Company Profile
Lacework is a cloud-native security platform developed to identify risk, abnormal behavior and active threats across public-cloud infrastructure, workloads, containers, Kubernetes environments, identities and software-development pipelines.
Founded in 2015, Lacework emerged from the premise that traditional rule-heavy security tools were poorly suited to cloud environments that changed continuously. Instead of requiring security teams to anticipate every possible threat and manually create a rule for it, Lacework built a data-driven platform designed to understand normal relationships and behavior across a customer’s cloud environment. Deviations from that baseline could then be investigated as potential risks or attacks.
Lacework was acquired by Fortinet, with the transaction becoming effective on August 1, 2024. The technology was subsequently integrated into the Fortinet Security Fabric and introduced as Lacework FortiCNAPP, combining Lacework’s cloud-native platform with Fortinet’s security operations, automation and threat-intelligence capabilities. Fortinet currently presents the platform under its broader FortiCNAPP portfolio. Fortinet officially completed the acquisition in August 2024.
For directory purposes, Lacework should therefore be understood as an acquired cloud-security technology platform and continuing product lineage rather than an independent cybersecurity vendor.
Infrastructure Stack
Cloud-Native Application Protection Platform
Cloud Security Posture Management
Kubernetes Security Posture Management
Cloud Workload Protection
Cloud Infrastructure Entitlement Management
Cloud Detection and Response
Application Security
Code Security
Static Application Security Testing
Software Composition Analysis
Software Bill of Materials
Infrastructure as Code Security
Cloud Vulnerability Management
Cloud Compliance
Behavioral Analytics
Anomaly Detection
Attack Path Analysis
Runtime Security
Container Security
Multi-Cloud Security
Security Automation
Threat Intelligence
Fortinet Security Fabric Integration
Visual Signature
Website
Operational Snapshot
Problem They Solve
Fragmented Cloud Security Visibility
Solution They Provide
Unified Code-to-Cloud Risk and Threat Protection
In Plain Terms
What They Really Do?
Lacework watches what is happening across an organization’s cloud environment and builds a model of how its resources normally behave and relate to one another.
It observes cloud accounts, workloads, containers, Kubernetes clusters, identities, API activity and development pipelines. It then looks for security weaknesses and changes that do not fit the established operating pattern.
A traditional tool may generate separate alerts for a vulnerable server, an unusual login, an overly permissive cloud identity and a configuration failure. Each alert may appear unrelated.
Lacework attempts to connect them.
If the vulnerable server is exposed to the internet, the suspicious identity can access it and unusual activity is occurring inside the workload, the platform can correlate those signals into a higher-confidence security event. This reduces the need for analysts to reconstruct the entire relationship manually.
The objective is not simply to discover more problems. It is to identify which combinations of problems could allow an attacker to move from initial access to meaningful control.
What Lacework Really Does
Lacework converts raw cloud telemetry into security context.
Its original Polygraph technology was designed to model relationships among users, processes, workloads, applications, cloud resources and network activity. The platform learned the normal behavior of an environment and used machine learning to identify deviations.
This behavioral model differentiated Lacework from cloud-security products built primarily around static policies. Static policies remain necessary for compliance and configuration management, but they cannot independently explain whether suspicious activity is part of a broader attack.
Lacework combined policy-based posture management with behavioral anomaly detection. It could identify a cloud resource that violated a security standard while also observing whether that resource was communicating abnormally, running an unusual process or interacting with a compromised identity.
Fortinet has extended this approach through integrations with FortiSOAR, FortiGuard threat intelligence and automated remediation. Current FortiCNAPP capabilities correlate behavioral analytics, anomaly detection, cloud-provider logs and threat intelligence into composite alerts intended to represent higher-confidence attack activity. Fortinet describes the integrated platform as a unified, AI-driven code-to-cloud security system.
Primary Operating Model: Cloud-Native Application Protection Platform
Current Product Identity: FortiCNAPP / Lacework FortiCNAPP
Current Parent Organization: Fortinet
Lacework addresses a structural problem created by cloud adoption. Enterprises frequently operate multiple cloud providers, thousands of changing assets, large Kubernetes environments, extensive identity systems and software-development pipelines that deploy new code continuously. Each layer can generate separate vulnerabilities, configuration failures, excessive permissions, compliance violations and security alerts.
When these risks are processed by disconnected tools, security teams receive large volumes of findings without enough context to determine which issues create a realistic path to compromise.
Lacework attempts to connect those findings.
The platform brings together cloud configurations, asset relationships, identity permissions, workload activity, vulnerabilities, code weaknesses, open-source dependencies and runtime behavior. This allows a security team to see not merely that a vulnerability exists, but whether the affected workload is publicly exposed, whether a reachable identity possesses dangerous permissions, whether abnormal activity is occurring and whether the combined conditions form an actionable attack path.
It observes cloud accounts, workloads, containers, Kubernetes clusters, identities, API activity and development pipelines. It then looks for security weaknesses and changes that do not fit the established operating pattern.
A traditional tool may generate separate alerts for a vulnerable server, an unusual login, an overly permissive cloud identity and a configuration failure. Each alert may appear unrelated.
Lacework attempts to connect them.
If the vulnerable server is exposed to the internet, the suspicious identity can access it and unusual activity is occurring inside the workload, the platform can correlate those signals into a higher-confidence security event. This reduces the need for analysts to reconstruct the entire relationship manually.
The objective is not simply to discover more problems. It is to identify which combinations of problems could allow an attacker to move from initial access to meaningful control.
What Lacework Really Does
Lacework converts raw cloud telemetry into security context.
Its original Polygraph technology was designed to model relationships among users, processes, workloads, applications, cloud resources and network activity. The platform learned the normal behavior of an environment and used machine learning to identify deviations.
This behavioral model differentiated Lacework from cloud-security products built primarily around static policies. Static policies remain necessary for compliance and configuration management, but they cannot independently explain whether suspicious activity is part of a broader attack.
Lacework combined policy-based posture management with behavioral anomaly detection. It could identify a cloud resource that violated a security standard while also observing whether that resource was communicating abnormally, running an unusual process or interacting with a compromised identity.
Fortinet has extended this approach through integrations with FortiSOAR, FortiGuard threat intelligence and automated remediation. Current FortiCNAPP capabilities correlate behavioral analytics, anomaly detection, cloud-provider logs and threat intelligence into composite alerts intended to represent higher-confidence attack activity. Fortinet describes the integrated platform as a unified, AI-driven code-to-cloud security system.
Primary Operating Model: Cloud-Native Application Protection Platform
Current Product Identity: FortiCNAPP / Lacework FortiCNAPP
Current Parent Organization: Fortinet
Lacework addresses a structural problem created by cloud adoption. Enterprises frequently operate multiple cloud providers, thousands of changing assets, large Kubernetes environments, extensive identity systems and software-development pipelines that deploy new code continuously. Each layer can generate separate vulnerabilities, configuration failures, excessive permissions, compliance violations and security alerts.
When these risks are processed by disconnected tools, security teams receive large volumes of findings without enough context to determine which issues create a realistic path to compromise.
Lacework attempts to connect those findings.
The platform brings together cloud configurations, asset relationships, identity permissions, workload activity, vulnerabilities, code weaknesses, open-source dependencies and runtime behavior. This allows a security team to see not merely that a vulnerability exists, but whether the affected workload is publicly exposed, whether a reachable identity possesses dangerous permissions, whether abnormal activity is occurring and whether the combined conditions form an actionable attack path.
Founder
Bio
Lacework was founded in 2015 by Vikram Kapoor and Sanjay Kalra.
Vikram Kapoor served as Lacework’s founder and Chief Technology Officer. He helped establish the company’s data-driven approach to cloud security and the architecture behind its behavioral-analysis platform.
Sanjay Kalra served as co-founder and Chief Product Officer. He was closely associated with the development and commercialization of Lacework’s early cloud-security and compliance platform.
The founding thesis was that cloud security should adapt automatically to dynamic infrastructure rather than depend on security teams manually constructing and maintaining extensive sets of detection rules.
Jay Parikh was serving as Lacework’s CEO when the Fortinet acquisition was announced. Before joining Lacework, Parikh had led major engineering and infrastructure organizations, including infrastructure operations at Facebook.
Vikram Kapoor served as Lacework’s founder and Chief Technology Officer. He helped establish the company’s data-driven approach to cloud security and the architecture behind its behavioral-analysis platform.
Sanjay Kalra served as co-founder and Chief Product Officer. He was closely associated with the development and commercialization of Lacework’s early cloud-security and compliance platform.
The founding thesis was that cloud security should adapt automatically to dynamic infrastructure rather than depend on security teams manually constructing and maintaining extensive sets of detection rules.
Jay Parikh was serving as Lacework’s CEO when the Fortinet acquisition was announced. Before joining Lacework, Parikh had led major engineering and infrastructure organizations, including infrastructure operations at Facebook.
Headquarters
Mountain View, Santa Clara County, California, United States
Services & Solutions
Cloud Security Posture Management
Lacework provides continuous visibility into cloud resources, configurations and policy violations.
Its Cloud Security Posture Management capabilities discover assets across supported cloud environments and evaluate them against security policies, regulatory requirements and industry frameworks. Security teams can identify exposed storage, unprotected services, weak encryption settings, unrestricted network access and other configuration weaknesses.
Historical asset inventory allows organizations to understand how their cloud environment changed over time, including resources that may no longer exist when an incident is investigated.
The platform supports centralized visibility across AWS, Microsoft Azure, Google Cloud, Oracle Cloud Infrastructure and Kubernetes. This gives organizations a common control layer across multiple cloud providers rather than requiring separate security processes for each environment.
Cloud compliance capabilities can evaluate resources against frameworks and standards such as PCI DSS, HIPAA, NIST, ISO 27001, SOC 2 and CIS benchmarks. Fortinet continued updating FortiCNAPP’s compliance policies through 2026, indicating that the Lacework policy and compliance layer remains an actively maintained part of the current platform. Fortinet’s product documentation records ongoing policy updates across AWS, Azure, GCP and Kubernetes.
Cloud Infrastructure Entitlement Management
Cloud identities regularly accumulate more permissions than they use.
Lacework FortiCNAPP discovers human and machine identities, examines their effective permissions and compares granted access with observed activity. This allows the platform to identify users, roles and service accounts with unnecessary or dangerous privileges.
Each identity can be evaluated through multiple risk factors, including its permissions, access paths, activity and relationship with sensitive resources. Remediation guidance helps security teams reduce permissions and move toward least-privilege access.
This capability is particularly important in cloud-native environments where machine identities, access keys, automation services and application roles may significantly outnumber human users.
Cloud Workload and Kubernetes Protection
Posture management explains how a cloud environment is configured. Workload protection examines what is happening inside running systems.
Lacework supports agent-based and agentless approaches for monitoring cloud workloads. Workload telemetry can reveal processes, network connections, vulnerabilities, secrets and behavioral changes that would not be visible through cloud configuration data alone.
Kubernetes protection extends this visibility across clusters, nodes, containers and services. The platform can identify configuration risk, vulnerable workloads and abnormal runtime behavior in containerized environments.
This allows security teams to connect a Kubernetes configuration weakness with the workload running behind it, the vulnerability affecting that workload and any unusual activity indicating exploitation.
Code and Application Security
Lacework extends its coverage into the development lifecycle.
Static Application Security Testing analyzes first-party source code for weaknesses. Software Composition Analysis identifies known vulnerabilities and licensing risks in open-source libraries and third-party dependencies. Software Bill of Materials capabilities create visibility into the components contained inside an application.
Infrastructure as Code Security examines cloud configurations before infrastructure is deployed. It can identify misconfigured Terraform or other infrastructure definitions while they are still inside the development workflow.
These capabilities support a shift-left security model, but the larger objective is code-to-cloud traceability. A code vulnerability can be connected to the application, workload and cloud resource into which it was eventually deployed.
This reduces the separation between Application Security, DevSecOps and runtime Cloud Security.
Cloud Detection and Response
Cloud Detection and Response focuses on active behavior rather than theoretical exposure alone.
Lacework FortiCNAPP monitors cloud activity and workload behavior for deviations that may indicate compromised credentials, ransomware, cryptojacking, privilege escalation or unauthorized access.
Composite alerts combine multiple related signals into a single investigation. Behavioral analytics, anomaly detection, threat intelligence and cloud-service-provider telemetry are used to determine whether separate events may represent parts of the same attack.
Integrations with FortiSOAR allow response actions to be automated through playbooks. These actions can include responding to compromised hosts, restricting dangerous access keys or coordinating remediation across security and cloud teams.
FortiGuard Outbreak Alerts add context about new and emerging threats, allowing customers to examine whether relevant exposures exist within their own environment.
Vulnerability and Exposure Management
A vulnerability count does not explain business risk.
Cloud environments may contain thousands of vulnerabilities, many of which are unreachable, isolated or associated with noncritical assets. Treating every vulnerability as equally urgent produces remediation backlogs that security and engineering teams cannot realistically resolve.
Lacework adds environmental context.
A vulnerability becomes more significant when it affects an internet-facing workload, sits on a realistic attack path, contains accessible secrets or is connected to an identity with excessive permissions. Runtime activity can increase the priority further.
FortiCNAPP’s Security Graph presents relationships among assets and exposures so analysts can investigate how individual weaknesses combine. Its attack-path analysis draws on cloud configuration, workload data, vulnerabilities, secrets and identity relationships across AWS, Azure and Google Cloud environments.
This approach changes vulnerability management from a numerical exercise into an investigation of exploitable conditions.
Lacework provides continuous visibility into cloud resources, configurations and policy violations.
Its Cloud Security Posture Management capabilities discover assets across supported cloud environments and evaluate them against security policies, regulatory requirements and industry frameworks. Security teams can identify exposed storage, unprotected services, weak encryption settings, unrestricted network access and other configuration weaknesses.
Historical asset inventory allows organizations to understand how their cloud environment changed over time, including resources that may no longer exist when an incident is investigated.
The platform supports centralized visibility across AWS, Microsoft Azure, Google Cloud, Oracle Cloud Infrastructure and Kubernetes. This gives organizations a common control layer across multiple cloud providers rather than requiring separate security processes for each environment.
Cloud compliance capabilities can evaluate resources against frameworks and standards such as PCI DSS, HIPAA, NIST, ISO 27001, SOC 2 and CIS benchmarks. Fortinet continued updating FortiCNAPP’s compliance policies through 2026, indicating that the Lacework policy and compliance layer remains an actively maintained part of the current platform. Fortinet’s product documentation records ongoing policy updates across AWS, Azure, GCP and Kubernetes.
Cloud Infrastructure Entitlement Management
Cloud identities regularly accumulate more permissions than they use.
Lacework FortiCNAPP discovers human and machine identities, examines their effective permissions and compares granted access with observed activity. This allows the platform to identify users, roles and service accounts with unnecessary or dangerous privileges.
Each identity can be evaluated through multiple risk factors, including its permissions, access paths, activity and relationship with sensitive resources. Remediation guidance helps security teams reduce permissions and move toward least-privilege access.
This capability is particularly important in cloud-native environments where machine identities, access keys, automation services and application roles may significantly outnumber human users.
Cloud Workload and Kubernetes Protection
Posture management explains how a cloud environment is configured. Workload protection examines what is happening inside running systems.
Lacework supports agent-based and agentless approaches for monitoring cloud workloads. Workload telemetry can reveal processes, network connections, vulnerabilities, secrets and behavioral changes that would not be visible through cloud configuration data alone.
Kubernetes protection extends this visibility across clusters, nodes, containers and services. The platform can identify configuration risk, vulnerable workloads and abnormal runtime behavior in containerized environments.
This allows security teams to connect a Kubernetes configuration weakness with the workload running behind it, the vulnerability affecting that workload and any unusual activity indicating exploitation.
Code and Application Security
Lacework extends its coverage into the development lifecycle.
Static Application Security Testing analyzes first-party source code for weaknesses. Software Composition Analysis identifies known vulnerabilities and licensing risks in open-source libraries and third-party dependencies. Software Bill of Materials capabilities create visibility into the components contained inside an application.
Infrastructure as Code Security examines cloud configurations before infrastructure is deployed. It can identify misconfigured Terraform or other infrastructure definitions while they are still inside the development workflow.
These capabilities support a shift-left security model, but the larger objective is code-to-cloud traceability. A code vulnerability can be connected to the application, workload and cloud resource into which it was eventually deployed.
This reduces the separation between Application Security, DevSecOps and runtime Cloud Security.
Cloud Detection and Response
Cloud Detection and Response focuses on active behavior rather than theoretical exposure alone.
Lacework FortiCNAPP monitors cloud activity and workload behavior for deviations that may indicate compromised credentials, ransomware, cryptojacking, privilege escalation or unauthorized access.
Composite alerts combine multiple related signals into a single investigation. Behavioral analytics, anomaly detection, threat intelligence and cloud-service-provider telemetry are used to determine whether separate events may represent parts of the same attack.
Integrations with FortiSOAR allow response actions to be automated through playbooks. These actions can include responding to compromised hosts, restricting dangerous access keys or coordinating remediation across security and cloud teams.
FortiGuard Outbreak Alerts add context about new and emerging threats, allowing customers to examine whether relevant exposures exist within their own environment.
Vulnerability and Exposure Management
A vulnerability count does not explain business risk.
Cloud environments may contain thousands of vulnerabilities, many of which are unreachable, isolated or associated with noncritical assets. Treating every vulnerability as equally urgent produces remediation backlogs that security and engineering teams cannot realistically resolve.
Lacework adds environmental context.
A vulnerability becomes more significant when it affects an internet-facing workload, sits on a realistic attack path, contains accessible secrets or is connected to an identity with excessive permissions. Runtime activity can increase the priority further.
FortiCNAPP’s Security Graph presents relationships among assets and exposures so analysts can investigate how individual weaknesses combine. Its attack-path analysis draws on cloud configuration, workload data, vulnerabilities, secrets and identity relationships across AWS, Azure and Google Cloud environments.
This approach changes vulnerability management from a numerical exercise into an investigation of exploitable conditions.
Operational Focus
Methodology
Lacework’s methodology can be reduced to five connected actions: discover, understand, correlate, prioritize and respond.
Discovery creates an inventory of cloud assets, identities, workloads, containers, software components and configurations.
Understanding establishes relationships among those assets and determines expected behavior.
Correlation connects misconfigurations, vulnerabilities, permissions, abnormal activity and threat intelligence.
Prioritization identifies which combinations create meaningful exposure or indicate active compromise.
Response directs the issue to the appropriate security, cloud, infrastructure or development team and can automate selected remediation actions through the Fortinet Security Fabric.
The platform’s value therefore depends on context rather than raw finding volume. It is designed to reduce the operational distance between identifying a security weakness and understanding why that weakness matters.
Discovery creates an inventory of cloud assets, identities, workloads, containers, software components and configurations.
Understanding establishes relationships among those assets and determines expected behavior.
Correlation connects misconfigurations, vulnerabilities, permissions, abnormal activity and threat intelligence.
Prioritization identifies which combinations create meaningful exposure or indicate active compromise.
Response directs the issue to the appropriate security, cloud, infrastructure or development team and can automate selected remediation actions through the Fortinet Security Fabric.
The platform’s value therefore depends on context rather than raw finding volume. It is designed to reduce the operational distance between identifying a security weakness and understanding why that weakness matters.
Market Scope
Geography
Lacework was built primarily for organizations operating substantial public-cloud and cloud-native infrastructure.
The platform is relevant to technology companies, financial institutions, healthcare organizations, retailers, software providers, government contractors and other enterprises running workloads across AWS, Azure, Google Cloud, Oracle Cloud Infrastructure, Kubernetes and private-cloud environments.
Its strongest fit is within organizations that have separate cloud engineering, DevOps, application security, compliance and Security Operations teams. A unified CNAPP can provide these teams with a common representation of risk while allowing remediation responsibility to remain distributed.
Through Fortinet, Lacework technology now has access to a larger international customer base, channel network, threat-intelligence operation and integrated security portfolio.
The acquisition changed the corporate structure but expanded the potential distribution of the underlying technology.
Current Strategic Position
Lacework no longer competes as a venture-backed independent CNAPP company.
Its strategic role is now to provide the cloud-native application protection layer within the broader Fortinet Security Fabric. Fortinet acquired the platform, engineering expertise and a portfolio of 225 patents and patent applications, many related to cloud security and artificial intelligence.
This gives Fortinet a stronger code-to-cloud position alongside its existing network security, SASE, application security, endpoint, SIEM, SOAR and threat-intelligence capabilities.
The central integration question is whether Fortinet can preserve the data-driven depth and cloud-native usability that distinguished Lacework while connecting it to a much larger cybersecurity platform.
For existing Lacework customers, the acquisition offers greater scale and broader integrations but also introduces platform-consolidation considerations. Buyers should assess product-roadmap continuity, licensing, deployment architecture, support responsibilities and the degree to which individual Lacework capabilities are becoming native components of FortiCNAPP.
The platform is relevant to technology companies, financial institutions, healthcare organizations, retailers, software providers, government contractors and other enterprises running workloads across AWS, Azure, Google Cloud, Oracle Cloud Infrastructure, Kubernetes and private-cloud environments.
Its strongest fit is within organizations that have separate cloud engineering, DevOps, application security, compliance and Security Operations teams. A unified CNAPP can provide these teams with a common representation of risk while allowing remediation responsibility to remain distributed.
Through Fortinet, Lacework technology now has access to a larger international customer base, channel network, threat-intelligence operation and integrated security portfolio.
The acquisition changed the corporate structure but expanded the potential distribution of the underlying technology.
Current Strategic Position
Lacework no longer competes as a venture-backed independent CNAPP company.
Its strategic role is now to provide the cloud-native application protection layer within the broader Fortinet Security Fabric. Fortinet acquired the platform, engineering expertise and a portfolio of 225 patents and patent applications, many related to cloud security and artificial intelligence.
This gives Fortinet a stronger code-to-cloud position alongside its existing network security, SASE, application security, endpoint, SIEM, SOAR and threat-intelligence capabilities.
The central integration question is whether Fortinet can preserve the data-driven depth and cloud-native usability that distinguished Lacework while connecting it to a much larger cybersecurity platform.
For existing Lacework customers, the acquisition offers greater scale and broader integrations but also introduces platform-consolidation considerations. Buyers should assess product-roadmap continuity, licensing, deployment architecture, support responsibilities and the degree to which individual Lacework capabilities are becoming native components of FortiCNAPP.
