Lacework FortiCNAPP: Cloud-Native Application Protection Platform

Name: Lacework FortiCNAPP: Cloud-Native Application Protection Platform
Uploaded: 2026-06-28T12:39:12-04:00
Duration: 4 min 35 s
Description: Introducing #Fortinet's Lacework #FortiCNAPP, the most comprehensive cloud-native application protection platform available. Lacework FortiCNAPP helps quickly manage risk, rapidly detect and respond to active threats, boost developer productivity and ...

Fortinet

06/28/2026

0 (0%)

Report Like Favorite

Transcript

day, we're all aiming for the same thing. To protect our teams and avoid the financial, brand and operational impact of malicious actors in our systems. To build higher walls against intruders and limit the effect of anyone who does make it through the defenses. At Lacework, our approach is to both prevent security incidents from occurring and also prepare you to react to those that do arise. Our cloud security platform does this uniquely by analyzing massive amounts of data to give teams the context necessary to take faster and more decisive action. Let's take a look at how it works. When dealing with a security incident, the first thing a security team should assess is whether or not an attack is still in progress. In this case, let's use the alert category filter to show us composite alerts, which identify critical security incidents that present an immediate threat to your cloud environment. This feature is unique because it detects hard-to-uncover malicious activity by combining specific indicators of compromise into highly accurate, detailed alerts. Composite alerts answer the two main questions a security team has after a security breach. What did the attacker do and what does this mean? We see through these series of alerts that the incident was a cloud-native ransomware attack. This alert provides access to key details like the exact cloud identity the attackers were able to compromise. And we can quickly investigate to see that the identity unfortunately had full admin privileges. Now we have all the details we'll need to immediately neutralize the threat, finding attackers during or after an attack is far from ideal. Thankfully, the Lacework platform also has capabilities to help you prevent attackers from even getting in the door. Let's see how Lacework would have helped prevent the earlier worst-case scenario from occurring. When we start our research and click on the Compliance tab, we see a list of known bad things for which your cloud environment could be configured. We can see it's auditing all of our access keys, and out of our seven keys, there are four that have not been rotated in the last 90 days. Next we'll look at Vulnerabilities. Here we can see our vulnerable hosts. Click on the specific host you want to learn more about. Then you can look at which CVEs, or Critical Vulnerabilities, are running on which packages. Under the Fixed Version column, we can see which version we need to update the system to in order to get it to a safe state. One key Lacework feature, Active Package Detection, lets us know whether a vulnerable package is actively running and being used by an application on your host, so we can prioritize fixing those packages first. We can easily see these by filtering the Package Status column. Next we'll look at Identities. If you click on Explore Identities at the top, we can see a list of all the identities we have in our accounts. We see that several of these are high severity risks, and we can also see why they are so risky. To help you understand the relationships among all of the resources and services in your cloud, we have the Lacework Explorer. With interactive visuals, this feature makes it easy to see and prioritize the potential risks associated with each resource. A host with a vulnerability may matter less if it's not misconfigured to be exposed to the public internet. But if that same host has an admin identity behind it, it becomes much more important to address that vulnerability right away. So let's click on Attack Paths on the left-hand side and investigate the path that attackers could take. Now we'll drill down into the top risky paths with the Admin Privilege role. We can see that from the public internet, there is a path an attacker could take through the internet gateway, through the security group. We see that this security group has two compliance, or configuration errors, which could give the attacker access to this host. It shows us that if the host did not have a certain identity associated with it with very broad access privileges, it wouldn't be as risky. So now we have a simple action to take to make our cloud safer. What sets Lacework apart isn't just the vast amount of data we handle. It's how we transform that data into actionable information through our advanced analytics.

TL;DR

Lacework FortiCNAPP combines threat detection and prevention in a single cloud-native application protection platform, using advanced analytics to transform massive data volumes into actionable security insights.
Composite alerts correlate multiple indicators of compromise to detect sophisticated attacks like cloud-native ransomware, providing security teams with immediate context on attacker actions and business impact.
Active Package Detection prioritizes vulnerability remediation by identifying which vulnerable packages are actually running in production, reducing alert fatigue and focusing effort where it matters.
Attack path visualization maps potential intrusion routes from the public internet through misconfigurations to privileged identities, enabling targeted hardening of the most critical exposure points.

Unified Cloud Security Through Data-Driven Detection

Lacework FortiCNAPP positions itself as a comprehensive cloud-native application protection platform that combines threat prevention with incident response capabilities. The platform's core differentiator is its approach to analyzing massive amounts of cloud telemetry data to provide security teams with contextual insights for faster decision-making. The demonstration walks through a cloud-native ransomware attack scenario, showcasing how composite alerts combine multiple indicators of compromise into detailed, actionable notifications that answer critical questions: what did the attacker do, and what does this mean for the organization. This correlation capability aims to surface hard-to-detect malicious activity that might otherwise be missed by traditional point solutions.

Proactive Risk Management and Attack Path Analysis

Beyond detection, the platform emphasizes preventive security through continuous compliance monitoring, vulnerability management, and identity risk assessment. The compliance module audits cloud configurations against known security anti-patterns, such as identifying access keys that haven't been rotated within 90 days. The vulnerability management feature includes Active Package Detection, which prioritizes remediation by identifying whether vulnerable packages are actively running in production environments. Perhaps most notably, the Lacework Explorer provides visual attack path analysis, mapping how an attacker could traverse from the public internet through security groups and misconfigured hosts to reach privileged identities—transforming abstract risk scores into concrete remediation actions.

Chapters

0:00 - Introduction and Platform Overview
0:54 - Composite Alerts and Threat Detection
1:53 - Prevention Capabilities
2:21 - Vulnerability Management
3:00 - Identity Risk Assessment
3:44 - Attack Path Analysis

Key Quotes

0:33 "At Lacework, our approach is to both prevent security incidents from occurring and also prepare you to react to those that do arise."
1:11 "This feature is unique because it detects hard-to-uncover malicious activity by combining specific indicators of compromise into highly accurate, detailed alerts."
2:45 "One key Lacework feature, Active Package Detection, lets us know whether a vulnerable package is actively running and being used by an application on your host, so we can prioritize fixing those packages first."
4:19 "What sets Lacework apart isn't just the vast amount of data we handle. It's how we transform that data into actionable information through our advanced analytics."

FAQ

How does Lacework FortiCNAPP prioritize which vulnerabilities to fix first?

The platform uses Active Package Detection to identify whether vulnerable packages are actively running and being used by applications on your hosts. Combined with attack path analysis that considers factors like public internet exposure and associated identity privileges, teams can focus remediation efforts on vulnerabilities that present actual exploitable risk rather than theoretical exposure.

What makes composite alerts different from traditional security alerts?

Composite alerts correlate multiple indicators of compromise into single, detailed notifications that identify critical security incidents presenting immediate threats. Rather than generating separate alerts for each suspicious activity, the system combines related signals to answer what the attacker did and what it means for your environment, reducing alert fatigue while surfacing hard-to-detect malicious activity.

Categories:

Tags:

Show more Show less

Browse videos

Upcoming Webinar Calendar

11/12/2026

01:00 PM

11/12/2026

Leaving VMware Means Leaving vSAN: Your VMware Exit Is Really a Storage Decision

https://www.truthinit.com/index.php/channel/2192/leaving-vmware-means-leaving-vsan-your-vmware-exit-is-really-a-storage-decision/
11/12/2026

01:00 PM

11/12/2026

Practical Session: Connecting On-Prem Data to Databricks Using MinIO AIStor (Americas)

https://www.truthinit.com/index.php/channel/2202/practical-session-connecting-on-prem-data-to-databricks-using-minio-aistor-americas/
11/18/2026

08:00 AM

11/18/2026

Hands-On Workshop: Connecting On-Prem Data to Databricks via MinIO AIStor (International)

https://www.truthinit.com/index.php/channel/2194/hands-on-workshop-connecting-on-prem-data-to-databricks-via-minio-aistor-international/
11/19/2026

01:00 PM

11/19/2026

Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection

https://www.truthinit.com/index.php/channel/2076/securing-the-microsoft-enterprise-strengthening-configuration-management-identity-security-and-data-protection/
11/19/2026

01:00 PM

11/19/2026

Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents

https://www.truthinit.com/index.php/channel/2181/zendesk-deep-dive-get-the-work-done-faster-with-employee-service-ai-agents/
11/19/2026

01:00 PM

11/19/2026

A Deep Dive into Muse, Dots, and Duet's Impact on Your Website

https://www.truthinit.com/index.php/channel/2228/a-deep-dive-into-muse-dots-and-duets-impact-on-your-website/
12/02/2026

04:00 AM

12/02/2026

Skylight en acción: salvaguardando la IA más allá del usuario.

https://www.truthinit.com/index.php/channel/2147/skylight-en-acción-salvaguardando-la-ia-más-allá-del-usuario/
12/03/2026

01:00 PM

12/03/2026

CISO Insights: Steering Cybersecurity Strategies in an AI-Driven Era

https://www.truthinit.com/index.php/channel/2231/ciso-insights-steering-cybersecurity-strategies-in-an-ai-driven-era/
01/19/2027

04:00 AM

01/19/2027

Skylight in Aktion: Gewährleisten Sie KI-Schutz über den Benutzer hinaus

https://www.truthinit.com/index.php/channel/2176/skylight-in-aktion-gewährleisten-sie-ki-schutz-über-den-benutzer-hinaus/
01/19/2027

02:00 PM

01/19/2027

HUMAN Dialogue: Embracing the Rise of the Empowered AI Consumer.

https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-rise-of-the-empowered-ai-consumer/
03/18/2027

01:00 PM

03/18/2027

Securing Access for People, Partners and AI Agents

https://www.truthinit.com/index.php/channel/2251/securing-access-for-people-partners-and-ai-agents/
06/17/2027

01:00 PM

06/17/2027

Stop the Leak: Data Loss Prevention for the AI Era

https://www.truthinit.com/index.php/channel/955/360view-stop-the-leak-data-loss-prevention-for-the-ai-era/
08/19/2027

01:00 PM

08/19/2027

Who Has Access to What...and Should They?

https://www.truthinit.com/index.php/channel/2252/who-has-access-to-what-and-should-they/
10/21/2027

01:00 PM

10/21/2027

After VMware: Building the Private Cloud You Actually Want

https://www.truthinit.com/index.php/channel/2253/after-vmware-building-the-private-cloud-you-actually-want/
11/18/2027

01:00 PM

11/18/2027

Assume Breach, Prove Recovery

https://www.truthinit.com/index.php/channel/2254/assume-breach-prove-recovery/
12/16/2027

01:00 PM

12/16/2027

The Self-Running Service Desk

https://www.truthinit.com/index.php/channel/2255/the-self-running-service-desk/