Orca vs Microsoft Defender for Cloud: specialist CNAPP or the one you may already own?
Cloud Security Compare editors · Matchups reviewed September 2026 · Editorial assessment
The short version
Orca Security scores higher, 4.2 to 4.0, winning agentless coverage, attack paths, code security and AI workload security. Microsoft Defender for Cloud wins runtime (through Defender for Endpoint), ecosystem and pricing transparency, where it is the only vendor in our matrix with public per-resource pricing and a free posture tier. For Azure-first teams on a budget, Defender is the default to beat.
Orca Security
4.2/ 5
Microsoft Defender for Cloud
4.0/ 5
Orca Security wins 4 criteria, Microsoft Defender for Cloud wins 3.
What is the verdict?
Defender for Cloud is the comparison every Orca buyer on Azure has to make, because part of it may already be switched on. Foundational CSPM is free, and paid Defender CSPM adds attack path analysis, agentless scanning, AI-SPM and code-to-cloud mapping, billed per resource across Azure, AWS and GCP. Orca's case is depth and consistency: agentless coverage of every workload type without choosing plans per subscription, and stronger prioritization across clouds.
How do Orca and Defender compare on each criterion?
Agentless coverage and time to value
Weight 18%
Orca: SideScanning reads workload block storage out of band and covers VMs, containers and serverless across six clouds, including Oracle, Alibaba and Tencent.
Defender: Agentless VM, secrets and Kubernetes scanning exist, but only in the paid Defender CSPM and Defender for Servers Plan 2 tiers.
Runtime protection depth
Weight 16%
Orca: The eBPF Orca Sensor adds runtime detections and can terminate processes, but it is an optional layer and less proven than runtime-first rivals.
Defender: Server runtime protection comes through Defender for Endpoint EDR across Azure, AWS, GCP and on-premises machines.
Risk prioritization and attack paths
Weight 18%
Orca: Dynamic risk scoring and attack path analysis on one data model built from full agentless context.
Defender: Attack path analysis, cloud security explorer and internet exposure analysis sit in Defender CSPM.
Code-to-cloud and AppSec
Weight 14%
Orca: SCA, SAST, secrets, IaC and image scanning with GitHub, GitLab and Azure DevOps, plus cloud-to-code tracing that opens pull requests.
Defender: Code-to-cloud mapping and agentless code-to-cloud container assessment are included in Defender CSPM.
AI workload security
Weight 12%
Orca: AI-SPM inventory, shadow AI discovery, MCP server monitoring and AI AppGen Security for apps built on AI app builders.
Defender: AI-SPM in Defender CSPM plus Defender for AI Services, billed per 1,000 tokens.
Ecosystem and integrations
Weight 12%
Orca: Covers the source-control and CI/CD tools buyers expect, but its partner and market footprint is smaller than Wiz's or the platform vendors'.
Defender: Native to Azure and Microsoft's security stack, with AWS and GCP resources covered and billed alongside Azure.
Pricing transparency
Weight 10%
Orca: No public price list; the pricing URL returns a 404 and quotes go through sales.
Defender: Foundational CSPM is free, paid plans bill per resource with a public cost calculator, and there is a 30-day free trial.
Scores are 0 to 5. The marker leans toward the stronger vendor; a gap of 1.5 or more pins it to the end. How to read these bars
What are the key differences?
| Fact | Orca Security | Microsoft Defender for Cloud |
|---|---|---|
| Deployment | Agentless SideScanning of workload block storage; optional Orca Sensor for runtime | Free Foundational CSPM; agentless scanning in paid Defender CSPM and Defender for Servers Plan 2; agent-based EDR through Defender for Endpoint |
| Runtime sensor | Orca Sensor, eBPF-based, Linux, Kubernetes and Windows; can be configured to terminate processes | Microsoft Defender for Endpoint (Defender for Servers Plan 1 and Plan 2) |
| Clouds named | AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud, Tencent Cloud | Azure, AWS, Google Cloud, on-premises via Azure Arc |
| Code security | SCM posture, SCA, SAST, secrets, IaC and container image scanning; GitHub, GitLab, Azure DevOps; cloud-to-code tracing into pull requests | Code-to-cloud mapping and agentless code-to-cloud container assessment (Defender CSPM) |
| AI security | AI-SPM (models, pipelines, training data, AI packages), shadow AI, MCP server monitoring, AI AppGen Security (unveiled ahead of Black Hat USA 2026) | AI-SPM in Defender CSPM; Defender for AI Services billed per 1,000 tokens |
| Ownership | Standalone vendor | Microsoft |
| Public pricing | Not published. Contact sales. | Published per resource on the Azure pricing page and cost calculator; Foundational CSPM free; 30-day free trial |
| Open-source project | None named | None named |
Orca Security sources: Orca platform · SideScanning · Orca Sensor · Application security · AI security · AI AppGen Security · Reviewed Sep 2026
Microsoft Defender for Cloud sources: Defender CSPM plans · Defender for Servers · Defender for Cloud pricing · Reviewed Sep 2026
Microsoft states that from 27 October 2026 Foundational CSPM becomes opt-in for new Azure subscriptions.
When should you pick Orca?
- A large share of your estate is on AWS, Google Cloud or other clouds, and you want one consistent view.
- You want agentless workload coverage without enabling paid plans resource by resource.
- You want AI security features such as MCP server monitoring and AI AppGen Security.
When should you pick Defender for Cloud?
- You are Azure-first and already use Microsoft's security stack.
- Budget predictability matters: you can model cost from Microsoft's public calculator before a sales call.
- You want server EDR and cloud posture from one vendor through Defender for Endpoint.
What do buyers get wrong about this matchup?
Teams often compare Orca against free Foundational CSPM. That is not like for like: attack path analysis, agentless scanning and AI-SPM are in the paid Defender CSPM plan, and agentless server scanning sits in Defender for Servers Plan 2. Price the plans you would actually need. Microsoft also states that Foundational CSPM becomes opt-in for new Azure subscriptions from 27 October 2026.
Frequently asked questions
Is Microsoft Defender for Cloud free?
Foundational CSPM is free. Defender CSPM and the workload plans are paid and billed per resource, and Defender for Cloud is free for the first 30 days.
Does Defender for Cloud cover AWS and Google Cloud?
Yes. Microsoft's documentation lists AWS and GCP resources, such as EC2 instances, S3 buckets and GCP compute instances, as billable resources, and Defender for Servers covers AWS and GCP virtual machines.
Is Orca better than Defender for Cloud?
Overall, slightly, in our assessment: 4.2 against 4.0. Defender is ahead on runtime, ecosystem and pricing transparency.