Lacework was a cloud-native application protection platform known for behavioral analytics and anomaly detection in cloud environments. Fortinet acquired Lacework in August 2024 and rebranded the product as FortiCNAPP. The lacework.com domain now redirects to Fortinet’s product page.
Founded in 2015 in Mountain View, California, Lacework raised over $1.8 billion in venture funding and reached a peak valuation of $8.3 billion in November 2021. At the time of acquisition, the company had nearly 1,000 customers.
What is Lacework / FortiCNAPP?
Lacework built its CNAPP around behavioral analytics. Rather than relying solely on static rules, the platform established baselines of normal behavior for cloud workloads and flagged deviations. This catches threats that don’t match known signatures.
The platform covered CSPM, CWPP, CIEM, CDR, code security, and (as of January 2026) DSPM. Fortinet brought 225 cloud security and AI patents from the acquisition, increasing Fortinet’s patent portfolio to over 1,800.
Key Features
| Capability | Details |
|---|---|
| CSPM | Configuration monitoring across AWS, Azure, GCP, OCI, Kubernetes. Compliance with CIS Benchmarks. |
| CWPP | Runtime monitoring with behavioral baselines. File integrity monitoring, process tracking. |
| CIEM | Net-effective permissions analysis. Compares granted vs. actually used permissions. |
| CDR | Real-time Kubernetes and cloud audit log analysis. Detects unauthorized access and control plane compromises. |
| Code Security | SAST, SCA, SBOM generation, IaC scanning. Integrates with CI/CD pipelines via FortiDevSec. |
| DSPM | Sensitive data discovery, classification, and access monitoring (added January 2026). |
| KSPM | Kubernetes Security Posture Management with CIS Benchmark compliance. |
| Agentless Scanning | Scans Windows and Linux workloads without agent deployment. Default 24-hour scan frequency. |
Behavioral Analytics
The core differentiator was Lacework’s anomaly detection engine. The platform monitored cloud API calls, process execution, network connections, and file activity to build behavioral baselines.
When workloads deviated from established patterns — a container making unusual network connections, a process spawning unexpected child processes — the system generated alerts.
Composite Alerts correlated multiple weak signals into grouped findings. Instead of firing on every low-confidence event, the system combined related signals so teams could focus on real issues.
Cloud Detection and Response
CDR processed Kubernetes audit logs and cloud provider logs (like AWS CloudTrail) to detect unauthorized access attempts, privilege escalation, and control plane manipulation. The platform processed logs in under 15 minutes to enable near-real-time response.
Fortinet Security Fabric Integration
As FortiCNAPP, the platform now integrates with Fortinet’s broader portfolio. Network-aware risk scoring detects FortiGate firewalls along internet-accessible paths and factors that protection into workload risk assessments. FortiSOAR provides workflow orchestration and automated remediation.
Acquisition Timeline
| Date | Event |
|---|---|
| November 2021 | Series D at $8.3B valuation |
| June 10, 2024 | Fortinet announces acquisition |
| August 1, 2024 | Acquisition completed |
| 2025 | Product rebranded as FortiCNAPP |
| January 2026 | DSPM module added |
When to Use FortiCNAPP
Organizations previously using Lacework should work through Fortinet’s support channels for the transition to FortiCNAPP. New buyers evaluating CNAPP platforms should consider FortiCNAPP alongside alternatives.
FortiCNAPP was named a Leader in three categories (Overall, Market, and Innovation) in the KuppingerCole 2025 CNAPP Leadership Compass and won the SC Awards 2025 Best Cloud Workload Protection Solution.
Strengths:
- Behavioral analytics approach catches anomalies that static rules miss
- Composite Alerts reduce false positives through multi-signal correlation
- Integration with the broader Fortinet Security Fabric
- Multi-cloud support including AWS, Azure, GCP, OCI
- 225 cloud security and AI patents
Limitations:
- No longer available as a standalone product — requires Fortinet relationship
- Enterprise pricing with no free tier
- Transition from Lacework to FortiCNAPP may cause disruption for existing customers
- Smaller community compared to cloud-native-only vendors
For a broader view of CNAPP and cloud security, see our cloud infrastructure security guide. For alternative CNAPP platforms, see Wiz and Orca Security.
For open-source runtime security in Kubernetes, consider Falco or KubeArmor.
Note: Acquired by Fortinet (August 2024). Rebranded as FortiCNAPP. lacework.com redirects to fortinet.com.
