What Orca Security added on November 10 and how cloud teams can pilot service fingerprints, agent relationships and generated-code provenance without automating remediation.

What Orca changed on November 10

Orca Security expanded its unified cloud-security platform to discover shadow AI applications through service fingerprints, inventory cloud-managed and self-hosted agents, map their relationships and access, attribute AI-generated code, and bring security checks into coding-agent workflows. The company’s announcement names AI application builders and services including Lovable, v0, Replit, Base44, Bolt, Vercel, Netlify and Supabase, plus coding agents such as Claude Code, Codex and Gemini CLI.

The new Agents tab in Orca’s AI Bill of Materials is intended to connect agents with the models they use, MCP servers and tools they call, cloud identities they operate under and data stores they can reach. Help Net Security reported the expansion on November 11. Capabilities and completeness are vendor claims; the reviewed pages provide no independent detection benchmark, customer result or public list price. Orca directs prospects to contact the company for a personalized demo.

Relationship graph connecting an AI application to models, repositories, tools, cloud identities and data stores
Explanatory graph based on announced relationship categories; it is not Orca UI or a customer finding.

Who can use it and what the pilot requires

The expansion is part of the Orca Security Platform and is relevant to current customers and organizations evaluating the platform. The announcement says Orca uses agentless SideScanning and does not require an additional workload agent, employee registration or a separate integration for every discovered builder. Exact packaging, plan entitlements and pricing were not published in the reviewed sources; confirm them directly before planning a rollout.

A responsible pilot still needs cloud account authorization, a current asset and identity inventory, repository ownership data, data classifications, an AI use policy, change management, a false-positive process and named reviewers from cloud security, application security, development and privacy. Start with non-production accounts or a limited set of production accounts where owners are prepared to validate findings.

Conceptual illustration of a security team bringing unknown AI applications and agents into a governed inventory
Original AI-generated conceptual illustration; the services, inventory and findings are fictional.
  • System of record: cloud provider, identity platform, repositories and approved service catalog.
  • Feature role: discover signals, connect relationships and prioritize review candidates.
  • Human role: confirm ownership, business purpose, risk, remediation and exceptions.
  • Stop condition: unclear authorization, sensitive employee monitoring, incomplete account coverage or automated change.

Step 1: begin with read-only discovery

Connect only the approved accounts and repositories for the pilot. Record the connector scope, collection method, permissions, expected signals, retention and owner. Disable or exclude automated remediation. Capture a baseline export before review so later changes can be explained.

Service fingerprints may include DNS pointers, packages, file markers, builder commit identities and cloud permissions. Treat each as a lead, not proof that an application is unauthorized, vulnerable or AI-generated. Require an asset owner to confirm the service, purpose, environment and lifecycle status.

Step 2: verify relationships before ranking risk

For each confirmed agent or AI-built application, map the model and provider, MCP servers and tools, cloud identity, permissions, repository, deployment, reachable data stores, data sensitivity and human owner. Distinguish configured access from observed use. A broad role establishes possible reach; it does not prove that the agent accessed every permitted resource.

Example review prompt for an approved internal assistant: “Using only inventory records AI-300 through AI-340, list confirmed relationships, possible paths and missing ownership data. Cite record IDs for every statement. Separate configured permission from observed access. Do not infer employee intent, label a service unauthorized, change cloud policy, open a pull request or remediate a finding.”

Conceptual illustration of cloud security and development teams reviewing an agent path through tools, identity and data
Original AI-generated conceptual illustration; the access path and approval controls are fictional.
  • Expected output: a cited ownership and reachability queue.
  • Validate every relationship against the authoritative source.
  • Prioritize autonomous tools plus broad identity plus sensitive data.
  • Route suspected secrets or customer data to established incident handling.

Step 3: use four gates for the pilot

Gate one is discovery accuracy: sample findings and record confirmed assets, duplicates and false positives. Gate two is ownership: assign a business and technical owner plus a documented purpose. Gate three is risk: review identity reach, tool authority, data sensitivity, network exposure and generated-code path. Gate four is governance: approve a remediation, exception or decommission plan with rollback and evidence.

Do not measure success by the number of alerts. Measure confirmed coverage, owner assignment, time to validate, high-risk paths resolved, false-positive burden, unauthorized changes prevented and residual unknowns. Keep any automated pull request, cloud policy change or service disablement outside the initial pilot.

Four gates for shadow AI discovery, owner verification, risk prioritization and human governance
Explanatory pilot: inventory findings become actions only after verification and named approval.

Step 4: treat code provenance as context, not proof

Orca says the platform can attribute code to the coding agents and models that produced it and identify which contributors are associated with more security risk. Use provenance to route review and reproduce the development path. Do not infer that AI-generated code is insecure, or that human-written code is safe, from authorship alone.

Link provenance to a commit, repository owner, security finding, evidence, reviewer, disposition and verification. If the AI Skills Hub places requirements, scanning and remediation into a coding agent, keep branch protection, tests, independent review and merge authority outside the agent.

Review loop connecting coding-agent provenance to commits, security scans and human disposition
Explanatory loop: provenance improves traceability but cannot establish code quality or safety by itself.

Realistic limitations

Agentless discovery depends on the cloud accounts, repositories, telemetry and permissions connected to the platform. Unsupported builders, local development, encrypted traffic, renamed artifacts, incomplete identity data or off-cloud services can create gaps. Fingerprints can be stale or ambiguous, and a relationship graph can overstate risk if configured permission is mistaken for observed activity.

The reviewed announcement does not publish exact availability by plan, price, detection coverage, false-positive rates or an independent customer benchmark. This article did not test Orca, SideScanning, Service Fingerprints, the AIBOM Agents tab or AI Skills Hub. Verify licensing, data handling, regional support, integrations, permissions, detection accuracy and rollback in your own environment.

Why this feature was selected

A focused Firecrawl search on November 12 for “Orca Security AI-generated applications autonomous agents digital fingerprints cloud November 2026” returned Orca’s November 10 primary announcement prominently, followed by November 11 independent coverage from Help Net Security and additional current reporting. The breadth and recency show active public attention, not Google rank, search volume or traffic. The practical gap was a bounded rollout that turns a new relationship inventory into verified work without treating discovery as authorization to remediate.

Put the insight into practice.

Deep Security helps organizations assess risk, validate controls, and build a practical plan to strengthen their defenses.

Talk with Deep Security