About Lacework
Lacework is an AI-powered cloud security platform that uses behavioral analytics and anomaly detection to protect multi-cloud environments. Now part of Fortinet, Lacework provides cloud security posture management, cloud workload protection, and infrastructure-as-code security through its Polygraph Data Platform. The platform establishes behavioral baselines across cloud workloads and network traffic, then uses machine learning to detect deviations that indicate threats, reducing alert fatigue by surfacing only genuine security events.
Pros & Cons
Pros
- Exceptional behavioral analytics reduce false positives significantly
- Strong infrastructure-as-code scanning
- Composite alerts reduce alert fatigue
- Good Kubernetes and container security
- Fortinet integration adds network security context
Cons
- Agent-based approach for workload protection
- Learning period required for behavioral baselines
- Smaller ecosystem compared to CrowdStrike or Palo Alto
- UI can be complex for new users
Key Features
Polygraph Behavioral Analytics
Machine learning engine that builds behavioral baselines and detects anomalies across cloud workloads and network traffic
Cloud Security Posture Management
Continuous assessment of cloud configurations against security best practices and compliance standards
Cloud Workload Protection
Agent-based runtime protection with vulnerability scanning for VMs, containers, and serverless
Infrastructure-as-Code Security
Scans Terraform, CloudFormation, and Kubernetes manifests for misconfigurations before deployment
Composite Alerts
Correlates related events into single composite alerts to reduce noise and accelerate investigation
Cloud Activity Monitoring
Monitors API calls, user behavior, and resource changes across AWS, Azure, and GCP
Container & Kubernetes Security
Build-time and runtime security for container images and Kubernetes clusters