Orca lawsuit highlights CNAPP consolidation

The lawsuit mattered because it showed how little room there was for product or sales mistakes in agentless cloud security, where Wiz and Orca were chasing the same large enterprise budgets with very similar workflows. Both products let security teams connect AWS, Azure, and GCP accounts without installing agents, then rank risky identities, workloads, APIs, and misconfigurations in one console. That makes speed of execution, enterprise sales reach, and product breadth decisive.

• Orca made the dispute unusually broad. The July 2023 Delaware case alleged patent infringement, trade secret misuse, and copied go to market playbooks, not just overlapping features. That reflected a fight over who defined the agentless cloud security category, not a narrow patent skirmish.
  3 justia 4 securityweek
• Wiz still widened the gap commercially. By July 2024, Wiz was estimated at $500M ARR, versus Orca at roughly $50M revenue in late 2023. In practice, Wiz won by selling a bigger platform into Fortune 500 security teams, then expanding from posture management into identity, runtime, and developer security.
  1 sacra 2 sacra 5 sacra
• The legal fight did not stop category consolidation. By late 2025, reporting indicated Orca had suffered a patent setback, and in January 2026 the companies agreed to dismiss all claims. The market moved on to scale, platform bundling, and distribution, which favored the company with stronger enterprise adoption.
  6 calcalistech 7 calcalistech

This market is heading toward fewer, broader cloud security platforms. The winners will be the vendors that become the default control plane for cloud risk across infrastructure, identities, applications, and developer workflows. The Orca fight was an early sign that CNAPP would consolidate around execution and platform depth more than around any single scanning technique.