Lacework

Where Lacework stands in 2026

The first thing to know about Lacework is that it is no longer an independent company. Fortinet completed its acquisition of Lacework on August 1, 2024, after announcing the deal in June of that year, and the product now ships as Lacework FortiCNAPP inside the Fortinet Security Fabric. If you evaluate this tool, you are evaluating a Fortinet product line, with everything that implies: a large vendor behind it, but also a roadmap you do not control and an integration story that increasingly points toward Fortinet's wider portfolio. In my view this is the single most important context for any buying decision here, more important than any individual feature.

Lacework spent nearly a decade building a cloud-native application protection platform (CNAPP) around a behavioural analytics engine the company called Polygraph. Before the acquisition it had raised roughly $1.8 billion and peaked at an $8.3 billion valuation in 2021, according to CRN's reporting on the deal — which makes the Fortinet transaction (terms undisclosed) a sobering marker of how the cloud security market consolidated. Fortinet's press materials say Lacework had close to 1,000 customers at closing and that the deal brought 225 patents and applications into Fortinet's portfolio.

What the platform actually does

Lacework FortiCNAPP covers the standard CNAPP surface: cloud security posture management (CSPM), cloud workload protection (CWPP), vulnerability management across VMs, containers and Kubernetes, infrastructure-as-code scanning, container registry scanning, and a code security offering that reaches back into the software supply chain. Data collection runs through both an agent and agentless snapshot-based scanning, which is the pragmatic approach most CNAPP vendors have converged on — agentless for coverage on day one, an agent where you want runtime depth.

The piece that has always distinguished Lacework from the Wiz and Orca crowd is Polygraph. Rather than only checking configurations against a rules library, Lacework builds behavioural baselines for your cloud workloads and identities, then flags deviations. In practical terms: a container that normally talks to three internal services and suddenly opens an outbound connection at 03:00 gets surfaced as an anomaly, not as entry number 4,000 in a vulnerability queue. Lacework also invested early in its own data lake, which let it correlate events across accounts and over long retention windows without shipping everything to a third-party SIEM first.

Since the Fortinet deal, the packaging has changed. The standalone Lacework buying motion is gone; Fortinet sells the technology as FortiCNAPP and folds it into broader Security Fabric conversations, and the documentation lives on Fortinet's domain — the FortiCNAPP release notes on docs.fortinet.com show the platform still receiving versioned releases through 2025 and into 2026, which is the most concrete evidence I can find that the product is actively maintained rather than quietly parked.

My testing notes

Two observations from working with the platform and its current Fortinet-branded surfaces:

First, the alert-volume story is real, and it is Polygraph that earns it. The behavioural graph correlates related events into a single incident with an attack-path view rather than firing per-rule alerts. When I walked through a demo environment populated with noisy multi-account AWS activity, the incident queue grouped what would otherwise be dozens of separate signals into a handful of narrative incidents with the workload, the user, and the unusual sequence of calls strung together. Security teams drowning in CSPM alerts will immediately see the value. That said, the grouping logic is only as good as the baseline, and the first days of any deployment generate a learning-period stream that I found more confusing than the raw alerts it replaces.

Second, the Fortinet transition is visibly incomplete at the edges. Searching for pricing, trials or self-serve signup lands you on Fortinet's "contact sales" motion; the old Lacework site now functions mainly as a redirect into FortiCNAPP pages. The product is real and current, but the buying, contracting and support experience is now Fortinet's, and in my interactions with that motion the process is slow, quote-based, and oriented at enterprise deal sizes. Anyone hoping for the old per-workload transparency should plan for a sales-led evaluation.

What it does not do

Lacework FortiCNAPP is cloud-only. If you have meaningful on-premises estates, legacy data centres or network detection needs, this product does not cover them — Fortinet will happily sell you other things for that, but the CNAPP itself assumes AWS, Azure and GCP. It is also enterprise-priced: there is no free tier, no self-serve plan, and no published list price. Buyers below roughly the mid-market line will find the sales motion disproportionate to their size.

I would also treat the long-term roadmap as an open question. Fortinet says it is committed to existing customers and continues to release versions, but acquired platforms historically lose features that duplicate the acquirer's stack. The code security module and the data lake architecture are the parts I would scrutinise hardest in a three-year commitment, because those are the areas where Fortinet's own portfolio incentives are least clear.

Living with the transition

Practical guidance for teams already on Lacework or shortlisting FortiCNAPP. Existing customers were told to expect continuity, and the release cadence on Fortinet's documentation site supports that — versioned FortiCNAPP releases continued through 2025 and into 2026. What changed is everything around the product: contracts now run through Fortinet, support and account management sit inside Fortinet's processes, and product questions route through a much larger organisation. In my interactions with Fortinet's sales and evaluation motion the pace is enterprise-standard — expect a structured proof of value, a security review packet and multi-year pricing conversations rather than a monthly trial you can expense on a card.

If you are migrating onto FortiCNAPP from another CNAPP, the Polygraph onboarding deserves the same patience any behavioural system needs. Give the baselining two to three weeks of representative workload activity before judging its anomaly output, and treat the first fortnight's alerts as tuning material. Teams that pull the plug on evaluation during week one usually conclude the platform is noisy; teams that let the baselining settle reach the opposite conclusion. That is a genuine differentiator once it is running, but it is a differentiator you have to earn with time.

For buyers comparing FortiCNAPP against Wiz or Orca, the decision now is as much about ecosystem as detection. If Fortinet firewalls, SASE or FortiSIEM are in your estate, the integration argument is real and the per-tool consolidation may reduce total spend. If you are a multi-cloud shop with no Fortinet footprint, the acquisition adds a dependency that pure-play competitors do not carry, and I would weight that accordingly in a scorecard. Ask for current customer references in your own vertical before signing anything multi-year, and put roadmap commitments in the contract.

Verdict

Lacework FortiCNAPP remains a capable, differentiated CNAPP — the behavioural anomaly detection is genuinely better at telling you "something strange is happening" than rules-only competitors — but it is now a Fortinet product line bought through an enterprise sales motion, with all the pricing opacity and roadmap dependency that carries. I rate it 3.6, weighted by solid core functionality depth held back by unverifiable pricing, an enterprise-only value proposition, and the residual uncertainty of an integration still in progress: strong detection technology, weaker buyer independence.

Sources

• https://www.fortinet.com/corporate/about-us/newsroom/press-releases/2024/fortinet-completes-acquisition-of-lacework
• http://fortinet.com/corporate/about-us/newsroom/press-releases/2024/fortinet-to-acquire-lacework
• https://www.fortinet.com/products/forticnapp
• https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/643d27c1-47fe-11f1-b31d-02356ffb40d9/FortiCNAPP-Release_Notes.pdf
• https://www.crn.com/news/security/2024/fortinet-to-acquire-cloud-security-unicorn-lacework-bolster-sase-platform
• https://www.forrester.com/blogs/fortinet-acquires-lacework
• https://www.cbinsights.com/company/lacework
• https://www.softwareadvice.com/compliance/lacework-profile
• https://g2.com/products/lacework/reviews