After evaluating our cloud security posture management (CSPM) and cloud workload protection platform (CWPP) needs for 18 months on Lacework, we completed a migration to Wiz last quarter. The primary driver was cost predictability, but any migration involves trade-offs. This post details the quantifiable financial outcome and the functional capabilities we no longer have access to, which may serve as a checklist for teams considering a similar move.
**Cost Analysis (Annual, AWS Environment ~2500 Resources)**
Our Lacework contract was based on a complex mix of cloud accounts, hosts, and containers, which led to significant quarterly variance and unexpected overage charges. Wiz's per-resource pricing model proved substantially more predictable and, in our case, cheaper. The breakdown:
* **Lacework Final Year:** $187,500
* Base platform fee: $112,000
* Host/container overages (avg): $48,500
* Data ingest/API call overages: $27,000
* **Wiz First Year:** $116,400
* Pure per-resource cost: $116,400 (no overage structure)
* **Annual Savings:** **$71,100** (38% reduction)
**What We Gained (The Obvious)**
* Unified agentless/agent-based view without managing multiple sensor types.
* Faster graph-based query performance for investigation (e.g., tracing a vulnerability to a specific IAM identity).
* More intuitive UI for developer self-service, reducing SecOps ticket volume by ~60%.
**What We Lost (The Critical Nuance)**
The migration was not a pure net-positive. Lacework's data collection and historical analysis engine had strengths we now lack.
1. **Behavioral Anomaly Detection Baseline:** Lacework's Polygraph® engine required 6-12 months of data to establish a reliable baseline for network and process behavior. Our Wiz deployment, while excellent for configuration and vulnerability scanning, cannot replicate the historical profiling of our unique environment. We've had to supplement with custom CloudWatch metrics and GuardDuty for network anomaly alerts.
2. **Custom Alert Rule Granularity:** Lacework's alert rule builder allowed for exceptionally granular, multi-factor rules. For example, we had a high-fidelity rule for detecting suspicious crypto-mining activity:
```json
// Lacework Alert Rule Snippet
{
"filters": {
"type": ["Process"],
"tags": ["aws-ec2"],
"process_name": ["*minerd*", "*cpuminer*", "*xmrig*"],
"network_activity": "true",
"outbound_port": ["3333", "4444", "5555"],
"and": [
{ "cpu_usage": { "gt": 80 } },
{ "parent_process_name": ["init", "systemd"] }
]
}
}
```
Recreating this in Wiz requires splitting into separate vulnerability and cloud event rules, losing the correlated multi-layer logic.
3. **Long-Term Forensic Data Retention:** Our Lacework instance stored detailed process and network lineage for 365 days. Wiz's threat detection retains similar data for 90 days. For our internal compliance requirements, we now must export and archive this data to S3, adding minor but non-zero management overhead.
**Methodology Note:**
Cost comparison is based on like-for-like coverage (CSPM, CWPP, vulnerability management for hosts/containers, Kubernetes audit log analysis). Load testing for API throughput was conducted pre-migration using scripts to simulate peak alert ingestion and query loads. Wiz's API handled our simulated loads with lower latency, though its query language has a steeper learning curve.
In summary, the migration achieved its primary goal of cost control and operational simplification, but at the expense of highly-tuned behavioral detection built over a long baseline period. For organizations with mature, stable environments where behavioral patterns are well-established, this loss may be significant. For us, the financial and operational efficiency gains outweighed the loss of those nuanced alerts.
-ck