The Atlas take.
FortiCNAPP carries forward Lacework’s cloud and workload security lineage, but an existing customer and a new customer can face different commercial rules. Fortinet’s documentation explicitly separates legacy agent-based licensing from newer package and vCPU usage reporting. Atlas would use that clarity to build a technical and commercial coverage ledger before comparing quotes. Agentless workload assessment and the Linux agent also have different observation boundaries. The useful evaluation proves how a cloud configuration and a workload behavior become actionable evidence, then reconciles the components and resource population with the customer’s actual subscription model.
02 / DEFINE THE BOUNDARY
What you are actually evaluating.
Confirm the current FortiCNAPP edition and the modules retained in any existing Lacework deployment. Agentless control-plane collection and workload agents have different visibility; a shared platform name does not mean every runtime or development function is enabled.
Names you may encounter Lacework · Lacework FortiCNAPP. Historical names do not establish current feature equivalence.
03 / THE CONTROL PATH
Where it sits. How it works.
Cloud configuration and agentless scans combine with workload-agent observations, followed by security investigation and subscription usage accounting.
- 01
Cloud accounts and scan scope
Configured integrations select the accounts and supported workloads assessed without in-workload agents.
- 02
Workload observation and analysis
Agents provide behavior-related data; scanning and runtime collection retain separate configuration and coverage limits.
- 03
Investigation and usage review
Owners investigate findings and reconcile protected resources with the applicable package and billing model.
04 / WHAT EARNS ITS PLACE
Strengths, with the evidence attached.
Atlas analysis of documented capabilities; availability and behavior depend on the edition and environment.
Collection behavior is documented
Agent and agentless FAQs describe operational behavior that can be challenged against representative workloads rather than inferred from platform marketing.
Legacy commercial rules are acknowledged
Subscription documentation distinguishes newer vCPU packages from earlier agent-based contracts, reducing ambiguity during an existing-estate evaluation.
Inspect the documented capability notes
- Cloud, Kubernetes and entitlement posture functions assess documented configuration and permission risks.
- Workload and cloud detection capabilities include behavioral context associated with the Polygraph approach.
- Development-related functions include infrastructure-as-code and software-analysis capabilities where the corresponding modules are selected.
05 / KNOW THE COMPROMISES
The tradeoffs to take seriously.
Architectural implications and procurement questions from Atlas; these are not independently measured product failures.
Process visibility has conditions
The Linux agent FAQ documents conditions affecting which command-line activity is captured. Test short-lived and non-networking processes required by the use case.
Usage numbers require contract context
The newer subscription view and legacy license model use different accounting concepts; a preview of vCPU usage does not itself change the current contract.
06 / FROM PURCHASE TO PRACTICE
Make it work in your environment.
A proposed implementation sequence. Confirm supported versions, permissions, and rollback with the current documentation.
- 01
Identify the inherited agreement
Record whether the instance uses legacy licensing or current packages and which modules are entitled before rollout changes.
- 02
Test representative workload behavior
Validate an agentless assessment and an agent-observed event on the actual host and container patterns.
- 03
Reconcile health and consumption
Compare cloud inventory, agent health, scan results, and usage records; assign owners for gaps and unexpected growth.
07 / THE OPERATING COMMITMENT
The bill is only part of the cost.
Commercial shape
Confirm Standard, Pro, or Enterprise packaging and the applicable vCPU model, or the legacy agreement where retained. Treat a usage preview as an estimate, not a contract conversion.
- Current package entitlements and vCPU populations where applicable
- Legacy agent-based counting if it still governs the account
- Agentless scanning resources, integration services, and ongoing administration
08 / COMPARE THE JOB
Put these beside it.
Alternatives worth examining for the same problem. Check each offering’s scope before treating it as a substitute.
Sysdig
Compare workload collection components and Kubernetes operating responsibilities with explicit support and policy checks.
WizWiz
Compare a cloud-risk graph approach with separately scoped runtime sensing and a different commercial contract.
09 / MAKE THE DECISION OBSERVABLE
Earn confidence through a real evaluation.
Suggested by Atlas. Agree acceptance criteria, use synthetic fixtures in an authorized environment, and capture both useful work and failed controls.
- TEST 01
Test a short-lived workload
Acceptance evidence: Preserve lifetime, process and container context, collection settings, and the actual observed evidence; document anything the agent did not collect.
- TEST 02
Challenge an agentless exclusion
Acceptance evidence: Exclude a lab workload through the supported scan configuration and confirm that inventory and coverage reporting explain the resulting gap.
- TEST 03
Reconcile the license model
Acceptance evidence: Use a representative resource population to explain the displayed usage and the contract’s counting rules, including a retained legacy instance where relevant.
START WITH ONE EXERCISE
Perform a benign, authorized role change in a lab and a separate documented event on an instrumented workload.
Evidence to look for: The evaluation records each signal’s source and timing, and the operator can reverse the configuration change without confusing it with a runtime response.
Questions to bring to the vendor
- Which current SKU and support path correspond to the existing Lacework configuration?
- Does a behavioral finding come from cloud activity records or a workload agent?
- Which development integrations can identify the responsible repository without requiring unnecessary access to unrelated code?
10 / SHOW THE WORK
Evidence, and what is still unknown.
What this research cannot establish
- No independent workload-overhead or detection-quality benchmark was performed.
- Exact cloud support, package entitlements, inherited contract terms, and data-processing arrangements need deployment-specific confirmation.
Dossier research reviewed October 18, 2026. Earlier profile references are retained for traceability; products and commercial terms change.
- Fortinet FortiCNAPP: official product documentation ↗Earlier profile reference
- Fortinet FortiCNAPP: official supporting source ↗Earlier profile reference
- FortiCNAPP Linux agent FAQs ↗Documentation
- FortiCNAPP agentless workload scanning FAQs ↗Documentation
- FortiCNAPP subscription usage and packages ↗Pricing
KEEP BUILDING YOUR JUDGMENT