No more typing reviews! Try our Samantha, our new voice AI agent.

FortiCNAPP vs Proofpoint Intelligent Compliance Platform comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Feb 22, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Qualys TotalCloud
Sponsored
Average Rating
8.6
Reviews Sentiment
7.2
Number of Reviews
41
Ranking in other categories
Vulnerability Management (10th), Container Security (11th), Cloud Workload Protection Platforms (CWPP) (7th), Cloud Security Posture Management (CSPM) (7th), SaaS Security Posture Management (SSPM) (2nd), Cloud-Native Application Protection Platforms (CNAPP) (6th)
FortiCNAPP
Average Rating
8.2
Reviews Sentiment
6.7
Number of Reviews
17
Ranking in other categories
Vulnerability Management (29th), Container Security (17th), Cloud Workload Protection Platforms (CWPP) (13th), Cloud Security Posture Management (CSPM) (13th), Cloud-Native Application Protection Platforms (CNAPP) (12th), Compliance Management (9th)
Proofpoint Intelligent Com...
Average Rating
8.6
Reviews Sentiment
6.6
Number of Reviews
2
Ranking in other categories
Email Archiving (6th), eDiscovery (11th), Compliance Management (12th)
 

Featured Reviews

RO
IT Security Expert at Alior Bank S.A.
Unified risk scoring has improved our cloud visibility and simplifies remediation priorities
Qualys TotalCloud provides unified vulnerability and threat assessment across both IAS and SaaS. This solution provides a single prioritized view of risk, which helps reduce the work I would have to do. We are no longer based on CVSS; we are based on Qualys risk scoring, which is based on CVSS plus internal findings made by Qualys, and then assigns its own score. The TruRisk insight feature has found a small number of assets with high vulnerability scores, though I am cautious since some information is classified. Qualys TotalCloud has positively impacted our bank's performance, and we have definitely seen benefits after implementing this solution.
Charl Pinches - PeerSpot reviewer
Solutions Sales Specialist at a outsourcing company with 1,001-5,000 employees
Cloud risk has become visible and security teams prioritize and act on threats efficiently
FortiCNAPP can be improved because the platform can feel complex at the start, especially for teams new to CNAP tooling. Some users mention that they found the interface and data models less intuitive than expected, and I have had situations where reporting and alert configurations might require time. Regarding other improvements needed for FortiCNAPP, the majority of the time is that reporting and alert configuration might require time to tune properly. This is the significant issue, combined with the fact that some users find the interface and data model less intuitive than expected. Regarding FortiCNAPP's AI capabilities, I think there might be a bit of improvement needed. However, since Fortinet is a security vendor overall, keeping the data safe is not a problem. I know they have invested a lot in getting it to a place where it is a trusted platform.
reviewer2842215 - PeerSpot reviewer
Associate at a legal firm with 201-500 employees
Centralized archiving has transformed how we manage compliance, audits, and investigations
Overall Proofpoint Intelligent Compliance Platform is a strong platform for compliance and information governance, but there are a few areas where it could improve in the future. One improvement area is the user experience and interface consistency across different modules. Some workflows can feel complex, especially for a new user or the team managing multiple compliance functions simultaneously. Community feedback has also highlighted that certain administrative interfaces and navigation flows could be more modern and streamlined. I also think there is room for improvement in support responsiveness and operational simplicity for complex deployments. Some users in the community have mentioned challenges around the ticket response time and troubleshooting efficiency for advanced configurations that needs to be improved. From a product perspective, a continued investment in AI-driven detection, the reduction of false positives, and easier policy tuning would make the platform even more effective at scale. Proofpoint already provides strong automation and machine learning capabilities, but a highly regulated environment still requires significant tuning and oversight to optimize the workflow. One additional improvement for Proofpoint Intelligent Compliance Platform would be making policy configurations and workflow management more intuitive, especially for organizations with complex compliance structures and multiple regulatory requirements. I also think more customizable dashboards and reporting capabilities would help teams gain faster operational insight and improve visibility into the compliance trends, investigations, and reliable workload.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Qualys TotalCloud has helped us view our risk structure, vulnerabilities, and security posture."
"CSPM is currently the most used feature, and we are enjoying the new feature, FlexScan, which is valuable for Internet-facing VMs."
"I found the initial setup user-friendly."
"By integrating TotalCloud, we have significantly reduced vulnerabilities in our deployment pipeline."
"I would recommend Qualys TotalCloud to other users because it is cost-efficient and has a good return on investment."
"The scalability is good as well. I would rate it ten out of ten."
"The agent and agentless scanning in TotalCloud, particularly the FlexScan method, is incredibly valuable. With traditional scanning approaches, we had to give IP ranges and whitelist IPs. All that is now simplified. FlexScan requires minimal intervention, and after configuration, it automatically collects data and performs necessary scans."
"I would definitely recommend Qualys TotalCloud to other users."
"If you want to turn your cloud findings into actionable security work, FortiCNAPP is the way to go."
"FortiCNAPP definitely brings time-saving benefits, and security is the main concern for the company."
"The most valuable feature, from a compliance perspective, is the ability to use Lacework as a platform for multiple compliance standards. We have to meet multiple standards like PCI, SOC 2, CIS, and whatever else is out there. The ability to have reports generated, per security standard, is one of the best features for me."
"There are many valuable features that I use in my daily work. The first are alerts and the event dossier that it generates, based on the severity. That is very insightful and helps me to have a security cap in our infrastructure. The second thing I like is the agent-based vulnerability management, which is the most accurate information."
"For the most part, out-of-the-box, it tells you right away about the things you need to work on. I like the fact that it prioritizes alerts based on severity, so that you can focus your efforts on anything that would be critical/high first, moderate second, and work your way down, trying to continue to improve your security posture."
"The most valuable feature is Lacework's ability to distill all the security and audit logs. I recommend it to my customers. Normally, when I consult for other customers that are getting into the cloud, we use native security tools. It's more of a rule-based engine."
"The most valuable aspects are identifying vulnerabilities—things that are out there that we aren't aware of—as well as finding what path of access attackers could use, and being able to see open SSL or S3 buckets and the like."
"Polygraph compliance is a valuable feature. In our perspective, it delivers significant benefits. The clarity it offers, along with the ability to identify and address misconfigurations, is invaluable. When such issues arise, we promptly acknowledge and take action, effectively collaborating with our teams and the responsible parties for those assets. This enables us to promptly manage problems as soon as they arise."
"Overall, Proofpoint Intelligent Compliance Platform is a very strong and reliable platform for compliance, archiving, supervision, and information governance."
"Our experience with the platform has been positive as it has maintained consistent control over spam and malware threats."
 

Cons

"We encountered challenges identifying the correct resource category for certain items, such as those in containers or storage."
"The downside is only in container security, but it has not been a long time since they introduced these models."
"Qualys's ticketing system can be confusing when assigning tasks to individuals, and support could be improved by offering instant call solutions with engineers in addition to ticket replies."
"The support process is inefficient due to the excessive number of replies required when submitting tickets."
"To be honest, I would move out from this tool because it does not give a full view of vulnerability."
"In TotalCloud, I would suggest improvements in policy checks to cater to various inventory types like VPCs, subnets, S3 buckets, or IAMs. There is a lack of data segregation according to criticality or inventory."
"One of the things that could be improved is the alerts. Qualys is a fantastic tool, especially with the TruRisk feature, but one challenge that most leaders face involves alert fatigue."
"The response part of the Cloud Detection and Response (CDR) module can be improved."
"There are a couple of the difficulties we encounter in the realm of cybersecurity, or security as a whole, that relate to potentially limited clarity. Having the capacity to perceive the configuration aspect and having the ability to contribute to it holds substantial advantages, in my view. It ranks high, primarily due to its role in guaranteeing compliance and the potential to uncover vulnerabilities, which could infiltrate the system and introduce potential risks. I had been exploring a specific feature that captured my interest. However, just yesterday, I participated in a product update session that announced the imminent arrival of this feature. The feature involves real-time alerting. This was something I had been anticipating, and it seems that this capability is now being integrated, possibly as part of threat intelligence. While anomaly events consistently and promptly appear in the console, certain alerts tend to experience delays before being displayed. Yet, with the recent product update, this issue is expected to be resolved. Currently, a comprehensive view of all policies is available within the console. However, I want a more tailored display of my compliance posture, focusing specifically on policies relevant to me. For instance, if I'm not subject to HIPAA regulations, I'd prefer not to see the HIPAA compliance details. It's worth noting that even with this request, there exists a filtering mechanism to control the type of compliance information visible. This flexibility provides a workaround to my preference, which is why it's challenging for me to definitively state my exact request."
"Policy implementation is quite complex, and the stability will take more time for the solutions."
"FortiCNAPP can be improved because the platform can feel complex at the start, especially for teams new to CNAP tooling."
"Its integrations with third-party SIEMs can be better. That is one of the things that we discussed with them."
"The configuration and setup of alerts should be easier. They should make it easier to integrate with systems like Slack and Datadog. I didn't spend too much time on it, but to me, it wasn't as simple as the alerting that I've seen on other systems."
"The solution lacks a cohesive data model, making extracting the necessary data from the platform challenging. It uses its own LQL query language, and each database across different layers and modules is structured differently, complicating correlation efforts. Consequently, I had to create extensive custom reports outside Lacework because their default dashboards didn't communicate risk metrics. They're addressing these issues by redesigning their tools, including introducing the dashboard, which is a step closer to actionable insights but still needs refinement."
"The customer support for FortiCNAPP is fine, though it can take time as we need to engage with AWS first, but I would rate it around 7 or 8 out of 10."
"A feature that I have requested from them is the ability to sort alerts and policies based on a security framework. Right now, when you go into alerts, you have hundreds and hundreds of them that you have to manually pick. It would be useful to have categories for CIS Benchmark or SOC 2 and be able to display all the alerts and policies for one security framework."
"Some workflows can feel complex, especially for a new user or the team managing multiple compliance functions simultaneously."
"The Proofpoint Intelligent Compliance Platform does not provide features that help reduce manual efforts, so additional human resources are still required to manage security."
 

Pricing and Cost Advice

"Qualys TotalCloud offers cost-effective licensing flexibility."
"The cost is high, but it meets our organizational needs."
"Although Qualys TotalCloud is relatively expensive due to its unique automation features, its cost-effectiveness is rated an eight out of ten, with ten being the most costly."
"Qualys TotalCloud is expensive, but it offers a premier solution with no headaches."
"Qualys TotalCloud offers good pricing that is affordable and competitive with the market. Our partnership also provides us with additional benefits."
"While Qualys TotalCloud's pricing is currently acceptable, it is becoming increasingly expensive and may soon be considered overpriced."
"TotalCloud's price is about right where I would expect it to be."
"I am not sure about the pricing. From what I understand, it is a bit on the higher side, but I do not have the exact numbers."
"My smaller deployments cost around 200,000 a year, which is probably not as expensive as Wiz."
"The pricing has gotten better. That scenario was somewhat unstable. They have a rather interesting licensing structure. I believe you get 200 resources per "Lacework unit." It was difficult, in the beginning, to figure out exactly what a "resource" was... That was a problem until about a year or so ago. They have improved it and it has stabilized quite a bit."
"It is slightly expensive. It depends on how big your environment is, but it is expensive. Right now, we are spending a lot of money. We have covered all of the cloud providers and most of our colocation facilities as well, so we cannot complain, but it is slightly expensive. It is not super expensive."
"The licensing fee was approximately $80,000 USD, per year."
Information not available
report
Use our free recommendation engine to learn which Compliance Management solutions are best for your needs.
909,153 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Manufacturing Company
13%
Outsourcing Company
12%
Comms Service Provider
10%
Financial Services Firm
10%
Construction Company
9%
Financial Services Firm
8%
Comms Service Provider
8%
Computer Software Company
7%
Legal Firm
15%
Construction Company
15%
Financial Services Firm
14%
Comms Service Provider
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business11
Midsize Enterprise5
Large Enterprise30
By reviewers
Company SizeCount
Small Business9
Midsize Enterprise5
Large Enterprise8
No data available
 

Questions from the Community

What needs improvement with Qualys TotalCloud?
To be totally honest, I do not have any best features because I have had a bad experience using this tool, especially...
What is your primary use case for Qualys TotalCloud?
My main use case for Qualys TotalCloud is vulnerability management and exposure management. I use this tool to evalua...
What is your experience regarding pricing and costs for Lacework?
We purchased the Fortinet firewall and services from a vendor, not through any other marketplaces.
What needs improvement with Lacework?
FortiCNAPP can be improved because the platform can feel complex at the start, especially for teams new to CNAP tooli...
What is your primary use case for Lacework?
My main use case for FortiCNAPP, from my previous experience distributing it or now as a reseller, is for anyone who'...
What needs improvement with Proofpoint Intelligent Compliance Platform?
Overall Proofpoint Intelligent Compliance Platform is a strong platform for compliance and information governance, bu...
What is your primary use case for Proofpoint Intelligent Compliance Platform?
My main use case of Proofpoint Intelligent Compliance Platform is supporting compliance, information governance, and ...
What advice do you have for others considering Proofpoint Intelligent Compliance Platform?
Overall, Proofpoint Intelligent Compliance Platform is a very strong and reliable platform for compliance, archiving,...
 

Also Known As

Qualys TotalCloud with FlexScan
Polygraph, FortiCNP, Lacework
Proofpoint e-discovery and Analytics, Proofpoint Enterprise Archive
 

Overview

 

Sample Customers

Information Not Available
J.Crew, AdRoll, Snowflake, VMWare, Iterable, Pure Storage, TrueCar, NerdWallet, and more.
The Guardian Life Insurance Company of America
Find out what your peers are saying about FortiCNAPP vs. Proofpoint Intelligent Compliance Platform and other solutions. Updated: June 2026.
909,153 professionals have used our research since 2012.