a strategic direction—not independent proof that fully autonomous remediation was already broadly available.
The deal in brief
- Acquirer: Orca Security
- Target: Opus Security
- Announcement: May 13, 2025
- Purchase price: Not disclosed
- Strategic goal: Add cloud-security orchestration, remediation, prevention, and workflow automation to Orca’s agentless-first CNAPP platform
Orca said Opus’s team and technology would join the company. Orca’s announcement framed the transaction as a move from cloud-risk visibility and prioritization toward action powered by what it called agentic artificial intelligence.
SecurityWeek reported that Opus had raised $10 million in seed funding from YL Ventures. That figure is secondary-source reporting, and neither the acquisition announcement nor the companies disclosed a purchase price. Calcalist estimated the deal at tens of millions of dollars, but that estimate was not confirmed and should not be treated as an established transaction value.
What Opus brought to Orca
Opus was founded in 2022 by Meny Har and Or Gabay, who were members of the founding team at Siemplify, the security-orchestration company acquired by Google Cloud in 2021. Opus focused on coordinating cloud-security remediation across existing tools, teams, environments, and playbooks.
#1 Best Overall
That focus addresses a persistent problem in cloud security: finding a risk is not the same as fixing it. A platform may identify a publicly exposed storage bucket, an overprivileged identity, or a vulnerable production workload, but the security outcome depends on assigning ownership, selecting a safe response, obtaining approval where necessary, making the change, and verifying the result.
Orchestration technology can connect those steps to ticketing systems, cloud APIs, identity platforms, CI/CD tools, compliance workflows, messaging systems, and other security products. Its value is therefore not simply the ability to trigger an action. It is the ability to coordinate the right action across a complicated operating environment.
Why Orca wants to move from visibility to action
Cloud environments produce more findings than security teams can manually investigate. Prioritization helps separate urgent exposures from lower-impact issues, but prioritization alone can leave organizations with a well-organized backlog rather than a safer environment.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →The strategic product flow Orca is pursuing can be summarized as:
Rank #2
Discover → contextualize → prioritize → approve or automate → verify → roll back or escalate
Orca’s existing platform positioning emphasizes agentless visibility and contextual analysis across AWS, Microsoft Azure, Google Cloud, Oracle Cloud, Alibaba Cloud, and Kubernetes. The company’s rationale is that automation is safer and more useful when it understands asset importance, identities, exposure, workload relationships, and possible attack paths before attempting remediation.
Opus complements that context with orchestration and action. In theory, the combination could allow Orca to identify a high-risk condition, determine its likely owner and business impact, select an appropriate playbook, route the issue for approval or execute a permitted action, and confirm whether the risk was actually reduced.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What Orca said it planned to add
In its announcement and a subsequent CEO blog post, Orca described four broad capability areas:
1. More autonomous threat response
Orca gave examples such as isolating compromised cloud instances or revoking access permissions. Those examples illustrate the intended model; they do not establish that every customer receives those actions automatically or that every response can run without human approval.
2. Risk identification and remediation
The combined platform is intended to connect risk prioritization with remediation. That could reduce the time between discovering a vulnerability or misconfiguration and assigning or correcting it.
3. Workflow automation
Orca cited alert triage, compliance checks, policy enforcement, and remediation workflows. This is where Opus’s orchestration background could help coordinate security, engineering, DevOps, cloud-administration, and compliance teams.
Free tools Windows power users keep installed
One-click scans. No signup required.
4. Continuous learning and adaptation
“Continuous learning” should not be read as unrestricted self-modifying behavior or unsupervised model retraining. Buyers need to establish what actually changes over time: playbook recommendations, risk scoring, workflow routing, or something else—and how those changes are tested and controlled.
What “agentic AI” should mean to a buyer
Traditional detection identifies a suspicious condition. Conventional automation follows a predefined rule. An agentic system is intended to interpret context, select or sequence actions toward a goal, and adapt based on results or feedback.
The useful questions are operational rather than promotional:
- What decisions can the system make?
- Which actions require approval?
- What cloud and service permissions are required?
- How are actions logged, explained, and reversed?
- How does the system handle incomplete or contradictory context?
- How are false positives prevented from causing production outages?
Orca’s materials describe the agentic-AI vision, but the acquisition announcement does not provide independent deployment metrics, false-positive rates, rollback statistics, or evidence that broad fully autonomous remediation was generally available at announcement.
The hard part is safe autonomy
Automating a ticket or notification is relatively low risk. Automatically revoking permissions, changing a cloud policy, isolating a workload, or modifying infrastructure can have immediate operational consequences.
Examples buyers should test
- Public storage exposure: Can the platform identify the responsible team, propose a safe change, obtain approval, apply it, and verify that the application still works?
- Overprivileged identity: Can it distinguish a dormant role from a role actively used by a production service before removing access?
- Critical vulnerability: Can it recommend compensating controls when immediate patching is impossible?
- Kubernetes misconfiguration: Can it determine whether a fix could disrupt a live service, admission controller, or deployment pipeline?
- Conflicting evidence: What happens when a scanner reports a critical issue but runtime context suggests the exposure is unreachable?
- Failed remediation: Is there an automatic rollback, human escalation path, and durable audit trail?
- Compromised automation credentials: What limits prevent an attacker from abusing the remediation engine?
- Incomplete inventory: Can the system safely act when it lacks visibility into an account, subscription, cluster, SaaS dependency, or shadow workload?
Controls that matter
Enterprise buyers should look for least-privilege roles, narrowly scoped permissions, approval gates, maintenance-window support, change simulation, strong authentication, action-level logging, rollback procedures, and the ability to disable or constrain individual playbooks.
They should also ask how the system handles policy exceptions. A security recommendation may conflict with a documented business exception, a compliance waiver, or an application dependency. Safe automation must preserve those decisions or escalate the conflict rather than blindly enforcing a generic rule.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Competitive implications
The acquisition reflects a broader shift in cloud security. Vendors increasingly compete not only on discovery and posture management, but also on attack-path analysis, runtime protection, identity risk, workflow integration, and native remediation.
Recommended Free Tools
| Platform | What to compare |
|---|---|
| Orca Security | Agentless-first visibility, contextual risk prioritization, multi-cloud coverage, and the maturity and control boundaries of remediation automation added through Opus. |
| Wiz | Agentless cloud visibility, attack-path analysis, CNAPP breadth, and remediation workflow depth. |
| Palo Alto Networks Prisma Cloud | Platform breadth, runtime controls, code and application security, and fit for organizations already using Palo Alto Networks. |
| Microsoft Defender for Cloud | Azure and Microsoft-security integration, multi-cloud depth, licensing dependencies, and operational fit. |
| CrowdStrike Falcon Cloud Security | Cloud posture, workload and runtime protection, identity context, and consolidation with endpoint security. |
| Tenable Cloud Security | Exposure management, configuration analysis, identity risk, and remediation workflows. |
| Rapid7 InsightCloudSec | Cloud posture management, automated response workflows, governance controls, and integrations. |
| Fortinet FortiCNAPP | CNAPP capabilities within the wider Fortinet Security Fabric. |
| Qualys TotalCloud | Cloud-native depth and remediation automation for organizations already using Qualys vulnerability and compliance products. |
Orca has described the combined company as the first CNAPP to identify, prioritize, remediate, and prevent risks autonomously. That is a company claim, not an independently established industry ranking. Comparisons should focus on documented capabilities, control design, integrations, and measured outcomes rather than the “agentic” label.
Buyer checklist
Before selecting Orca or an alternative platform, ask vendors:
- Is the relevant capability generally available, in preview, managed by the vendor, or limited to a particular plan?
- Which actions can run automatically, and which require human approval?
- What permissions and roles must be granted in each cloud?
- Can every automated action be reversed, and how quickly?
- Which ticketing, SIEM, SOAR, CI/CD, identity, and messaging integrations are supported?
- How are exceptions, maintenance windows, and conflicting policies handled?
- Can customers export complete decision and action logs?
- How are AI recommendations explained to reviewers?
- What happens if an integration, cloud API, model, or automation credential fails?
- How is customer data used, stored, and protected, including any AI-training restrictions?
- What is the pricing unit—assets, workloads, identities, accounts, data volume, or modules?
- Did the acquisition change Opus’s product, support, pricing, or migration path?
Orca’s commercial path is primarily sales-assisted: buyers can request a personalized demo. Orca also promotes an AWS trial path, but the reviewed acquisition materials did not disclose acquisition-specific pricing. Buyers should request current availability, pricing, and contractual details rather than assume that a promised roadmap capability is included.
Bottom line
Orca’s acquisition of Opus strengthens its position in the move from cloud-security observation to automated response. The product logic is clear: Orca supplies cloud context and prioritization, while Opus adds orchestration and remediation workflows. But the deal’s value depends on safe permissions, reliable integrations, approval and rollback controls, and measurable reductions in remediation time. “Agentic AI” is a useful description of the ambition—not proof that every cloud risk can already be fixed autonomously.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
