- The team wants posture and anomaly context in one cloud-security platform: All tiers include multicloud posture, compliance, secrets and cloud-account behavior detection, while higher tiers add attack paths, identity, runtime, and data context.
- Security operations need broad routing and ticket synchronization: FortiCNAPP documents Jira bidirectional status handling plus channels for ServiceNow, Slack, Splunk, FortiSIEM, FortiSOAR, EventBridge, Security Hub, Datadog, QRadar, webhooks, and others.
Security & Privacy / Cloud Security Posture Management (CSPM) Software
Lacework FortiCNAPP Review, Pricing, Pros & Cons
Lacework FortiCNAPP is Fortinet's SaaS CNAPP whose cloud-security tiers all include CSPM and KSPM resource discovery, configuration management, custom policies, compliance reporting, and secrets detection, with advanced risk, attack-path, CIEM, workload, DSPM, and code-security capabilities gated or separately licensed.
Research by Global Tool Radar Research SystemEvidence checked: Aug 10, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Buying snapshot
Quick buying snapshot
A compact view of who this tool fits, what it costs, and what to confirm before choosing it.
- The buyer needs public direct pricing below the documented vCPU minimums: Only AWS Marketplace starter amounts are public; direct Standard, Professional, and Enterprise prices require a quote and have tier-specific MOQs.
- The purchase assumes code security, advanced DSPM, CIEM, CWPP, or managed services are part of every CSPM tier: The ordering matrix gates advanced CNAPP capabilities and explicitly separates Code Security and professional services.
- Sales-assisted cloud-security subscription licensed by protected compute resources measured in vCPUs, with Standard, Professional, and Enterprise packages. Direct SKUs offer one-, three-, or five-year terms and tier-specific minimums. Exact AWS Marketplace starter contracts are separately published for 12 months.
- Paid amounts unverified — check official pricing
- Current documentation identifies trial FortiCNAPP instances and usage preview, but no public duration, vCPU allowance, conversion rule, payment requirement, or eligibility was verified.
Product scope
Product functionality and purchase scope
This profile evaluates the current FortiCNAPP cloud-security platform's CSPM and KSPM entitlement. All cloud-security tiers include the posture baseline, while Professional and Enterprise add material risk, identity, workload, data, and operational capabilities. Separately purchasable Code Security and professional services are excluded from CSPM entitlement.
Product checked: Aug 10, 2026
- Standard, Professional, and Enterprise CSPM and KSPM resource discovery and configuration management
- Built-in and custom cloud posture policies, secrets detection, and compliance reporting in all cloud-security tiers
- AWS, Azure, Google Cloud, OCI, and supported Kubernetes posture inventory
- Cloud-account behavior detection and standard vulnerability risk scoring as documented in the cloud tiers
- Professional and Enterprise custom vulnerability risk scoring, CIEM, and attack-path analysis when that tier is purchased
- Enterprise runtime workload protection and advanced DSPM classification and exposure context when that tier is purchased
- FortiCare Premium included with the documented cloud-security SKUs
- Independently purchasable FortiCNAPP Code Security, including its SCA, SAST, DAST, SBOM, license compliance, secrets scanning, and code-pipeline scope
- Professional services, QuickStart, assessments, consulting, on-demand services, and designated cloud engineer SKUs
- FortiSOAR, FortiSIEM, FortiAnalyzer, FortiGate, Jira, Slack, ServiceNow, Splunk, Datadog, and other destination products unless separately licensed
- Professional and Enterprise features when only Standard is purchased
- Enterprise-only runtime workload protection and advanced data classification or data-exposure context when only Standard or Professional is purchased
- Managed security operations and findings remediation services
Pricing checked: Aug 10, 2026
- Fortinet direct cloud-security subscription: Quote-based Standard, Professional, or Enterprise per-vCPU subscription under a direct SKU.
- AWS Marketplace starter contracts: Public 12-month Standard, Pro, or Enterprise starter packs with route-specific vCPU allowances and no refunds.
- $25000 USD · per Standard starter subscription · per year · AWS Marketplace Standard starter · billed monthly · one-year commitment · minimum 1 starter pack · Standard starter pack covering up to 500 vCPUs through the exact AWS Marketplace listing
- $25000 USD · per Pro starter subscription · per year · AWS Marketplace Pro starter · billed monthly · one-year commitment · minimum 1 starter pack · Pro starter pack covering up to 334 vCPUs through the exact AWS Marketplace listing
- $25000 USD · per Enterprise starter subscription · per year · AWS Marketplace Enterprise starter · billed monthly · one-year commitment · minimum 1 starter pack · Enterprise starter pack covering up to 250 vCPUs through the exact AWS Marketplace listing
Pricing plans
Lacework FortiCNAPP pricing table
Pricing checked: Aug 10, 2026
Official factConfidence 99%2 linked sources
The direct ordering guide proves per-vCPU scope, Standard, Professional, and Enterprise editions, minimum order quantities, term choices, and entitlements but no amount or payment schedule. The separate AWS Marketplace route binds USD 25,000 to each 12-month Standard, Pro, or Enterprise starter pack, with tier-specific vCPU allowances and recurring monthly AWS billing.
Official pricing pagePricing cautions
- Keep direct and marketplace quantities separate: Professional has a 375-vCPU direct MOQ but only 334 vCPUs in the public AWS Pro starter pack; the two routes are not equivalent commercial states.
- Allocate package usage before comparing tiers: Subscription usage is tracked monthly by package and can be allocated to accounts or resource groups; removed packages can automatically fall back to the next lower subscribed package.
PlanPriceKey differencesBest for
FortiCNAPP StandardFortiCNAPP Standard cloud-security editionAmount unverified — check official pricing
- Protected compute: per vCPU; Agent and Resource Management configuration count toward consumption; DSPM and agentless workload scanning do not.
- Direct MOQ: 500; One-, three-, or five-year direct SKU; numeric price and payment timing require quote.
FortiCNAPP ProfessionalFortiCNAPP Professional cloud-security editionAmount unverified — check official pricing
- Direct MOQ: 375; One-, three-, or five-year direct SKU; numeric price and payment timing require quote.
- Advanced risk and identity: custom risk scoring, CIEM, attack paths, managed-Kubernetes threat detection; Cloud-security platform scope; workload runtime and advanced DSPM remain Enterprise.
FortiCNAPP EnterpriseFortiCNAPP Enterprise cloud-security editionAmount unverified — check official pricing
- Direct MOQ: 250; One-, three-, or five-year direct SKU; numeric price and payment timing require quote.
- Runtime and advanced data security: continuous runtime workload protection, advanced classification and malware detection, data-exposure risk; Code Security and services remain separate purchases.
Plan upgrade triggers
Verified plan boundaries that can change the required edition.
The organization needs custom vulnerability risk scoring, CIEM entitlement discovery and scoping guidance, attack-path dashboards and Exposure Polygraphs, or behavior-based threat detection for managed Kubernetes.
Supporting pricing evidenceThe organization needs continuous runtime workload monitoring, workload behavior and signature detection, file-integrity monitoring, FortiGuard-powered sensitive-data classification and malware detection, or data-exposure risk correlation.
Supporting pricing evidenceWhat is included, connected, or sold separately
Product scope
What is included, connected, or sold separately
Material capabilities are separated by their verified relationship to the target product.
CSPM and KSPM discovery, custom policy, secrets, and complianceRelationship not verified
The ordering matrix marks the posture baseline in all three cloud-security tiers.
Plan: FortiCNAPP Standard: Not verified · FortiCNAPP Professional: Not verified · FortiCNAPP Enterprise: Not verified
Cloud Infrastructure Entitlement ManagementRelationship not verified
CIEM is broader than baseline CSPM and is not included in Standard.
Plan: FortiCNAPP Standard: Not verified · FortiCNAPP Professional: Not verified · FortiCNAPP Enterprise: Not verifiedFortiCNAPP CIEM
Continuous workload runtime protectionRelationship not verified
Runtime monitoring, behavior and signature detection, and file-integrity monitoring are Enterprise CWPP-style scope, not baseline CSPM.
Plan: FortiCNAPP Standard: Not verified · FortiCNAPP Professional: Not verified · FortiCNAPP Enterprise: Not verifiedFortiCNAPP Workload Security
Exposure Polygraph attack-path analysisRelationship not verified
The tier and required configuration or workload inputs must both be satisfied.
Plan: FortiCNAPP Standard: Not verified · FortiCNAPP Professional: Not verified · FortiCNAPP Enterprise: Not verified
SCA, SAST, DAST, IaC security, SBOM, license compliance, and code secretsRelationship not verified
The guide says cloud security and Code Security are independent purchases.
FortiCNAPP Code Security
Sensitive-data classification, malware detection, and exposure riskRelationship not verified
Basic data discovery is shown more broadly, but advanced classification and exposure correlation are Enterprise.
Plan: FortiCNAPP Standard: Not verified · FortiCNAPP Professional: Not verified · FortiCNAPP Enterprise: Not verifiedFortiCNAPP DSPM
How the score is calculated
Scoring method
How the score is calculated
The score uses the category-specific buying dimensions below and their displayed weights.
This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.
- Evidence confidence
- 76%
- AI claim confidence
- 99%
- Required-field evidence status
- 100%
- Evidence freshness
- 54%
- Field traceability
- 100%
- Model agreement
- 92%
Why this confidence level
- Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
- Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
- 8 of 8 weighted claims have evidence links.
- 0 A1 documentary official sources and 10 A2 official product sources are linked.
- 1 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
- 4 weighted claims are past the review window.
- No blocking evidence conflict was identified.
Cloud coverage and visibility18%
83Allows inventory aggregation across up to 100 cloud accounts, though sovereign-cloud coverage is not publicly documented.
Detection and policy depth18%
81Delivers baseline custom policy creation and secrets detection across all packages, while reserving advanced identity threats and threat detection for Professional.
Risk prioritization and context16%
75Findings and exposure context are available on the CSPM baseline, but correlated attack-path and Exposure Polygraph risk context that blends vulnerability, network, secret, IAM, activity, and runtime signals requires Professional or Enterprise plus the necessary configuration and scanning inputs.
Remediation operations15%
67Operational remediation relies on guidance text, ticket handoff through supported channels, and AWS-focused CLI templates, which can close findings for prepared teams but does not establish fully automatic multi-cloud remediation execution.
Compliance and governance13%
80Supports continuous compliance reporting across multiple cloud-account structures, subject to provider-specific collection schedules.
Integrations and reporting10%
81Provides bilateral Jira synchronization and integrates with standard tools like Splunk and Slack, alongside PDF and CSV report exports.
Support and total cost10%
57Licensing is sales-assisted per protected vCPU with Standard, Professional, and Enterprise minimum order quantities and one-, three-, or five-year direct terms, yet no public direct numeric price exists, AWS Marketplace starter packs bind USD 25,000 for 12 months with different Professional quantities, and Code Security plus services remain separate purchases, so total cost requires quote validation.
Public review signals
FortiCNAPP has broad and favorable exact-successor review coverage
The retained aggregate is favorable and materially larger than many CSPM review samples. Visible reviews value centralized multicloud visibility, anomaly detection, compliance, straightforward cloud integration, and support; concerns include pricing, alert speed and tuning, documentation, setup, and uncertainty around newer Fortinet-era module integration.
Public review signals updated: Aug 10, 2026
Commonly reported strengths
- Centralized cloud posture, workload, identity, and compliance visibility
- Behavior and anomaly context can reduce low-value noise
- Cloud onboarding and ongoing support are often viewed favorably
Commonly reported concerns
- Pricing can be high for broad environments
- Initial setup, documentation, and alert tuning may require effort
- Some advanced modules and Fortinet ecosystem integrations need careful entitlement validation
Gartner Peer Insights4.5/5
- Rating count
- 238 ratings
- Source context
- FortiCNAPP on Gartner Peer InsightsDocumented product successor
Marketplace app signals
Marketplace app signals
These source-reported ratings describe a specific marketplace listing, integration, mobile app, or add-on. They do not automatically represent the complete software product.
AWS Marketplace4.4/5
- Rating count
- 394 ratings
- Evaluated scope
- Full product listing
- Storefront
- AWS Marketplace
Lacework FortiCNAPP tag profile
Company size
- Enterprise
- Mid-market
Lacework FortiCNAPP core capabilities
- AWS, Azure, Google Cloud, OCI, and Kubernetes posture inventory
- Daily inventory history, related resources, configuration changes, exposure, findings, and attack-path context
- Built-in and custom compliance or violation policies with remediation details
- Broad regulatory and provider framework reporting with PDF and CSV exports
- Professional and Enterprise Exposure Polygraphs correlating vulnerability, network, secret, IAM, activity, and runtime inputs
- Jira bidirectional issue status plus broad alert-channel ecosystem
Detailed strengths and purchase cautions
Why it is worth considering
- Every Standard, Professional, and Enterprise cloud-security tier includes CSPM and KSPM resource discovery, configuration management, custom policies, secrets detection, and compliance reporting.
- Posture inventory spans AWS, Azure, Google Cloud, OCI, and Kubernetes with daily inventory history, related-resource links, configuration-change tracking, exposure, and findings.
- Built-in and custom compliance or violation policies support broad regulatory and provider framework reporting with PDF and CSV exports.
- Professional and Enterprise Exposure Polygraphs correlate vulnerability, network, secret, IAM, activity, and runtime inputs to support attack-path context beyond baseline findings.
What to confirm before buying
- Direct numeric prices and payment schedules are not public, so buyers must obtain Fortinet quotes and separately compare the published AWS Marketplace 12-month starter packs priced at USD 25,000 with tier-specific vCPU allowances.
- Attack-path analysis is available only on Professional or Enterprise and still depends on cloud configuration plus workload scanning or agents.
- Continuous runtime workload protection and advanced sensitive-data classification and exposure prioritization remain Enterprise entitlements rather than baseline CSPM features.
- Remediation is centered on guidance details, ticketing integrations, and AWS-focused CLI templates rather than fully automatic universal remediation across all clouds.
Cross-model buying perspectives
Multi-AI review
Cross-model buying perspectives
Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.
AI assessment updated: Sep 21, 2026
Score comparisonGeminixAIGPTRange
Cloud coverage and visibility8285814
Detection and policy depth8084795
Risk prioritization and context7873735
Remediation operations74666014
Compliance and governance8080800
Integrations and reporting8383776
Support and total cost70544624
cspm cloud misconfig detection8586788
cspm cloud compliance policy8082822
cspm risk prioritization context7874744
cspm remediation guidance workflow75686213
cspm multicloud operability8588844
- Support and total cost: 46–70 (24-point range)
- Remediation operations: 60–74 (14-point range)
- cspm remediation guidance workflow: 62–75 (13-point range)
GeminiAI-assisted buyer perspective79
A cloud security posture management platform that aggregates configuration inventory and compliance across major cloud providers, requiring buyers to balance tier-specific capabilities like attack paths against divergent direct and marketplace licensing minimums.
- Review confidence
- 79/100
Model details
- Strengths
- Supports continuous inventory and configuration tracking across AWS, Azure, Google Cloud, OCI, and Kubernetes.
- Includes built-in compliance frameworks and custom policy options with PDF and CSV export formats.
- Features bidirectional Jira ticketing integration alongside alerts for Slack, ServiceNow, and Splunk.
- Cautions
- Gates advanced attack-path analysis, custom vulnerability scoring, and Exposure Polygraphs behind the Professional and Enterprise tiers.
- Requires local collector installations and provider collection schedules for Kubernetes compliance rather than operating on a purely API-only model.
- Limits command-line remediation templates primarily to the AWS Remediate CLI.
xAIAI-assisted buyer perspective77
Lacework FortiCNAPP delivers CSPM and KSPM resource discovery, configuration management, custom policies, secrets detection, and compliance reporting in every cloud-security tier for AWS, Azure, Google Cloud, OCI, and Kubernetes estates, while attack-path context and CIEM require Professional or higher and runtime workload plus advanced data exposure require Enterprise; buyers must validate vCPU minimums, quote-based direct pricing versus AWS Marketplace 12-month starter packs, and separate Code Security licensing.
- Review confidence
- 77/100
Model details
- Strengths
- Every Standard, Professional, and Enterprise cloud-security tier includes CSPM and KSPM resource discovery, configuration management, custom policies, secrets detection, and compliance reporting.
- Posture inventory spans AWS, Azure, Google Cloud, OCI, and Kubernetes with daily inventory history, related-resource links, configuration-change tracking, exposure, and findings.
- Built-in and custom compliance or violation policies support broad regulatory and provider framework reporting with PDF and CSV exports.
- Professional and Enterprise Exposure Polygraphs correlate vulnerability, network, secret, IAM, activity, and runtime inputs to support attack-path context beyond baseline findings.
- Cautions
- Direct numeric prices and payment schedules are not public, so buyers must obtain Fortinet quotes and separately compare the published AWS Marketplace 12-month starter packs priced at USD 25,000 with tier-specific vCPU allowances.
- Attack-path analysis is available only on Professional or Enterprise and still depends on cloud configuration plus workload scanning or agents.
- Continuous runtime workload protection and advanced sensitive-data classification and exposure prioritization remain Enterprise entitlements rather than baseline CSPM features.
- Remediation is centered on guidance details, ticketing integrations, and AWS-focused CLI templates rather than fully automatic universal remediation across all clouds.
GPTAI-assisted buyer perspective73
Lacework FortiCNAPP fits buyers that want CSPM and KSPM across major public clouds and Kubernetes, plus compliance reporting and behavior-based cloud context, but it requires checking edition boundaries because advanced risk, remediation depth, runtime workload protection, and some data-security capabilities move to higher tiers or separate purchases.
- Review confidence
- 73/100
Model details
- Strengths
- The Standard, Professional, and Enterprise cloud-security tiers all include CSPM and KSPM resource discovery, configuration management, custom policies, secrets detection, and compliance reporting, which supports a baseline posture and compliance program in every edition.
- The product covers AWS, Azure, Google Cloud, OCI, and Kubernetes posture inventory, which supports buyers operating mixed-cloud estates rather than a single-provider footprint.
- The platform provides daily inventory history, related resources, configuration changes, exposure, findings, and attack-path context, which can help teams investigate why a posture finding matters in operational terms.
- The reporting package includes broad regulatory and provider framework reporting with PDF and CSV exports, which supports audit evidence collection and internal compliance workflows.
- Cautions
- Direct pricing is not public, so procurement has to rely on a quote for the standard ordering path rather than a posted list price.
- Attack-path analysis depends on Professional or Enterprise, so teams that need that capability cannot treat Standard as a complete posture-to-risk package.
- Runtime workload security and advanced data-security functions are Enterprise capabilities, so baseline CSPM buyers should not assume those workflows are included at lower tiers.
- Remediation is guided rather than fully automatic, because the facts describe AWS Remediate CLI templates, command-line guidance, tickets, and cloud-provider permissions rather than universal one-click fixes.
Research transparency
How this page was researched
A compact record of the evidence used, what was not tested, and which conclusions still need verification.
- Official sources
- 10
- Broad product review sources
- 1
- Marketplace and app-store sources
- 1
- Editorial sources
- 0
- Latest evidence check
- Aug 10, 2026
Research basis
Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.
Conflict handlingNo unresolved evidence conflict is currently recorded.
View research methodologyVerified findingsCurrent documentation identifies trial FortiCNAPP instances and usage preview, but no public duration, vCPU allowance, conversion rule, payment requirement, or eligibility was verified.
- Sales-assisted cloud-security subscription licensed by protected compute resources measured in vCPUs, with Standard, Professional, and Enterprise packages. Direct SKUs offer one-, three-, or five-year terms and tier-specific minimums. Exact AWS Marketplace starter contracts are separately published for 12 months.
- AWS, Azure, Google Cloud, OCI, and Kubernetes posture inventory Daily inventory history, related resources, configuration changes, exposure, findings, and attack-path context Built-in and custom compliance or violation policies with remediation details Broad regulatory and provider framework reporting with PDF and CSV exports Professional and Enterprise Exposure Polygraphs correlating vulnerability, network, secret, IAM, activity, and runtime inputs Jira bidirectional issue status plus broad alert-channel ecosystem AWS Remediate CLI templates and command-line guidance Organizations aggregating compliance, alerts, access, users, resource groups, and audit logs across up to 100 accounts
- No public direct-plan numeric starting price is published; verified AWS Marketplace starter prices are route-specific purchase-path offers.
- The direct ordering guide proves per-vCPU scope, Standard, Professional, and Enterprise editions, minimum order quantities, term choices, and entitlements but no amount or payment schedule. The separate AWS Marketplace route binds USD 25,000 to each 12-month Standard, Pro, or Enterprise starter pack, with tier-specific vCPU allowances and recurring monthly AWS billing.
Verification notes and unresolved itemsVerified on 2026-08-10 from current Fortinet product pages, FortiCNAPP ordering guide, Fortinet documentation, and the exact AWS Marketplace listing.
- Numeric Offers are limited to marketplace states where amount, 12-month unit, recurring AWS billing, contract, tier, vCPU allowance, and exact-product scope are jointly proven.
- Direct amounts are withheld.
- CSPM is scored at its documented tier scope without importing separate Code Security, services, or higher-tier CIEM, CWPP, DSPM, and attack-path entitlements into Standard.
- The three USD 25,000 starter prices are preserved only on the AWS Marketplace purchase path.
Sources checked
Sources checked
Lacework FortiCNAPP source links
Fortinet FortiCNAPPAmazon Web Services, Inc.Level A2Linked to 4 scored claimsChecked Aug 10, 2026
Organization OverviewFortinet, Inc.Level A2Linked to 0 scored claimsChecked Aug 10, 2026
Install Lacework FortiCNAPP Remediate CLI ComponentFortinet, Inc.Level A2Linked to 0 scored claimsChecked Aug 10, 2026
Jira Alert ChannelFortinet, Inc.Level A2Linked to 0 scored claimsChecked Aug 10, 2026
Attack Path AnalysisFortinet, Inc.Level A2Linked to 1 scored claimChecked Aug 10, 2026
Managing PoliciesFortinet, Inc.Level A2Linked to 0 scored claimsChecked Aug 10, 2026
Compliance FrameworksFortinet, Inc.Level A2Linked to 0 scored claimsChecked Aug 10, 2026
Using the Resource InventoryFortinet, Inc.Level A2Linked to 0 scored claimsChecked Aug 10, 2026
FAQ
Lacework FortiCNAPP FAQ
Is CSPM included in every FortiCNAPP cloud-security tier?
Yes. The current ordering guide marks CSPM and KSPM resource discovery, configuration management, custom policies, secrets detection, and compliance reporting in Standard, Professional, and Enterprise.
What requires Professional or Enterprise?
Professional adds custom vulnerability scoring, CIEM, attack paths, and managed-Kubernetes threat detection. Enterprise adds continuous runtime workload protection and advanced sensitive-data classification and exposure context.
Is FortiCNAPP Code Security part of the CSPM purchase?
No by default. The ordering guide describes Cloud Security and Code Security as independently purchasable parts and gives Code Security its own developer-based SKU.
Why is the starting price USD 25,000?
That amount is bound only to the exact AWS Marketplace 12-month starter offers. Direct Fortinet prices are not public, even though direct vCPU units, minimums, and term choices are documented.
Popular comparisons
Common Lacework FortiCNAPP comparisons
Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.