Alright, so I've been running the numbers on Lacework for a client who's deep into their "shift-left" security phase. They're pushing IaC scanning hard, and the sales rep made a big deal about their Terraform scanning being "enterprise-grade."
My immediate question: is it actually better than the established open-source tools, or are we just paying for a fancy wrapper? Because let's be honest, Checkov and Terrascan are free, and they've got massive community rule-sets.
From my testing over the last few weeks:
* **Coverage is... okay.** It catches the big stuff—unencrypted S3 buckets, open security groups. But on some of the more nuanced Kubernetes policies or newer AWS services, I found Checkov's community rules were more up-to-date.
* **The "Policy as Code" UI is slick, I'll give them that.** Building custom rules is easier for the security team than writing Rego or Python checks. But is that worth the premium? For us, maybe. For a startup with DevOps engineers? Probably not.
* **Here's the hidden fee:** The IaC scanning isn't a separate SKU. It's bundled into their "Cloud Security Platform," which means you're paying for a whole suite even if you just want the scanning. My client's quote came out to roughly **$12k/month** for the full suite. Running Checkov in their pipeline costs them the compute time on a few GitHub Actions runners.
The real value prop, in my view, isn't the rule library. It's the *correlation*. Lacework can theoretically link a misconfiguration in your Terraform to an active runtime vulnerability or anomalous traffic. That's powerful for closing the loop. But if you're just looking for a linter in your CI/CD pipeline, you're hauling a grand piano to a picnic.
Anyone else done a direct comparison? I'm particularly interested in:
- False positive rates compared to OSS tools.
- Scan speed on a monorepo with 500+ Terraform modules.
- Whether their custom policy engine actually saves time or just adds another layer of vendor lock-in.
Cloud costs are not destiny.
Hey, I'm an ETL engineer at a mid-sized fintech, managing our Airflow pipelines and Snowflake ingestion. We've been piloting IaC scanning for our Terraform modules that deploy to AWS and GCP, running both Checkov in our CI and evaluating Lacework's trial.
Based on our last three months of tests:
1. **Pricing model is the biggest blocker.** Lacework bundles IaC with their entire platform. For us, that quote was around $7-9k/month minimum for their core tier, which is a non-starter if you only need scanning. Checkov is free, Terrascan is free. The cost difference alone makes this a short conversation for many teams.
2. **Rule freshness and depth lag.** For newer GCP services like BigQuery Omni or specific Kubernetes ingress checks, we found Lacework's rules were often a few months behind. The Checkov community repo had a rule for a niche GCP networking change within a week of the feature launch. Lacework's custom rule builder is easier, but you're building because the built-in ones aren't there yet.
3. **CI/CD integration effort is similar.** Both Checkov and Lacework's scanner run as a container or CLI. The time to add either to a GitHub Action or GitLab pipeline was about a day of fiddling. Lacework's main advantage here is the consolidated findings dashboard if you're already using them for cloud security.
4. **The "enterprise-grade" part is about policy management.** If you have a large platform team that needs to enforce and exempt policies across hundreds of repos, Lacework's UI for assigning rulesets and tracking exceptions is easier than managing a giant Checkov config file. For smaller teams with under 20 repos, that's overkill.
I'd stick with Checkov unless you're already a Lacework customer for their runtime cloud security and need a single pane of glass. For a clean recommendation, tell us your team size and whether you're mandated to have a vendor-supported tool for audit compliance.
rookie