Getting started with FortiCNAPP after the Lacework acquisition

The Fortinet Acquisition and the Wiz Rivalry

Fortinet closed its acquisition of Lacework on August 1, 2024, for $152.3 million in cash. This deal placed Lacework technology within the Fortinet Security Fabric. The product is FortiCNAPP. Wiz is the highest-growth security vendor in history. Wiz differentiates via agentless API and snapshot-based scanning to build a risk graph. Lacework differentiates through Polygraph, a behavioral analytics engine that learns normal cloud activity. Most security teams pick one or the other because cost makes running both difficult. If you run both, you must plan triage routing carefully to manage overlapping vulnerability findings. Wiz reaches its first prioritized finding in hours, whereas Lacework requires a baselining period for full value. Mid-market deals for both products often stay within 20 percent of each other on initial quotes. Lacework previously raised $1.3 billion at an $8.3 billion valuation in 2021 with support from Sutter Hill Ventures, Altimeter Capital, D1 Capital Partners, and Tiger Global Management.

Deploying Polygraph for Precise Detection

Users must commit to a baselining period when implementing Polygraph. The baselining period is typically two to four weeks before anomaly detection provides full value. During this time, the engine aggregates entities into analysis groups to create a temporal baseline. The system updates this baseline every hour for every entity. You already know that cloud environments change too fast for manual rules because of rapid scaling. Polygraph monitors behavior at the process and container level to maintain precision and prevent the co-mingling of different behaviors when creating the temporal baseline through its automated data collection. Polygraph uses 13 different analysis groups to monitor specific behaviors. The insider class, for example, monitors human users as they move through the datacenter. The platform detects event changes for applications, users, and workloads, such as new binaries or privilege escalation. In November 2025, the platform released new policy checks for AWS and GCP. These checks identify BigQuery datasets lacking encryption, AWS EBS volumes not optimized via Compute Optimizer, and AWS App Runner services lacking VPC connectors. It also identifies when a user launches a new binary or escalates their privileges. The platform separates interactive human traffic from predictable application-to-application traffic to reduce noise.

Evaluating Runtime vs Posture Capabilities

Pick FortiCNAPP if runtime anomaly detection defines your success. The platform detects lateral movement, unusual API patterns, and credential abuse. This capability provides an advantage over snapshot-based scanners that miss threats occurring between scans. Wiz leads in identity and data security through its more developed CIEM and DSPM modules. Fortinet added native DSPM capabilities to FortiCNAPP in January 2026. Fortinet integrates its findings with FortiGuard Outbreak Alerts and FortiSOAR. Pick FortiCNAPP if you already own Fortinet firewalls or SASE tools. Renewal escalation remains a frequent complaint for Wiz customers. Mid-market deals for both products often stay within 20 percent of each other on initial quotes.

The platform identifies misconfigured Kubernetes services and monitors Kubernetes environments for abnormal behavior. It also detects when a user launches a new binary or escalates their privileges. It automates the mapping of cloud assets and configurations to frameworks like PCI DSS, HIPAA, SOC 2, and ISO 27001. FortiCNAPP also identifies vulnerabilities in first-party code and third-party libraries. This functionality helps security teams shift security left within the application life cycle. The platform provides visibility into identities and permissions by comparing granted versus used permissions. Will Fortinet eventually merge the Polygraph engine into its core firewall OS?