An in-account alternative to Orca Security

This page answers a question about product shape. A CNAPP is one product with one console and one vendor relationship. Hanu is a stack you run yourself, plus a correlation engine whose inputs come from many places. Both architectures are legitimate, they fail in different ways, and they suit different teams. What follows is the version of that comparison you can hand to an engineer without them finding the catch.

Where the other tool wins

The list is not short, and the first item is a genuine credit rather than a concession.

• Agentless scanning, and the credit for it. Orca was early to the idea that workload and data posture can be read without installing anything on the workload, and that idea is now the industry norm. Judged on cloud coverage, Orca reads more of the estate than Hanu: ours is AWS at 366 checks, Azure at 75 and GCP at 75, with no Oracle Cloud support.
• One purchase, one console. Posture, workloads, data and identity arrive as a single product with a single dashboard and a single support relationship. Hanu covers those surfaces and then expects you to decide what else belongs in the stack.
• A managed service. No datastore to size, no upgrade window, no backup rotation, no on-call for the tool. For a team with no spare platform capacity, that is worth more than any feature on this page.
• An executive reporting surface. Benchmarks, framework views and trend reporting are built for people who present to a board. Hanu's output is a ledger of chains and their evidence, which reads well in a post-incident review and less well in a steering committee.
• Recognition. Orca is a known CNAPP brand, so questionnaires, renewals and board reporting do not need a paragraph of explanation first. We are not going to pretend that has no value.

Where Hanu fits

Hanu answers the same posture questions at lower breadth and spends its effort where a cloud scan stops: at the joins between domains.

• Deterministic correlation over typed signals. 166 typed signals land on one bus from collectors across 32 domains. 75 correlation rules work on them: 34 tier-1 rules that evaluate a signal against history and context, and 41 tier-2 rules that fuse signals from different providers inside a time window. Scoring is fixed arithmetic, and 0 LLMs sit in the detection or scoring path.
• Compound risk rather than a finding count. The unit is a chain with one owner: a workflow tamper followed by a secret exposure, a poisoned release followed by model enumeration inside seven days, a certificate chaining to an authority whose keys are recoverable. The 609 behavioural detections exist to give those chains material to form from, not to fill a queue.
• Everything inside your boundary. Eight services, your datastores, a documented minimum of 2 vCPU, 6 GB RAM and 10 GB disk, 0 bytes of telemetry egress, keys sealed with your own KMS, and an air-gap capable deployment with a signed detection bundle.
• Source-available under the Elastic License 2.0. Community is $0 in production, unlimited tenants and seats, no ingest meter. ELv2 is not OSI open source and we say so rather than blurring it - the point is that the rules deciding what matters can be read by the people accountable for them.

The reason to accept the extra operating work is the queue it produces. A misconfiguration with no reachable path stays low. The chain that starts in a registry and ends in your cloud bill is ranked. Most of the joins that make that possible cross domains a cloud scan does not read, which is the whole argument of attack path analysis.

Verdict

Choose Orca if you are a head of cloud security or a security architect who wants one CNAPP covering cloud, workloads and data, operated by the vendor and backed by a support contract - and if your estate includes cloud providers Hanu does not read, that settles it. Choose Hanu if you are a platform or SRE lead who will run the stack, if telemetry has to stay inside a boundary you can demonstrate rather than describe, or if the risks you cannot currently see arrive through CI/CD, identity and AI activity. If you have a hard residency constraint, read Orca's in-account deployment documentation as well as this page; it exists for exactly that buyer, and it is a fairer comparison than a feature table.

What platform teams ask