SECURITY ATLAS / EVALUATION BRIEF Fortinet FortiCNAPP Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/fortinet-forticnapp/ THE ATLAS TAKE FortiCNAPP carries forward Lacework’s cloud and workload security lineage, but an existing customer and a new customer can face different commercial rules. Fortinet’s documentation explicitly separates legacy agent-based licensing from newer package and vCPU usage reporting. Atlas would use that clarity to build a technical and commercial coverage ledger before comparing quotes. Agentless workload assessment and the Linux agent also have different observation boundaries. The useful evaluation proves how a cloud configuration and a workload behavior become actionable evidence, then reconciles the components and resource population with the customer’s actual subscription model. SCOPE Confirm the current FortiCNAPP edition and the modules retained in any existing Lacework deployment. Agentless control-plane collection and workload agents have different visibility; a shared platform name does not mean every runtime or development function is enabled. WORTH A LOOK WHEN Teams operating cloud accounts and Linux workloads that can maintain both cloud integrations and agents, including existing Lacework estates. THINK TWICE WHEN A migration or renewal assumes legacy agent-count rules and newer vCPU packages are interchangeable, or an agentless scan is credited with runtime behavior. IMPLEMENTATION 1. Identify the inherited agreement Record whether the instance uses legacy licensing or current packages and which modules are entitled before rollout changes. 2. Test representative workload behavior Validate an agentless assessment and an agent-observed event on the actual host and container patterns. 3. Reconcile health and consumption Compare cloud inventory, agent health, scan results, and usage records; assign owners for gaps and unexpected growth. OPERATING REALITY Cloud administrators maintain account integrations and scan permissions; workload operators maintain agents and connectivity; security engineers own investigation and exceptions. Atlas would reconcile short-lived workloads, missing agents, and the billing population during the same review. A licensing dashboard and a protected-resource inventory answer different questions and should not silently substitute for one another. COMMERCIAL CONSIDERATIONS Confirm Standard, Pro, or Enterprise packaging and the applicable vCPU model, or the legacy agreement where retained. Treat a usage preview as an estimate, not a contract conversion. - Current package entitlements and vCPU populations where applicable - Legacy agent-based counting if it still governs the account - Agentless scanning resources, integration services, and ongoing administration EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Test a short-lived workload Acceptance evidence: Preserve lifetime, process and container context, collection settings, and the actual observed evidence; document anything the agent did not collect. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Challenge an agentless exclusion Acceptance evidence: Exclude a lab workload through the supported scan configuration and confirm that inventory and coverage reporting explain the resulting gap. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Reconcile the license model Acceptance evidence: Use a representative resource population to explain the displayed usage and the contract’s counting rules, including a retained legacy instance where relevant. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - Which current SKU and support path correspond to the existing Lacework configuration? - Does a behavioral finding come from cloud activity records or a workload agent? - Which development integrations can identify the responsible repository without requiring unnecessary access to unrelated code? EVIDENCE GAPS - No independent workload-overhead or detection-quality benchmark was performed. - Exact cloud support, package entitlements, inherited contract terms, and data-processing arrangements need deployment-specific confirmation. SOURCES FortiCNAPP Linux agent FAQs (Documentation) https://docs.fortinet.com/document/forticnapp/latest/administration-guide/792160/linux-agent-faqs FortiCNAPP agentless workload scanning FAQs (Documentation) https://docs.fortinet.com/document/forticnapp/latest/administration-guide/269317/agentless-workload-scanning-faqs FortiCNAPP subscription usage and packages (Pricing) https://docs.fortinet.com/document/forticnapp/26.1.0/administration-guide/770186 Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.