Lacework FortiCNAPP vs Qualys VMDR comparison

Fortinet and Qualys are both solutions in the Vulnerability Management category. Fortinet is ranked #16 with an average rating of 8.7, while Qualys is ranked #2 with an average rating of 8.2. Fortinet holds a 1.5% mindshare in VM, compared to Qualys’s 11.4% mindshare. Additionally, 90% of Fortinet users are willing to recommend the solution, compared to 94% of Qualys users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Dec 12, 2024

Qualys VMDR and Lacework FortiCNAPP compete in the vulnerability management software category. Qualys VMDR is favored for its comprehensive features, while Lacework FortiCNAPP stands out with its strong compliance and anomaly detection capabilities.

Features: Qualys VMDR offers continuous monitoring, cloud-based scanning, and detailed reporting, valued for identifying and prioritizing vulnerabilities. Users appreciate its integration capabilities and user-friendly dashboard. Lacework FortiCNAPP is recognized for anomaly detection and compliance capabilities, providing comprehensive security compliance checks and real-time monitoring, which simplify complex data presentation.

Room for Improvement: Qualys VMDR requires improvements in complex asset management and reporting customization, especially for IoT and SCADA environments. Users express the need for better false-positive management and a more streamlined user experience. Lacework FortiCNAPP needs enhanced integration with third-party SIEMs and better reporting customization. Users also desire improvements in alerting, communication of changes, and cloud data governance support.

Ease of Deployment and Customer Service: Qualys VMDR offers diverse deployment options, from on-premises to cloud-based models, but receives mixed reviews for customer support. While some users commend its responsiveness, others seek faster solutions. Lacework FortiCNAPP, primarily cloud-based, is praised for its straightforward deployment and high satisfaction in customer service, despite lacking on-premises flexibility.

Pricing and ROI: Qualys VMDR's pricing is generally considered high; however, users justify the cost due to significant improvements in vulnerability management and overall ROI. Lacework FortiCNAPP's pricing is perceived as somewhat expensive, yet users value its clear licensing structure, particularly for security monitoring and cloud compliance. Both tools are seen as valuable investments, though pricing remains an influential factor for many organizations.

To learn more, read our detailed Lacework FortiCNAPP vs. Qualys VMDR Report (Updated: November 2024).

Buyer's Guide

Lacework FortiCNAPP vs. Qualys VMDR

November 2024

Download the complete report

Helped 823,875 peers since 2012

Categories and Ranking

SentinelOne Singularity Clo...

Mindshare comparison

As of December 2024, in the Vulnerability Management category, the mindshare of SentinelOne Singularity Cloud Security is 1.3%, up from 0.3% compared to the previous year. The mindshare of Lacework FortiCNAPP is 1.5%, down from 2.1% compared to the previous year. The mindshare of Qualys VMDR is 11.4%, down from 13.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Vulnerability Management

Featured Reviews

Andrew W

VP - Information Technology at a financial services firm with 201-500 employees

Tells us about vulnerabilities as well as their impact and helps to focus on real issues

Looking at all the different pieces, it has got everything we need. Some of the pieces we do not even use. For example, we do not have Kubernetes Security. We are not running any K8 clusters, so it is good for us. Overall, we find the solution to be fantastic. There can be additional education components. This may not be truly fair to them because of what the product is going for, but it would be great to see additional education for compliance. It is not a criticism of the tool per se, but anything to help non-development resources understand some of the complexities of the cloud is always appreciated. Any additional educational resources are always helpful for security teams, especially those without a development background.

Read full review

Robert Croteau

Director of Enablement at Avesha

It provides a good overview of our security posture

The most valuable feature is Lacework's ability to distill all the security and audit logs. I recommend it to my customers. Normally, when I consult for other customers that are getting into the cloud, we use native security tools. It's more of a rule-based engine. They have to go in and put their policies in place. It's hard for them to implement that, especially if they don't have a real security team. The team's policymakers don't do anything. Lacework takes out all the noise and gives them bits of things that actually matter with the application after it learns the behavior.

Read full review

Harold Jensen

Senior Cybersecurity Engineer at 3M Health Information Systems

Good visibility but expensive and needs better support

Support: It's often overseas and often following a script, basically asking us to redo what we opened the case with. Multiple APIs: There seems to be a lack of easy onboarding into Qualys. We had to use manual inputs and some API calls to get items in place. Dashboard: It is very rudimentary with very little customization. The Qualys Scripting Language (QSL) works differently in different Qualys modules, so when you get it working in one area you have to modify the syntax in others. User account management: We often have to give users more rights than needed just to give them what they need. Integration with the various Qualys Modules: You can tell the UI is different based on of the different teams that created them. QSL syntax same in all modules Responsiveness of some of the components: They time out, you get a blank screen, etc. Backend updates between the various modules: You update connectors and information takes a few minutes to show in VMDR or Global Asset View Connectors: Connectors have a throttling issue with AWS which causes them to frequently fail unless you manually run them again.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Cloud Native Security is user-friendly. Everything in the Cloud Native Security tool is straightforward, including detections, integration, reporting, etc. They are constantly improving their UI by adding plugins and other features."

"Cloud Native Security offers a valuable tool called an offensive search engine."

"The most valuable feature of the solution is its storyline, which helps trace an event back to its source, like an email or someone clicking on a link."

"The most valuable aspect of Singularity Cloud Security is its unified dashboard."

"The key strength of Singularity Cloud Security lies in its ability to pinpoint vulnerabilities in our cloud accounts and identify suspicious activity that warrants further investigation."

"There's real-time threat detection. It can show threats and find issues based on their severity and helps us with real-time monitoring."

"The UI is responsive and user-friendly."

"Singularity Cloud Security's most valuable features are its ease of scalability and comprehensive security measures."

More SentinelOne Singularity Cloud Security pros

"The compliance reports are definitely most valuable because they save time and are accurate. So, instead of relying on a human going through and checking or providing me with a report, I could just log into Lacework and see for myself."

"There are many valuable features that I use in my daily work. The first are alerts and the event dossier that it generates, based on the severity. That is very insightful and helps me to have a security cap in our infrastructure. The second thing I like is the agent-based vulnerability management, which is the most accurate information."

"Lacework is helping a lot in reducing the noise of the alerts. Usually, whenever you have a tool in place, you have a lot of noise in terms of alerts, but the time for an engineer to look into those alerts is limited. Lacework is helping us to consolidate the information that we are getting from the agents and other sources. We are able to focus only on the things that matter, which is the most valuable thing for us. It saves time, and for investigations, we have the right context to take action."

"The most valuable aspects are identifying vulnerabilities—things that are out there that we aren't aware of—as well as finding what path of access attackers could use, and being able to see open SSL or S3 buckets and the like."

"The best feature, in my opinion, is the ease of use."

"For the most part, out-of-the-box, it tells you right away about the things you need to work on. I like the fact that it prioritizes alerts based on severity, so that you can focus your efforts on anything that would be critical/high first, moderate second, and work your way down, trying to continue to improve your security posture."

"I find the cloud configuration compliance scanning mature. It generates a lot of data and supports major frameworks like ISO 27001 or SOC 2, providing reports and datasets. Another feature I appreciate is setting custom alerts for specific events. Additionally, I value the agent-based monitoring and scanning for compute nodes. It gives us deeper insights into our workloads and helps identify vulnerabilities across our deployed assets."

"Polygraph compliance is a valuable feature. In our perspective, it delivers significant benefits. The clarity it offers, along with the ability to identify and address misconfigurations, is invaluable. When such issues arise, we promptly acknowledge and take action, effectively collaborating with our teams and the responsible parties for those assets. This enables us to promptly manage problems as soon as they arise."

More Lacework FortiCNAPP pros

"Performs automated, regular scans in the network."

"The most valuable feature is the ability to run different capabilities with the same agent. With only one agent, we can have EDR, vulnerability management, compliance and some basic SaaS security capabilities."

"It's really beneficial for scanning and interacting with the agent."

"It is a stable solution."

"Vulnerability management is the most valuable one and it’s a must in every organization."

"The reporting is fine."

"It is a simple solution that makes scanning easy. You just give it a scheduled task, and it will do everything for you."

"The prioritization feature is great. I think it has all of the advanced features that we need."

More Qualys VMDR pros

Cons

"We've found a lot of false positives."

"There is room for improvement in the current active licensing model for PingSafe."

"It took us a while to configure the software to work well in this type of environment, as the support documents were not always clear."

"Once all components, including the cloud piece and container runtime piece, integrate further and incorporate an AI layer for better comprehension, it will greatly enhance the utility of Singularity Cloud Security."

"The cost has the potential for improvement."

"PingSafe can be improved by developing a comprehensive set of features that allow for automated workflows."

"I would like PingSafe to add real-time detection of vulnerabilities and cloud misconfigurations."

"I would like additional integrations."

More SentinelOne Singularity Cloud Security cons

"Visibility is lacking, and both compliance-related metrics and IAM security control could be improved."

"I would like to see a remote access assistance feature. And the threat-hunting platform could be better."

"There are a couple of the difficulties we encounter in the realm of cybersecurity, or security as a whole, that relate to potentially limited clarity. Having the capacity to perceive the configuration aspect and having the ability to contribute to it holds substantial advantages, in my view. It ranks high, primarily due to its role in guaranteeing compliance and the potential to uncover vulnerabilities, which could infiltrate the system and introduce potential risks. I had been exploring a specific feature that captured my interest. However, just yesterday, I participated in a product update session that announced the imminent arrival of this feature. The feature involves real-time alerting. This was something I had been anticipating, and it seems that this capability is now being integrated, possibly as part of threat intelligence. While anomaly events consistently and promptly appear in the console, certain alerts tend to experience delays before being displayed. Yet, with the recent product update, this issue is expected to be resolved. Currently, a comprehensive view of all policies is available within the console. However, I want a more tailored display of my compliance posture, focusing specifically on policies relevant to me. For instance, if I'm not subject to HIPAA regulations, I'd prefer not to see the HIPAA compliance details. It's worth noting that even with this request, there exists a filtering mechanism to control the type of compliance information visible. This flexibility provides a workaround to my preference, which is why it's challenging for me to definitively state my exact request."

"Lacework has not reduced the number of alerts we get. We've actually had to add resources as a result of using it because the application requires a lot of people to understand it to get the value out of it properly."

"The biggest thing I would like to see improved is for them to pursue and obtain a FedRAMP moderate authorization... I don't believe they have any immediate plans to get FedRAMP moderate authorized, which is a bit of a challenge for us because we can only use Lacework in our commercial environment."

"Lacework lacks remediation features, but I believe they're working on that. They're focused on the reporting aspect, but other features need to improve. They're also adding some compliance features, so it's not worth saying they need to get better at it."

"A feature that I have requested from them is the ability to sort alerts and policies based on a security framework. Right now, when you go into alerts, you have hundreds and hundreds of them that you have to manually pick. It would be useful to have categories for CIS Benchmark or SOC 2 and be able to display all the alerts and policies for one security framework."

"The configuration and setup of alerts should be easier. They should make it easier to integrate with systems like Slack and Datadog. I didn't spend too much time on it, but to me, it wasn't as simple as the alerting that I've seen on other systems."

More Lacework FortiCNAPP cons

"Support could be improved since the response can be slow."

"Qualys VMDR identifies vulnerabilities and suggests fixes. However, it does not automate patching unless the patch management module is purchased separately."

"When you want to cover yourself for scalability, you will be charged for the number you place on the scan itself."

"It is a struggle to be able to pull our report and to be able to do onboarding using automated tools."

"The price could be better. Asset view is still a legacy feature. I'm not able to extract the information about the asset with complete details. It would be better if they fixed that in the next release. I know Qualys is already working on it, so I'm hopeful it will be available in the next five or six months. That would be something that's changed where I seek improvement."

"Endpoint stability and fault resolution could be improved."

"There's a need to upgrade or fix the potential vulnerability rate. Around 20,000 potential vulnerabilities were showing in Qualys VMDR, but none of the other tools showed them. When we checked, it wasn't the case. Support explained that even small issues were being counted as vulnerabilities, causing issues in our audit. So, the security features could be improved to identify vulnerabilities accurately."

"It's quite complex on the way it is set up, so it takes a fair bit of time in order to get your head around it in order to deploy it. Once you've deployed it, then you're never confident on the versions of the browsers and the SSL certificates, etc. You have to always go back into Qualys and check."

More Qualys VMDR cons

Pricing and Cost Advice

"The pricing is fair. It is not inexpensive, and it is also not expensive. When managing a large organization, it is going to be costly, but it meets the business needs. In terms of what is out there on the market, it is fair and comparable to what I have seen, so I do not have any complaints about the cost"

"Their pricing appears to be based simply on the number of accounts we have, which is common for cloud-based products."

"Its pricing is constant. It has been constant over the previous year, so I am happy with it. However, price distribution can be better explained. That is the only area I am worried about. Otherwise, the pricing is very reasonable."

"Singularity Cloud Workload Security's licensing and price were cheaper than the other solutions we looked at."

"SentinelOne provided competitive pricing compared to other vendors, and we are satisfied with the deal."

"Its pricing was a little less than other providers."

"I would rate the cost a seven out of ten with ten being the most costly."

"The tool is cost-effective."

More SentinelOne Singularity Cloud Security pricing and cost advice

"The pricing has gotten better. That scenario was somewhat unstable. They have a rather interesting licensing structure. I believe you get 200 resources per "Lacework unit." It was difficult, in the beginning, to figure out exactly what a "resource" was... That was a problem until about a year or so ago. They have improved it and it has stabilized quite a bit."

"My smaller deployments cost around 200,000 a year, which is probably not as expensive as Wiz."

"It is slightly expensive. It depends on how big your environment is, but it is expensive. Right now, we are spending a lot of money. We have covered all of the cloud providers and most of our colocation facilities as well, so we cannot complain, but it is slightly expensive. It is not super expensive."

"The licensing fee was approximately $80,000 USD, per year."

"It's very expensive, especially if you want to use multiple modules of Qualys."

"The product is more expensive than that of any other vendor."

"The solution is expensive."

"The solution is costly."

"It is a high cost product. Compared to the other solutions, it is around 15 to 20% higher in cost."

"In Nigerian Naira, we spend about roughly four to five million to use this solution and this is expensive compared to solutions like Nessus."

"The license is on a yearly basis."

"I used to work there, so I never paid for the product. As an employee, we get a lifetime license for personal use, and that's what I'm using. It is a comprehensive platform, so there is a lot more to it. There could be other solutions that are probably a little bit cheaper, but it depends on what people need. Different people have different needs. It offers many things on the same platform. If you add all the things up, it should be cheaper, but I have not done any analysis specifically."

More Qualys VMDR pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.

See recommendations

823,875 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

19%

Financial Services Firm

15%

Manufacturing Company

Government

Computer Software Company

18%

Financial Services Firm

13%

Manufacturing Company

Retailer

Educational Organization

36%

Computer Software Company

11%

Financial Services Firm

10%

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about PingSafe?

The dashboard gives me an overview of all the things happening in the product, making it one of the tool's best featu...

See all answers

What is your experience regarding pricing and costs for PingSafe?

SentinelOne provided competitive pricing compared to other vendors, and we are satisfied with the deal.

See all answers

What needs improvement with PingSafe?

To enhance the notification system's efficiency, resolved issues should be promptly removed from the portal. Currentl...

See all answers

What do you like most about Lacework?

Polygraph compliance is a valuable feature. In our perspective, it delivers significant benefits. The clarity it offe...

See all answers

What is your experience regarding pricing and costs for Lacework?

My smaller deployments cost around 200,000 a year, which is probably not as expensive as Wiz.

See all answers

What needs improvement with Lacework?

The solution lacks a cohesive data model, making extracting the necessary data from the platform challenging. It uses...

See all answers

What is your primary use case for Qualys VM?

Qualys VM is used for vulnerability scans for the internet and applications using application exchange. There are man...

See all answers

What do you like most about Qualys VMDR?

I like that we have many scanners and channels that don't overload. It helps us scan and track easily. Also, the tagg...

See all answers

What is your experience regarding pricing and costs for Qualys VMDR?

For smaller enterprises, the pricing is on the pricier side. However, for larger enterprises, it's considered okay. I...

See all answers

Comparisons

Wiz vs SentinelOne Singularity Cloud Security

Compared 31% of the time

Prisma Cloud by Palo Alto Networks vs SentinelOne Singularity Cloud Security

Compared 23% of the time

AWS GuardDuty vs SentinelOne Singularity Cloud Security

Compared 8% of the time

Orca Security vs SentinelOne Singularity Cloud Security

Compared 6% of the time

Deepfence ThreatMapper vs SentinelOne Singularity Cloud Security

Compared 2% of the time

More SentinelOne Singularity Cloud Security Competitors

Wiz vs Lacework FortiCNAPP

Compared 29% of the time

Prisma Cloud by Palo Alto Networks vs Lacework FortiCNAPP

Compared 14% of the time

AWS GuardDuty vs Lacework FortiCNAPP

Compared 9% of the time

Aqua Cloud Security Platform vs Lacework FortiCNAPP

Compared 5% of the time

Trivy vs Lacework FortiCNAPP

Compared 2% of the time

More Lacework FortiCNAPP Competitors

Tenable Nessus vs Qualys VMDR

Compared 18% of the time

Rapid7 InsightVM vs Qualys VMDR

Compared 9% of the time

Microsoft Defender Vulnerability Management vs Qualys VMDR

Compared 9% of the time

Tenable Security Center vs Qualys VMDR

Compared 8% of the time

Wiz vs Qualys VMDR

Compared 5% of the time

More Qualys VMDR Competitors

Product Reports

Buyer's Guide

SentinelOne Singularity Cloud Security

October 2024

SentinelOne Singularity Cloud Security report

Download SentinelOne Singularity Cloud Security product report

Buyer's Guide

Lacework FortiCNAPP

December 2024

Download Lacework FortiCNAPP product report

Buyer's Guide

Qualys VMDR

November 2024

Download Qualys VMDR product report

Also Known As

PingSafe

Polygraph, FortiCNP

Qualys VM, QualysGuard VM, Qualys Asset Inventory, Qualys Container Security, Qualys Virtual Scanner Appliance

Learn More

SentinelOne

Fortinet

Qualys

Overview

SentinelOne Singularity Cloud Security protects cloud workloads, offering advanced threat detection and automated response. It integrates seamlessly with cloud environments and secures containerized applications and virtual machines against vulnerabilities.

SentinelOne Singularity Cloud Security is renowned for its efficiency in mitigating threats in real-time. The platform integrates effortlessly with existing cloud environments, ensuring robust cloud security management with minimal manual intervention. Securing containerized applications and virtual machines, it excels in threat intelligence and endpoint protection. However, improvements are needed in performance during high workload periods, and more integrations with third-party tools and better documentation would be beneficial. Users often find the installation process complex, support response times slow, and the dashboard's navigation unintuitive.

What are the key features of SentinelOne Singularity Cloud Security?

Real-time Threat Detection: Identifies and mitigates threats as they occur.
Automated Response: Automatically responds to threats to minimize impact.
Ease of Deployment: Simple setup process with scalable options.
Machine Learning Insights: AI-driven insights enhance threat prevention.
Seamless Integration: Integrates with cloud environments for unified security management.

What are the primary benefits or ROI to expect from SentinelOne Singularity Cloud Security?

Enhanced Threat Mitigation: Improved security against real-time threats.
Reduced Manual Intervention: Automated processes save time and resources.
Scalability: Easily adapts to growing security requirements.
Centralized Management: Manage security across platforms from a single console.
Advanced Threat Intelligence: Provides in-depth analysis and protection.

In specific industries, SentinelOne Singularity Cloud Security is implemented to safeguard critical data and infrastructure. Organizations in finance, healthcare, and technology depend on its real-time threat detection and automated response to protect sensitive information. Its ability to secure containerized applications and virtual machines is particularly valuable in dynamic environments where rapid scaling is necessary.

Lacework FortiCNAPP provides robust cloud security, combining vulnerability management and multi-cloud insight with user-friendly controls, machine learning detection, and compliance support.

Lacework FortiCNAPP specializes in cloud security by merging machine learning anomaly detection with agent-based vulnerability management to offer detailed alerts and compliance reports. Its comprehensive approach allows continuous monitoring across AWS and Kubernetes, providing insights from an attacker's perspective. The platform offers automation and seamless Slack integration, facilitating collaborative and efficient cloud security management. Users value its ability to handle multi-cloud environments and scan IAC scripts, configurations, and compute nodes across AWS and GCP.

What are the key features?

Machine Learning Detection: Identifies anomalies effectively.
Compliance Reports: Provides precise compliance documentation.
Vulnerability Management: Supports agent-based vulnerability assessments.
Multi-Cloud Support: Manages and secures across multiple cloud providers.
Automation and Collaboration: Enables integration with Slack for streamlined communication.
Custom Alerts: Allows creation of personalized alerts for better focus.

What benefits do users expect?

Reduced Alert Noise: Minimizes distractions with filtered alerts.
Efficient Cloud Security: Automates processes for enhanced security management.
Collaboration Support: Integrates with tools like Slack.
Insightful Perspective: Provides insight from an attacker's viewpoint.

Organizations across sectors leverage Lacework FortiCNAPP for cloud security, focusing on compliance, security posture, and vulnerability management. It is widely used for monitoring AWS and Kubernetes environments, scanning IAC scripts, configurations, and securing compute nodes. It supports multi-cloud security posture management and log ingestion, enabling companies to maintain strong cloud infrastructures without dedicated security layers.

Vulnerability Management, Detection, and Response (VMDR) is a cornerstone product of the Qualys TruRisk Platform and a global leader in the enterprise-grade vulnerability management (VM) vendor space. With VMDR, enterprises are empowered with visibility and insight into cyber risk exposure - making it easy to prioritize vulnerabilities, assets, or groups of assets based on business risk. Security teams can take action to mitigate risk, helping the business measure their actual risk exposure over time.

Qualys VMDR offers an all-inclusive risk-based vulnerability management solution to prioritize vulnerabilities and assets based on risk and business criticality. VMDR seamlessly integrates with configuration management databases (CMDB), Qualys Patch Management, Custom Assessment and Remediation (CAR), Qualys TotalCloud and other Qualys and non-Qualys solutions to facilitate vulnerability detection and remediation across the entire enterprise.

With VMDR, users are empowered with actionable risk insights that translate vulnerabilities and exploits into optimized remediation actions based on business impact. Qualys customers can now aggregate and orchestrate data from the Qualys Threat Library, 25+ threat intelligence feeds, and third-party security and IT solutions, empowering organizations to measure, communicate, and eliminate risk across on-premises, hybrid, and cloud environments.

Sample Customers

Information Not Available

J.Crew, AdRoll, Snowflake, VMWare, Iterable, Pure Storage, TrueCar, NerdWallet, and more.

Agrokor Group, American Specialty Health, American State Bank, Arval, Life:), Axway, Bank of the West, Blueport Commerce, BSkyB, Brinks, CaixaBank, Cartagena, Catholic Health System, CEC Bank, Cegedim, CIGNA, Clickability, Colby-Sawyer College, Commercial Bank of Dubai, University of Utah, eBay Inc., ING Singapore, National Theatre, OTP Bank, Sodexo, WebEx

Buyer's Guide

Lacework FortiCNAPP vs. Qualys VMDR

November 2024

Free Report: Lacework FortiCNAPP vs. Qualys VMDR

Find out what your peers are saying about Lacework FortiCNAPP vs. Qualys VMDR and other solutions. Updated: November 2024.

DOWNLOAD NOW

823,875 professionals have used our research since 2012.

See our Lacework FortiCNAPP vs. Qualys VMDR report.

See our list of best Vulnerability Management vendors and best Container Security vendors.

We monitor all Vulnerability Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.