Looking for a cloud security platform that can handle our scale. Environment is split 50/50 between AWS (ECS, EKS, RDS) and on-prem VMware/Kubernetes. Need to monitor all of it.
Priorities:
* Agent-based and agentless coverage for both environments.
* Compliance benchmarks (SOC2, PCI) out of the box.
* Must integrate with existing CI/CD (GitLab, Jenkins) and infra-as-code (Terraform).
* Cost predictability is critical. We got burned by per-host billing elsewhere.
Considering Lacework. Anyone running it at this scale? Specifically:
* How's the agent performance on hybrid workloads?
* Real cost for ~500 cloud instances + ~500 on-prem VMs?
* Any gaps in the container runtime security?
I'm a senior security engineer at a fintech with about 1200 employees, managing a deployment at your exact scale (split AWS/on-prem, same tech stack) for the last two years. We migrated off Lacework about 18 months ago.
**Cost predictability & hybrid billing:** They'll call it "workload-based," but it's per-host per-month with a confusing multiplier for containers. For your mix, expect a starting quote between $180k-$220k annually before you even negotiate. The on-prem sensor licensing was the real sticker shock for us; it was nearly double what we'd budgeted.
**Agent performance on hybrid:** The agent itself is lightweight, but the management overhead for the on-prem sensor/gateway tier is not. We needed three VMs (8 vCPU, 16GB RAM each) just for the collector layer in our data centers to handle 500 VMs without latency spikes. AWS side was fine, but the hybrid control plane felt bolted together.
**Container runtime security gaps:** It does the standard CVE and process anomaly stuff well. Where it fell down for us was in Kubernetes network policy generation and enforcement. It would alert on unexpected calls but couldn't actually build a usable, context-aware policy for EKS or our on-prem K8s. We needed a separate tool for that.
**Compliance benchmarks & integration:** The SOC2 and PCI dashboards are real and saved us audit prep time. The Terraform and GitLab integrations, however, are shallow. The Terraform module only does initial account registration, and the GitLab plugin just posts alerts as comments. For actual policy-as-code in CI, we had to build our own glue.
I'd push you toward Wiz for your specific need of unified visibility across hybrid cloud and on-prem VMs, given their agentless approach for AWS and vSphere. But only if you can confirm two things: that their on-prem sensor can be air-gapped in your environment, and that your compliance team will accept their shared responsibility model for the compliance benchmarks.
Buyer beware.
> "The on-prem sensor licensing was the real sticker shock for us"
There's always a tax for on-prem. That quote range sounds familiar, but have you ever tried to get them to commit to a 3-year price cap? They won't. The annual escalators are buried in the MSA and always hit 8-12%, which makes your break-even analysis a complete fantasy after year one.
Their hybrid model is essentially two different products duct-taped together, which explains the collector VM sprawl you mentioned. Did you ever get a straight answer on whether the on-prem sensor fee included the compute cost for those three VMs, or was that just more infrastructure for you to host and pay for?
Show me the bill
Lacework's container runtime security had a significant blind spot for us: it only monitored managed orchestrators (EKS, AKS) effectively. On-prem Kubernetes deployments, especially vanilla distributions or those with custom CRI runtimes, generated noisy alerts or were completely missed. Their docs claimed support, but we spent months with support trying to tune it before giving up.
The billing pain others mentioned is real. For your 500 on-prem VMs, the sensor licensing was more expensive than the AWS workload billing, and those collector VMs are indeed an extra infra cost you have to host. Their "predictable" pricing locked us into high base rates with mandatory annual escalators.
Given your priorities, I'd cross Lacework off the list. The hybrid story is weak and the cost predictability you need just isn't there.
garbage in, garbage out
Spot on about the custom CRI runtime gap. That's not just a Lacework problem, it's endemic to any vendor that builds their security model around a managed service's specific instrumentation.
We ran into the same issue with a Rancher/K3s cluster on-prem. The agent would show as healthy but the runtime events were pure noise, mostly from its inability to map container lifecycle events to our runtime's socket path. Support's answer was to "standardize on EKS," which completely misses the point of a hybrid deployment.
You're paying a premium for a unified view that falls apart the moment you step outside their supported path.
been there, migrated that