Orca SecurityNxSCORE with Orca.
Orca finds the risks across your cloud estate. NxSCORE works alongside it on what happens after an alert: sorted by cause, a verdict with its evidence, a fix your engineers run, a guardrail so it stays fixed, and the evidence your auditors ask for.
You will recognise this if
- Orca raises the alerts, and the same ones are back after the next release.
- Nobody can say which open alerts already have a decision behind them.
- Some of your accounts were never added, and nothing tells you which.
- The auditor’s list is mostly policies and reviews that no scanner reads.
What NxSCORE reads from Orca, and what it never touches.
Orca stays your scanner. NxSCORE reads what it already knows, so it only scans what nothing else covers, and it never changes anything in Orca.
| NxSCORE reads | NxSCORE never |
|---|---|
| Policies, and which are switched on | Never changes a policy in Orca |
| Alert rules, and which accounts they cover | Never creates or edits a rule |
| Compliance standards and their requirements | Never dismisses or resolves an alert |
| Cloud accounts and how they are grouped | Never writes anything back |
| Open alerts, and 90 days of resolved ones | Never sees your workloads’ data |
How NxSCORE sits beside Orca.
Three things happen in the first days. None of them changes your cloud, or your CNAPP.
- 01
Connect Orca with a read-only key.
Your team creates a read-only API token in Orca and enters it once. It is encrypted as soon as it arrives and never shown again.
NxSCORE reads Orca the same way it reads any CNAPP: its policies and rules, compliance frameworks, cloud accounts and open alerts, once a day, with 90 days of resolved alerts on the first sync.
Orca, first syncConnectedCloud accounts 48 Open alerts 2,140 Resolved alerts read, last 90 days 3,620 Of those, came back after a fix 408 - 02
Coverage worked out control by control.
For each control, NxSCORE looks at whether Orca checks it, and for which accounts.
Whatever Orca does not check, the NxSCORE scan does. Whatever no scanner can check, such as a quarterly access review, is met with evidence your analyst accepts.
Who checked itExample- S3 buckets block public accessOrca
Orca checks it, and an alert rule covers every account.
- EC2 instances require IMDSv2Orca and NxSCORE
Both see the same failing setting. One finding, not two.
- Unused IAM roles removed after 90 daysNxSCORE
No Orca policy is switched on for it, so the NxSCORE scan checks it.
- Access reviewed each quarterEvidence
No scanner can check it. Your team uploads the review and an analyst accepts it.
- 03
Every account accounted for.
NxSCORE matches the accounts in your cloud organisation with the accounts Orca monitors. One that Orca has switched off, or never had, is listed by name, and scanned where NxSCORE has its own read-only role.
An account nobody can read is shown as not scanned. It never appears in a report as passing.
AccountsExample- prod-paymentsCovered by your CNAPP
- data-lakeScanned
- sandbox-17CNAPP only, not scanned
- dr-siteAccess denied
Then the work after the alert.
What happens after Orca raises it.
This is the part a scanner leaves to your team. With NxSCORE, an analyst does the preparation and your people make the decisions and the changes.
- 04
A verdict before anyone touches it.
Before a fix is suggested, NxSCORE reads how the resource is used: what a security group is attached to, when a key was last used, who created it. The verdict comes with its reason, so your engineers can check it.
Findings are grouped into issues, ordered on the Priorities page, and given an owner from the resource’s tags and a fix-by date from its severity. How a backlog is sorted.
Is it safe to fix?Example- Access key for svc-reportingSafe to fix
Last used 214 days ago.
- sg-payments-edgeCheck first
Attached to two network interfaces behind the load balancer.
- 05
A fix kit your engineers run.
For a safe fix, NxSCORE writes the script, with its check, apply and rollback in one file. Your engineers run it. NxSCORE’s access stays read-only.
A finding closes only when a later assessment, or Orca, no longer sees the problem. How fixes are kept safe.
Fix kit: S3 buckets that allow public access- CheckLists every change it would make. Changes nothing.
- ApplyAsks before it acts, in your change window.
- RescanClosed when NxSCORE, or Orca, no longer sees it.
- 06
A guardrail, so it does not come back.
When Orca raises the same issue again and again, your analyst writes a prevention plan aimed at its source. Your team agrees it and makes the change.
NxSCORE marks the plan verified after 14 days with no new findings from Orca or from its own scan.
Prevention planVerified - 07
Evidence for the requirements no scanner can check.
Each requirement is met by checks, evidence or both. Findings from Orca count towards the checks. Your team uploads the rest once, and your analyst accepts it.
PCI DSS 4.0.1Example- Settings Orca and NxSCORE checkChecks
- Policies, reviews and training recordsEvidence
Questions about NxSCORE with Orca.
Does NxSCORE replace Orca?
No. NxSCORE works with Orca. Orca stays your scanner. NxSCORE reads what it finds, checks what it does not, and runs the work after the alert with your team.
Does NxSCORE change anything in Orca?
No. It reads policies, alert rules, compliance standards, accounts and alerts with a read-only key. It never dismisses an alert, edits a policy or writes anything back.
Will we see every finding twice?
No. When Orca and the NxSCORE scan report the same failing setting on the same account, it is one finding, marked as found by both.
Orca already scores risk. How does NxSCORE decide the order?
It starts from Orca’s severity and adds what happens after a fix: whether the issue came back, whether it is past its fix-by date, and which compliance requirements fixing it would clear.
Do we need to deploy anything new in our cloud?
NxSCORE needs a read-only role in each cloud account it scans, so it can check what Orca does not and read the usage evidence behind a verdict. It adds no agents to your workloads. Every permission is listed on the access page.
Keep Orca. Add the work after the alert.
Connect Orca and one cloud account. After the first assessment, your analyst shows you how your open alerts sort by cause, which ones came back after a fix, and what Orca leaves unchecked.