Overview

Product video
Lacework FortiCNAPP empowers teams to quickly identify, prioritize, and remediate code vulnerabilities, cloud misconfigurations, and overprivileged identities more efficiently, safeguard business continuity through rapid detection, investigation, and resolution of active threats like compromised credentials, streamline security operations, to do more with less, while maintaining the highest security standards and continuously comply with evolving regulations and industry best practices.
Our data-driven platform never stops learning. It automatically visualizes complex relationships between entities, events, and vulnerabilities, correlates build and runtime data for deeper insights and uses patented analytics to understand normal behavior within your environment. It notifies you to significant changes and provides highly actionable alerts, all without requiring you to create and maintain static, rigid rules.
Whether your applications run in a single cloud, across multiple clouds, in a hybrid environment, or use containers and Kubernetes, Lacework FortiCNAPP delivers the right alerts to the right people at the right time to protect your applications, data and business.
Lacework is a more comprehensive alternative to products from companies like Palo Alto Networks, Wiz, Aqua, Orca, Snyk, Sysdig, and CrowdStrike and offers key features such as:
CODE SECURITY - Lacework FortiCNAPP offers integrated code security with SCA, SAST, and IaC security. It continuously monitors runtime application behavior to identify active, exploitable vulnerable packages versus inactive ones with lower risk.
CSPM/KSPM - Lacework FortiCNAPP provides robust CSPM and KSPM to ensure cloud service usage aligns with regulatory guidelines and best practices like CIS Benchmarks for AWS and AWS FSBP. To help prioritize risks, Lacework FortiCNAPP attack path analysis visualizes how attackers could exploit misconfigurations, showing the interconnected risks of a host or container, such as internet exposure, critical vulnerabilities, misconfigurations, exposed secrets, and privileged IAM roles.
CIEM - Lacework FortiCNAPP provides Cloud Infrastructure Entitlement Management (CIEM) for complete visibility into AWS IAM users, groups, roles, policies, entitlements, and machines (EC2). It automatically discovers identities, assesses net-effective permissions, and highlights excessive ones by comparing granted and used permissions.
BEHAVIOR ANALYTICS - Lacework FortiCNAPP continuously monitors AWS workloads for unusual behaviors, like compromises by comparing past and present states to detect anomalies. With over 100 patents, our approach ensures faster detection, quicker responses, and improved security.
COMPOSITE ALERTS - Lacework FortiCNAPP is unique in detecting early signs of active attacks by automatically correlating various alerts into a single, high-confidence composite alert. This alert provides detailed context and evidence of suspected attacks for further investigation. Lacework FortiCNAPP uses behavioral analytics, anomaly detection, in-house threat intelligence, and insights from AWS CloudTrail and GuardDuty to identify active attacks, including compromised credentials, ransomware and cryptojacking.
Contact AWSsales@fortinet.com for more information, a demo, or to discuss a private offer.
Are you concerned about the security of your cloud environment? Our expert cloud consulting services can help you implement security best practices, identify vulnerabilities, ensure compliance and protect your data from potential threats.
https://aws.amazon.com/marketplace/pp/prodview-bnqdxtusyye5qÂ
https://aws.amazon.com/marketplace/pp/prodview-ua74gq5f72fcqÂ
Highlights
- Gain comprehensive, continuous visibility into your AWS assets, applications, and users, enabling you to identify, measure, prioritize, and address associated risks faster and more efficiently
- Ensure business continuity by rapidly detecting, investigating, and resolving active attacks - such as compromised credentials, ransomware, and crypto-jacking to protect critical applications, services, and data
- Do more with less by streamlining security processes while maintaining high standards. Reduce cloud security costs by consolidating multiple siloed tools into a single platform and improve time-to-value with automated, easy-to-deploy and DevOps-friendly cloud security at scale
Details
Unlock automation with AI agent solutions

Features and programs
Buyer guide

Financing for AWS Marketplace purchases
Pricing
Free trial
Dimension | Description | Cost/12 months |
---|---|---|
Lacework Standard starter pack | Standard starter pack. Up to 500 vCPUs | $25,000.00 |
Lacework Pro starter pack | Pro starter pack. Up to 334 vCPUs | $25,000.00 |
Lacework Enterprise starter pack | Enterprise starter pack. Up to 250 vCPUs | $25,000.00 |
Vendor refund policy
No refunds
How can we make this page better?
Legal
Vendor terms and conditions
Content disclaimer
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Support
Vendor support
Fortinet FortiCare support offerings provide global support and deliver best-in-class support services. With FortiCare support, customers can be assured that their Fortinet security products are performing optimally and protecting their corporate assets. https://support.fortinet.comÂ
Let Fortinet cloud experts help you successfully adopt and operationalize Lacework FortiCNAPP to secure your hybrid and public cloud environments.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.

Standard contract
Customer reviews
FortiOS review
The best OOBE and ease of use
Firewall administator with FortiGate experience
Easy installation
Customer Support
Mac Binding in WiFi
Best User - Friendly Security Features
- Easy to find documentation / forums to find any setting you need
- Forti has a family of features / devices / services you can integrate it with to be able to expand the capabilities
- The logs are not easy to understand at first glance
- InterVlan Routing
- DPI
- WebFilter
- AD Integrated Security Features
- DHCP
- NTP Server
- Network Policies
Helps to scan all of IAC scripts and configurations across our AWS and GCP environments
What is our primary use case?
We use the tool for two main purposes: vulnerability management and monitoring. We utilize it to scan all of our IAC scripts and configurations across our AWS and GCP environments. Additionally, we employ its agent to scan our compute nodes. This covers three main areas: cloud configuration, host systems, and IAC code, all essential for vulnerability management. We primarily focus on monitoring AWS CloudTrail to detect anomalous activities and risky behavior.
What is most valuable?
I find the cloud configuration compliance scanning mature. It generates a lot of data and supports major frameworks like ISO 27001 or SOC 2, providing reports and datasets. Another feature I appreciate is setting custom alerts for specific events. Additionally, I value the agent-based monitoring and scanning for compute nodes. It gives us deeper insights into our workloads and helps identify vulnerabilities across our deployed assets.
One key aspect of the agent that stands out is its capability to distinguish between active and inactive packages on compute nodes. This feature reduces the number of actionable vulnerabilities by focusing on packages actively running in the environment rather than all installed packages.
I noticed that it was quite noisy, with many alerts about things I wasn't particularly concerned about. However, over time, Lacework's anomaly detection improved by establishing baselines of normal activity. It now alerts us only when there are deviations from these baselines. Integrating with Slack was especially beneficial—I set up a dedicated Slack channel just for Lacework alerts. This allowed me to focus on the alerts that required attention.
What needs improvement?
The solution lacks a cohesive data model, making extracting the necessary data from the platform challenging. It uses its own LQL query language, and each database across different layers and modules is structured differently, complicating correlation efforts. Consequently, I had to create extensive custom reports outside Lacework because their default dashboards didn't communicate risk metrics. They're addressing these issues by redesigning their tools, including introducing the dashboard, which is a step closer to actionable insights but still needs refinement.
Regarding reporting features, the ability to create granular custom alerts remains limited. For instance, I could only filter alerts by source or type rather than selecting alerts based on specific IDs. This lack of granularity in alert management and reporting customization is a notable drawback.
For how long have I used the solution?
I have been using the product for one and a half years.Â
What do I think about the scalability of the solution?
The solution is scalable. I rate it a nine out of ten.Â
How are customer service and support?
One thing I appreciated about Lacework was the support I received from their team. I regularly met with them to provide feedback on what worked well and what didn't in their modules. They took my feedback seriously, often implementing it into features, hotfixes, and interface changes. Part of the reason for this was my clear and detailed communication style.
While some customers might say, "This sucks," I made sure to explain exactly why and how I would suggest fixing it. This approach was well-received by their product managers, who valued my input. As a premium customer, I have access to account managers. Its support is very good.Â
Sometimes, the support process was quite slow. While they acknowledged my tickets promptly, resolving issues could take weeks as they liaised back and forth with engineering to diagnose and determine solutions. However, the support I received from my account management and technical account management teams was very good.Â
How would you rate customer service and support?
Neutral
Which solution did I use previously and why did I switch?
Lacework's advantage is its ability to differentiate between active and inactive packages through the agent. Most other CNAPP solutions don't offer this capability, and competitors like Wiz don't implement it as effectively.
I've used several other platforms, such as Wiz and Prisma, and they all cover similar functionalities, such as scanning for misconfigurations in the cloud against compliance standards, monitoring IAM configurations for risks, logging and anomaly detection, host-based vulnerability scanning, and IAC code scanning. Wiz offers better reporting and ease of data extraction from datasets.
Lacework, on the other hand, is generally more cost-effective and becomes user-friendly once you're accustomed to its UI conventions. However, extracting specific data from Lacework can sometimes be challenging.
How was the initial setup?
The product is very straightforward to deploy across an entire AWS or GCP organization. They offer automation via Terraform and CloudFormation templates, which allow deployment across all accounts with the appropriate permissions. As for Azure, I'm unsure about its compatibility.
What was our ROI?
You can expect ROI from vulnerability management.Â
What's my experience with pricing, setup cost, and licensing?
My smaller deployments cost around 200,000Â a year, which is probably not as expensive as Wiz.
What other advice do I have?
I rate the overall product a seven out of ten.Â