ORNA

The company has layered tabletop-exercise tooling, an MDR offering, and integrations with 28+ threat intelligence sources onto its original incident-response workflow product within a few years of founding, showing consistent feature expansion for a small team.

As a seed-stage company with an estimated 11-50 employees, ORNA has modest operational scale; the company reports serving 450+ organizations across 11 countries, which if accurate reflects reasonable traction for its stage but has not been independently verified.

Expansion from a pure incident-response SaaS tool into MDR and tabletop-exercise services suggests the company is actively iterating on its offering, though public funding events since its seed round are not well documented.

SOAR and incident-response orchestration is an established category dominated by larger platforms; ORNA's differentiation is packaging SANS-aligned incident response and tabletop exercises specifically for SMB/mid-market budgets and staffing levels rather than introducing a fundamentally new technique.

No independent third-party evaluation, MITRE-style test, or named enterprise case study was found in public sources; the customer count and country-reach figures are self-reported by the company, so efficacy evidence here is limited.

Structured, rehearsed incident response is a genuine and growing need for resource-constrained security teams, making this a relevant tool for the SMB and mid-market segment specifically, though less relevant to large enterprises with mature SOC/SOAR investments already in place.