Orca Security

One prompt. One full-stack app. Shipped before anyone checks it. That’s how citizen developers work now. And the attack surface is growing with them. Half of organizations already use AI to build software, according to our State of AI Security Report. So what’s changed since then? Roi Nisimi and Yonatan Levi from the Orca Research Pod join Ron Edding of Hacker Valley News to cover: 🔹 What’s new in the AI threat landscape 🔹 How citizen developers are changing the attack surface 🔹 How far the damage can spread 📅 Thursday, Oct 22 | 🕚 11:00 AM – 12:00 PM GMT+1 Save your seat 👇 https://lnkd.in/gYz6kzHW

How do you secure the cloud behind 2,500+ restaurants when native tools give you no single view? That was Jubilant FoodWorks Ltd.’s challenge. With 95% of their apps on AWS, every service needed its own navigation, and a new exposure could go unnoticed until the team happened to check. Today they detect issues 30% faster, and they prioritize vulnerabilities by real exposure. The full story, including how they handled an industry-wide supply-chain incident in minutes: https://lnkd.in/g_bzkynk

Excited to share new enhancements to Orca Security’s integration with Zscaler Private Access (ZPA). As cloud environments evolve, understanding how cloud assets map to an organization’s Zero Trust strategy is increasingly important. With the enhanced integration, Orca can ingest ZPA application segments and map them against the private network data of cloud workloads discovered by Orca. Matching assets are automatically labeled, making it easier for security teams to see which cloud assets are published through ZPA and identify areas that may warrant further review. Orca also brings ZPA trusted network context into exposure analysis, helping distinguish trusted ZPA-managed traffic from untrusted exposure paths, reduce alert noise, and accelerate triage. More to come as we continue building on the Orca + Zscaler partnership. #OrcaSecurity #Zscaler #ZPA #ZeroTrust #CloudSecurity #CNAPP

Ask for a network map and you usually get one of two things: an audit diagram from two years ago, or a firewall export. Both describe intent. Neither tells you what someone on the internet can actually reach today. Our new post walks through building a network map with an Orca Custom Agent. It follows the full network path to every asset, rates exposure port by port, and reruns weekly so you see what changed. https://lnkd.in/gWnF5z8V

We tested NVIDIA Nemotron 3.5 Super VL, an open, customizable multimodal model now available on Hugging Face. Here's what we found: https://lnkd.in/g_EGVeQS

Running self-managed GitLab 19.2 through 19.4? There’s a critical fix to apply. CVE-2026-97229 lets someone run code on the server by adding a specially crafted line of text to a project file. On setups that allow public project creation or open sign-ups, no login is required. Our Research Pod covers affected versions and mitigation steps: https://lnkd.in/gVw-MC-Y

Your scanner says one thing. Your team’s spreadsheet says another. And nobody can explain why a finding was scored the way it was. Custom Agents in Orca fix that by applying your own vulnerability scoring model inside the platform, on every alert. Maybe your team bumps anything on the CISA KEV list, or ranks internet-facing assets above internal ones. Our new blog shows how to turn rules like those into an agent that applies them automatically. Every score change is logged on the alert: the original score, the new one, which agent changed it, and why. So anyone can check the work. See how it works: https://lnkd.in/gQ_2h3yQ

“This bucket is public” is a finding. “This bucket is public, it sits in the Payments business unit, it’s a crown jewel, and your SLA says it’s due in 7 days” is a plan. The difference is context. Who owns it. How critical it is. What your SLA says. That context usually lives in spreadsheets and in people’s heads. So every alert waits for someone to add it by hand. Orca Custom Agents let you write those rules in plain language and apply them on every run. Here’s how: https://lnkd.in/grMeSpun

Building an app used to take an engineering team. Now it takes an afternoon. That’s great for the business but a challenge for the security team that usually hears about it last. At The Builder Exchange, Gil Geron, Troy Hunt, and security leaders from Blue Yonder, IDC, and Cimpress share new research and real stories on how teams are keeping up. 📅 Nov 4 | 9AM PST | Online Register here: https://lnkd.in/gpe_qTMr

Happy Orc-tober! 🫍🎃 Spooky season is here, and this year the cloud has plenty of its own stories to tell. This month, we're looking at what's really lurking out there, from the scariest AI security stories of 2026 to what's coming in 2027. And if you want the full story, we're getting into it live at The Builder Exchange on Nov 4. https://lnkd.in/gpe_qTMr