Fortinet FortiCNAPP

My main use case for FortiCNAPP, from my previous experience distributing it or now as a reseller, is for anyone who's looking for a strong cloud security platform and gaining visibility into risk, malicious configurations, any vulnerabilities, as well as your workload behavior across cloud environments.

The fact that it is built as a cloud native application protection platform means it is aimed at helping security teams manage their cloud posture, the workload protection, identity risk, and compliance from a central place. When you consider it as a solution that someone can use in their SOC, it is most valuable when you need clearer visibility across multi-cloud environments, which is a challenge in today's environment. If you want to turn your cloud findings into actionable security work, FortiCNAPP is the way to go.

FortiCNAPP offers features that stand out to my clients and to me as a reseller. It is not just a reporting tool; it gives you the actual context around cloud risk in a way that helps with prioritization, investigation, and compliance tracking, taking away a lot of your time and saving your resources to focus on what's important. The vulnerability and workload risk detection with severity-based prioritization is a key player, compliance reporting that supports frameworks such as PCI, SOC 2, and CIS is a game changer, and noise reduction by consolidating and prioritizing alerts saves a lot of time.

I can tell you more about how the compliance reporting helps my clients. I have not had feedback from them regarding how it made it easier, but I have had showcases where I can demonstrate from a PCI perspective as well as a SOC 2 that it is a requirement and how it addresses that compliance framework.

FortiCNAPP has impacted my clients positively. The strong visibility into the cloud security posture and operational risk is a massive impact for clients. From a compliance reporting perspective, it is valuable when they need evidence for audit and control testing, fitting well into security operations models where cloud findings need to be handled alongside broader SOC activity.

FortiCNAPP can be improved because the platform can feel complex at the start, especially for teams new to CNAP tooling. Some users mention that they found the interface and data models less intuitive than expected, and I have had situations where reporting and alert configurations might require time.

Regarding other improvements needed for FortiCNAPP, the majority of the time is that reporting and alert configuration might require time to tune properly. This is the significant issue, combined with the fact that some users find the interface and data model less intuitive than expected.

Regarding FortiCNAPP's AI capabilities, I think there might be a bit of improvement needed. However, since Fortinet is a security vendor overall, keeping the data safe is not a problem. I know they have invested a lot in getting it to a place where it is a trusted platform.

FortiCNAPP is stable. I have not experienced any downtime or issues reported by my clients.

From a licensing perspective, FortiCNAPP's scalability is good. It can handle growing workloads or expanding environments smoothly.

The customer support for FortiCNAPP is pretty good from a South African perspective. Most support runs via the distribution channel, and only once it gets to layer two or tier two does it get pushed through to your Fortinet system engineers, where support is very quick.

My experience with pricing, setup cost, and licensing for FortiCNAPP revolves around Fortinet being an enterprise vendor. Pricing is always a discussion point. FortiCNAPP is not a cheap solution, and licensing around it can become very expensive for specific customers. However, if the use case is there and the need is a demand, then pricing is the last thing that will be the focus.

I have seen a return on investment for my clients. They need fewer employees from a SOC perspective where people are deployed in their SOC, as well as significant time saved. When you save time, you save money.

FortiCNAPP is not a cheap solution, and licensing around it can become very expensive for specific customers. However, if the use case is there and the need is a demand, then pricing is the last thing that will be the focus.

Before choosing FortiCNAPP, I believe my clients did evaluate other options, but I have no insight into what they used prior.

I must ensure that you understand the interface and the model that you want to expect from it. I believe it is flexible enough to get the right interface or data that you want to see from a CNAP perspective.

From a feature perspective, I wish more people knew about the integration potential with the broader Fortinet ecosystem, which is a massive game changer. If you are already invested in a Fortinet ecosystem, it is a no-brainer to go for FortiCNAPP to look after your cloud platform.

Integration depth can matter a lot for FortiCNAPP. Value can be improved significantly when it is connected into an existing SOC stack. However, if you are not running any form of a Fortinet estate, it can become complex.

I rate FortiCNAPP an eight because, from my experience, it is best viewed as a platform that helps a SOC make cloud risk visible, understandable, and actionable, which is exactly what I prefer using it for or positioning it to customers. However, as a stand-alone product, if you do not have the experience from an existing cloud or understanding of how to manage cloud security at scale, then there might be a bit of a challenge. FortiCNAPP is a credible solution that adds real value when you properly integrate it with your existing security operations.

Private Cloud

Amazon Web Services (AWS)

My main use case for FortiCNAPP is majorly for AWS, specifically for security posture management and auditing so that the user and whoever is using this can capture what is necessary.

A specific example of how I use FortiCNAPP for AWS security posture management is that we created resources manually, which sometimes led to misconfigurations in the customer requirements, and we have used FortiCNAPP to detect services that are publicly exposed and security groups with wide ranges of open IPs for ingress or egress, along with checking unencrypted databases and tightening IAM permissions.

I also have a unique use case of FortiCNAPP for one of Asia's largest growing country government projects where we identified users with excessive permissions not required by them, due to many users being onboarded in the government sector, so we used FortiCNAPP to identify all cloud identities and recommended the right permission sets for them.

FortiCNAPP has positively impacted my organization by providing centralized visibility and consolidating our cloud security posture management, helping us identify misconfigurations and public accessibility issues, which allowed us to enhance IAM governance and visibility on vulnerabilities.

Although I don't have specific metrics, I can say it has reduced our operational overhead significantly by providing a centralized view, highlighting critical issues, and helping us tighten configurations that have reduced operational costs and time.

The best features FortiCNAPP offers, in my opinion, include compliance and audit capabilities, IAM identity management, and security rectification in configurations, along with vulnerability management, which helped us rectify thousands of overwhelmingly security vulnerabilities. I find myself relying on all of them day-to-day, including threat detection, which is really good.

Regarding how FortiCNAPP can be improved, I would say there are a few things.

For improvements, I believe integrating FortiCNAPP with ITSM tools to reduce manual ticket creation and allowing more customization in reports could be beneficial, as well as providing knowledge-sharing articles for remediation playbooks.

I have been using FortiCNAPP for almost three years.

FortiCNAPP is stable.

FortiCNAPP's scalability is open, and we can change instances easily as needed.

The customer support for FortiCNAPP is fine, though it can take time as we need to engage with AWS first, but I would rate it around 7 or 8 out of 10.

Previously, we have only used it as an add-on solution.

While I don't have specific metrics for ROI, I know that we save time on operations and manpower while improving our security posture.

Regarding pricing, setup cost, and licensing, since it's a marketplace, I find the pay-as-you-go model convenient and fair.

We did not evaluate other options before choosing FortiCNAPP, as it completed our use case right away.

For others looking into FortiCNAPP, I recommend it for tightening security in public clouds as it has worked well for us compared to other options such as Palo Alto Prisma and CrowdStrike. I would rate this product 8.5 out of 10.

Public Cloud

Amazon Web Services (AWS)

What do you like best about the product?

What I like best about FortiCNAPP is its unified visibility across cloud infrastructure, workloads, and identities in a single platform. Instead of using separate tools for CSPM, CIEM, and vulnerability management, everything is integrated, which makes monitoring and remediation much more efficient. I also appreciate the real-time risk prioritization. It doesn’t just show vulnerabilities, but helps correlate misconfigurations, exposed workloads, and identity risks to highlight what actually matters. The automation capabilities for compliance checks and policy enforcement are another strong point, especially in dynamic cloud environments.

What do you dislike about the product?

One area that could be improved is the user interface, especially for new users. While the platform is powerful, the number of features and dashboards can feel overwhelming at first, and it takes some time to fully understand how everything connects. The initial configuration and policy tuning also require a solid understanding of cloud security concepts, which may be challenging for smaller teams without dedicated cloud security expertise. Additionally, more detailed documentation and practical implementation examples would make onboarding smoother.

What problems is the product solving and how is that benefiting you?

FortiCNAPP helps solve the challenge of fragmented cloud security visibility. In modern cloud environments, risks often come from multiple areas such as misconfigurations, excessive identity permissions, vulnerable workloads, and exposed containers. Managing these risks across different tools can create blind spots and slow down response times.

By consolidating CSPM, CIEM, vulnerability management, and runtime protection into a single platform, FortiCNAPP reduces complexity and improves risk prioritization. Instead of reacting to hundreds of low-impact alerts, it correlates findings to highlight the most critical attack paths. This has benefited me by improving efficiency in identifying high-risk issues, reducing manual investigation time, and strengthening overall cloud security posture. It also supports compliance monitoring, which makes reporting and audits much more manageable.

What do you like best about the product?

Good visibility across cloud resources
Helpful posture management and compliance reporting
Easy-to-understand dashboards
Integrates well with other Fortinet security products
Good alerting for misconfigurations and risky cloud permissions

What do you dislike about the product?

Initial setup and onboarding can take time
Some reports and dashboards could be more customizable
Occasionally too many alerts without proper tuning..

What problems is the product solving and how is that benefiting you?

FortiCNAPP helps detect cloud misconfigurations, weak security controls, and risky permissions. It improves cloud security posture and reduces the risk of breaches by continuously monitoring cloud environments and providing actionable remediation recommendations.

What do you like best about the product?

the diversity of applications and softwares is very helpfull, also the platform security is very trustworthy, the website interface is also very simple and easy to use.

What do you dislike about the product?

the setup qnd configuration process is hard to understand, the lavk of documentation is also an issue specially for new users of the platform, also it would be a great change if the prices were a bit lower

What problems is the product solving and how is that benefiting you?

It provides a single dashboard for viewing and managing our security posture across all cloud service providers. It’s been a big help in spotting misconfigurations early, and it saves a lot of time overall.

What do you like best about the product?

I found Lacework FortiCNAPP incredibly smooth to set up, which was neither tricky nor difficult at all. This ease of installation was something I deeply appreciated. During my hackathon experience, it effectively helped me in publishing my app and mimicking a production-level scenario for my project. This showed me its potential to be a great tool for application development and project presentation. I also loved the peer review feature, which provided authentic previews that were immensely helpful in decision-making. The platform’s associations with reputed partners like G2, HubSpot, and Salesforce highlighted its well-established and trustworthy nature. Additionally, I remember the features like vulnerability management and the alerting and prioritizing capabilities as excellent facets of Lacework FortiCNAPP. The single entity dashboard offering comprehensive visibility across multi-cloud environments, including AWS, Azure, and Kubernetes, was remarkable, helping greatly in monitoring the security posture. These aspects were impressive and beneficial, making it easy to use and efficient for its purposes.

What do you dislike about the product?

{"I find that the integration experience with Lacework FortiCNAPP could be enhanced. The process of linking it up with specific software tools like Terraform, remediation code, or a normal CI/CD system could feel more comprehensive and streamlined. Improving this aspect could make these integrations more efficient and less cumbersome."}

What problems is the product solving and how is that benefiting you?

Lacework FortiCNAPP helped me with app deployment and mimicking production scenarios during a hackathon, facilitating authentic peer reviews and decision-making.