No more typing reviews! Try our Samantha, our new voice AI agent.

FortiCNAPP vs VulnCheck comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Feb 22, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

FortiCNAPP
Ranking in Vulnerability Management
33rd
Average Rating
8.4
Reviews Sentiment
6.7
Number of Reviews
13
Ranking in other categories
Container Security (27th), Cloud Workload Protection Platforms (CWPP) (17th), Cloud Security Posture Management (CSPM) (21st), Cloud-Native Application Protection Platforms (CNAPP) (16th), Compliance Management (10th)
VulnCheck
Ranking in Vulnerability Management
50th
Average Rating
8.4
Reviews Sentiment
6.2
Number of Reviews
3
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of May 2026, in the Vulnerability Management category, the mindshare of FortiCNAPP is 1.8%, up from 1.3% compared to the previous year. The mindshare of VulnCheck is 0.3%, up from 0.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Vulnerability Management Mindshare Distribution
ProductMindshare (%)
FortiCNAPP1.8%
VulnCheck0.3%
Other97.9%
Vulnerability Management
 

Featured Reviews

Mark Freeborough - PeerSpot reviewer
Client Manager at MLL Telecom Ltd
Network segmentation has strengthened access control and now streamlines automated threat response
The most valuable features in FortiCNAPP include robust network segmentation and restricting access to network assets. It also supports security measures by leveraging security fabrics for better enforcement and policy enforcement. FortiCNAPP integrates with SIEM solutions, and we offer different SIEM options that work with Fortinet and AlienVault, among others, providing multiple scenarios.FortiCNAPP's automated policy recommendations significantly help improve security measures as part of an overall service wrap. When deploying a Fortinet SD-WAN or network, these tools provide greater visibility to vulnerabilities and enhanced security on the network. It functions as a proactive tool, enabling me to identify threats quickly and automate responses.
reviewer2805510 - PeerSpot reviewer
Partner Account Manager at a wholesaler/distributor with 51-200 employees
Proactive exploit intelligence has transformed how we prioritize real-world vulnerability risks
VulnCheck needs improvement in terms of data. It is primarily an intelligence and data layering system and not a complete vulnerability management platform. This means that it lacks native patch workflows, so you do not have asset discovery as you would with Tenable or Qualys. You will require other tools to act on the data that you find, which necessitates engineering time for API integration, data mapping, and tuning. Additionally, not all exploit signs are clear; some can be noisy or ambiguous, so teams need to apply their judgment. Finally, the time to value is not instant; it requires integration, workflow changes, and team training. I think VulnCheck is an excellent tool and valuable data resource. However, if you wish to send alerts via an API to platforms like Rapid7 or Tenable VM, you will need to integrate that with a SIEM solution to perform any kind of risk management.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"There are many valuable features that I use in my daily work. The first are alerts and the event dossier that it generates, based on the severity. That is very insightful and helps me to have a security cap in our infrastructure. The second thing I like is the agent-based vulnerability management, which is the most accurate information."
"The compliance reports are definitely most valuable because they save time and are accurate. So, instead of relying on a human going through and checking or providing me with a report, I could just log into Lacework and see for myself."
"The most valuable feature is Lacework's ability to distill all the security and audit logs. I recommend it to my customers. Normally, when I consult for other customers that are getting into the cloud, we use native security tools. It's more of a rule-based engine."
"FortiCNAPP definitely brings time-saving benefits, and security is the main concern for the company."
"Polygraph compliance is a valuable feature. In our perspective, it delivers significant benefits. The clarity it offers, along with the ability to identify and address misconfigurations, is invaluable. When such issues arise, we promptly acknowledge and take action, effectively collaborating with our teams and the responsible parties for those assets. This enables us to promptly manage problems as soon as they arise."
"The most valuable aspects are identifying vulnerabilities—things that are out there that we aren't aware of—as well as finding what path of access attackers could use, and being able to see open SSL or S3 buckets and the like."
"FortiCNAPP is a competitive and robust solution, the only one in the IT sphere that addresses all quadrants in the Gartner Quadrants."
"The most valuable feature, from a compliance perspective, is the ability to use Lacework as a platform for multiple compliance standards. We have to meet multiple standards like PCI, SOC 2, CIS, and whatever else is out there. The ability to have reports generated, per security standard, is one of the best features for me."
"VulnCheck has shifted the mindset within my organization and my partners from a reactive to a more proactive approach."
"With VulnCheck's early exploit visibility, I can remediate vulnerabilities quickly, making timely decisions before the vulnerabilities are known to the public and hackers."
"The clear prioritization based on risk is probably the biggest day-to-day benefit."
 

Cons

"Visibility is lacking, and both compliance-related metrics and IAM security control could be improved."
"The solution lacks a cohesive data model, making extracting the necessary data from the platform challenging. It uses its own LQL query language, and each database across different layers and modules is structured differently, complicating correlation efforts. Consequently, I had to create extensive custom reports outside Lacework because their default dashboards didn't communicate risk metrics. They're addressing these issues by redesigning their tools, including introducing the dashboard, which is a step closer to actionable insights but still needs refinement."
"The biggest thing I would like to see improved is for them to pursue and obtain a FedRAMP moderate authorization... I don't believe they have any immediate plans to get FedRAMP moderate authorized, which is a bit of a challenge for us because we can only use Lacework in our commercial environment."
"Policy implementation is quite complex, and the stability will take more time for the solutions."
"I would like to see a remote access assistance feature. And the threat-hunting platform could be better."
"A feature that I have requested from them is the ability to sort alerts and policies based on a security framework. Right now, when you go into alerts, you have hundreds and hundreds of them that you have to manually pick. It would be useful to have categories for CIS Benchmark or SOC 2 and be able to display all the alerts and policies for one security framework."
"There are a couple of the difficulties we encounter in the realm of cybersecurity, or security as a whole, that relate to potentially limited clarity. Having the capacity to perceive the configuration aspect and having the ability to contribute to it holds substantial advantages, in my view. It ranks high, primarily due to its role in guaranteeing compliance and the potential to uncover vulnerabilities, which could infiltrate the system and introduce potential risks. I had been exploring a specific feature that captured my interest. However, just yesterday, I participated in a product update session that announced the imminent arrival of this feature. The feature involves real-time alerting. This was something I had been anticipating, and it seems that this capability is now being integrated, possibly as part of threat intelligence. While anomaly events consistently and promptly appear in the console, certain alerts tend to experience delays before being displayed. Yet, with the recent product update, this issue is expected to be resolved. Currently, a comprehensive view of all policies is available within the console. However, I want a more tailored display of my compliance posture, focusing specifically on policies relevant to me. For instance, if I'm not subject to HIPAA regulations, I'd prefer not to see the HIPAA compliance details. It's worth noting that even with this request, there exists a filtering mechanism to control the type of compliance information visible. This flexibility provides a workaround to my preference, which is why it's challenging for me to definitively state my exact request."
"In general, I would not recommend Lacework right now. There are more mature solutions that would be a better fit."
"VulnCheck's UI and reporting can be improved for better visibility."
"VulnCheck needs improvement in terms of data."
 

Pricing and Cost Advice

"The licensing fee was approximately $80,000 USD, per year."
"The pricing has gotten better. That scenario was somewhat unstable. They have a rather interesting licensing structure. I believe you get 200 resources per "Lacework unit." It was difficult, in the beginning, to figure out exactly what a "resource" was... That was a problem until about a year or so ago. They have improved it and it has stabilized quite a bit."
"My smaller deployments cost around 200,000 a year, which is probably not as expensive as Wiz."
"It is slightly expensive. It depends on how big your environment is, but it is expensive. Right now, we are spending a lot of money. We have covered all of the cloud providers and most of our colocation facilities as well, so we cannot complain, but it is slightly expensive. It is not super expensive."
Information not available
report
Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.
894,738 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
11%
Computer Software Company
8%
Manufacturing Company
7%
Construction Company
6%
Outsourcing Company
22%
Construction Company
15%
Computer Software Company
8%
Insurance Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business6
Midsize Enterprise4
Large Enterprise4
No data available
 

Questions from the Community

What is your experience regarding pricing and costs for Lacework?
The pricing is a mediator compared to other products; it is not that much higher and not much lower than other products, making it a very affordable price.
What needs improvement with Lacework?
Policy implementation is quite complex, and the stability will take more time for the solutions. There is definitely room for improvement in policy implementation.
What is your primary use case for Lacework?
FortiCNAPP is mainly used from a security point of view. Some VPNs charge for their solutions, but Fortinet provides a free-of-cost VPN solution, making it more reliable and cost-effective for clie...
What needs improvement with VulnCheck?
VulnCheck needs improvement in terms of data. It is primarily an intelligence and data layering system and not a complete vulnerability management platform. This means that it lacks native patch wo...
What is your primary use case for VulnCheck?
Over the year and a half that I have been dealing with VulnCheck, I have also worked with numerous similar solutions. I know the market and understand the similarities and what VulnCheck can do, wh...
What advice do you have for others considering VulnCheck?
VulnCheck has shifted the mindset within my organization and my partners from a reactive to a more proactive approach. By contextualizing vulnerabilities and understanding how people get breached, ...
 

Also Known As

Polygraph, FortiCNP, Lacework
No data available
 

Overview

 

Sample Customers

J.Crew, AdRoll, Snowflake, VMWare, Iterable, Pure Storage, TrueCar, NerdWallet, and more.
Information Not Available
Find out what your peers are saying about FortiCNAPP vs. VulnCheck and other solutions. Updated: May 2026.
894,738 professionals have used our research since 2012.