Lacework FortiCNAPP: product and architecture
Lacework is now sold as Lacework FortiCNAPP: Fortinet completed its acquisition on 1 August 2024 and the product has been generally available under the new name since 8 October 2024. This Lacework review examines a cloud security platform that has carved out a distinct position in the CNAPP (Cloud-Native Application Protection Platform) market through its behavioral analytics engine called Polygraph. Unlike rule-based security tools that depend on predefined threat signatures, Lacework ingests telemetry from cloud workloads, containers, Kubernetes clusters, and IAM configurations, then builds a behavioral baseline to flag anomalies. The platform supports AWS, Azure, and Google Cloud, making it relevant for organizations running multi-cloud infrastructure. For security teams drowning in alert noise from misconfigured rules, Lacework's machine-learning approach offers a fundamentally different operating model.
Overview
Lacework operates as a unified cloud security platform that consolidates workload protection, configuration auditing, vulnerability scanning, and threat detection into a single agent-based and agentless architecture. The company was founded in 2015 and gained traction among mid-market and enterprise teams looking to move beyond bolt-on security tools that required constant tuning.
The platform's core differentiator is its Polygraph Data Engine, which continuously observes process behavior, network connections, file activity, and user actions across cloud environments. Rather than relying on static rules that generate thousands of low-value alerts, Polygraph builds a graph of normal behavior and surfaces deviations that actually matter. This approach reduces alert volume significantly -- Lacework claims up to 95% fewer alerts compared to rule-based alternatives.
Lacework also provides Cloud Security Posture Management (CSPM), Infrastructure as Code (IaC) scanning, and container image vulnerability analysis, positioning it as a platform play rather than a point solution.
Key Features and Architecture
Lacework's architecture centers on three pillars: data collection, behavioral modeling, and contextual alerting.
Data Collection Layer. Lacework deploys a lightweight agent on workloads (EC2 instances, Kubernetes nodes, bare-metal hosts) that captures system-level telemetry -- process trees, network flows, file integrity changes, and DNS queries. For agentless coverage, the platform integrates via cloud provider APIs to pull CloudTrail logs, VPC Flow Logs, Azure Activity Logs, and GCP Audit Logs. This dual approach means teams can get visibility into both host-level and cloud-control-plane activity without choosing one over the other.
Polygraph Behavioral Analytics. The Polygraph engine ingests collected telemetry and constructs a behavioral graph for each environment. It maps relationships between users, machines, containers, and applications over a baseline period (typically 7-14 days). Once the baseline stabilizes, Polygraph identifies deviations: a container suddenly making outbound connections to an unfamiliar IP, a service account accessing resources it has never touched, or a process spawning a child that deviates from its historical pattern. Each anomaly gets a severity score based on how far it deviates from the baseline and how many correlated anomalies are occurring simultaneously.
Composite Alerts. Rather than firing one alert per anomaly, Lacework groups related anomalies into composite alerts that tell a story. A single composite alert might combine an unusual login location, privilege escalation, and data exfiltration attempt into one actionable incident. This dramatically cuts investigation time.
Additional Capabilities. The platform includes CIS benchmark scanning for cloud accounts, Kubernetes admission controller integration for shifting security left, and a vulnerability scanner that assesses container images and host packages against CVE databases. The API is well-documented, with Terraform providers available for infrastructure-as-code deployments.
Ideal Use Cases
Lacework fits best in organizations with the following characteristics:
Multi-cloud environments with 200+ workloads. The per-workload pricing model and behavioral analytics engine deliver the most value at scale, where rule-based tools become unmanageable. Teams running across AWS, Azure, and GCP benefit from a single pane of glass rather than stitching together provider-native tools like GuardDuty, Defender for Cloud, and Security Command Center.
DevOps-driven organizations with container-heavy architectures. Teams running Kubernetes at scale need runtime protection that adapts to ephemeral workloads. Lacework's ability to baseline container behavior without writing custom rules makes it practical for environments where containers spin up and down constantly.
Security teams with limited headcount. Because Polygraph reduces alert noise and groups anomalies into composite alerts, smaller security teams (3-8 analysts) can operate Lacework without dedicating full-time staff to alert triage and rule maintenance.
Compliance-driven enterprises. Organizations needing continuous CIS, SOC 2, PCI DSS, or HIPAA compliance monitoring across cloud accounts will find the built-in compliance dashboards useful for audit preparation.
Pros and Cons
Pros:
- Polygraph behavioral analytics dramatically reduces false positives and alert fatigue compared to rule-based alternatives
- Composite alerts group correlated anomalies into single incidents, cutting investigation time
- Multi-cloud support across AWS, Azure, and GCP from a single platform
- Agentless and agent-based deployment options provide flexibility
- Built-in compliance frameworks (CIS, SOC 2, PCI DSS, HIPAA) reduce audit preparation overhead
- Strong container and Kubernetes runtime protection without custom rule writing
Cons:
- Enterprise-only, quoted pricing puts it out of reach for startups and small teams
- No free tier or self-service option for evaluation; requires sales engagement
- 7-14 day baseline period means threat detection is limited during initial deployment
- Limited value for single-cloud or small-workload environments where simpler tools suffice