After a 24-month tenure with Lacework, my organization mandated a cost-optimization review of our cloud security posture management (CSPM) and cloud workload protection platform (CWPP) stack. The primary driver was escalating cost, but secondary concerns around feature velocity and operational overhead prompted a full evaluation. We conducted a structured proof-of-concept with Wiz, alongside a re-evaluation of Lacework's then-current offering, culminating in a migration six months ago. This report details the quantitative and qualitative outcomes.
**Primary Catalyst: The Cost Equation**
Our Lacework bill was heavily correlated with data ingestion volume, specifically around event counts and agent-based telemetry. While their unified platform model is elegant, the pricing model became punitive at scale. Our monthly bill for ~5000 cloud resources and ~1500 container workloads was consistently in the five-figure range. Key cost drivers included:
* **Cloud Activity Log (CAL) events:** Every API call in our multi-account AWS organization was ingested. During peak deployment cycles, this generated immense volume with diminishing investigative return.
* **Container runtime analysis:** Fine-grained, continuous monitoring of all container behaviors, while powerful, generated a massive and expensive telemetry stream.
* **Compliance scanning frequency:** Frequent, automated scans of our entire estate against benchmarks (CIS, PCI-DSS) added to the computational load.
Wiz's pricing, based primarily on active cloud resources (e.g., an EC2 instance, an S3 bucket, a Kubernetes pod) rather than events or telemetry volume, provided immediate cost predictability. Our bill decreased by approximately 62% for comparable coverage, and more importantly, it now scales linearly with our infrastructure footprint, not its activity level.
**Coverage and Architectural Shift**
The migration required a fundamental shift in mindset from continuous, agent-centric telemetry collection to a snapshot-in-time, graph-based correlation model.
* **Lacework's Strength:** Provided deep, continuous visibility into runtime behaviors (process execution, network calls, file integrity). The `lw_agent` was a data powerhouse.
* **Wiz's Approach:** Leverages short-lived, credential-based scanners to build a massive, interconnected graph of all cloud resources, configurations, vulnerabilities, secrets, and network exposures. Its "agentless" design (they do offer a lightweight agent for runtime threat detection) dramatically reduced our operational toil.
A concrete example: Identifying a critical vulnerability path.
* In Lacework, we'd see a CVE on a container image, then later potentially observe related runtime activity. Correlation often required manual work across dashboards.
* Wiz immediately shows that CVE on the container image, but also graphically illustrates that the vulnerable container is deployed in a pod, which is exposed via an overly permissive NetworkPolicy to a public-facing service, which is attached to an S3 bucket containing sensitive data. This contextual, risk-prioritized graph is their core differentiator.
**Operational and Integration Observations**
* **Kubernetes Integration:** Lacework's agent DaemonSet provided deep runtime security but required managing agent upgrades and resource profiles. Wiz's Kubernetes integration relies heavily on the cloud provider's managed control plane audit logs and its own in-cluster scanner, which felt less intrusive but required a mindset shift toward "security-as-snapshot" versus continuous monitoring.
* **Terraform & CI/CD:** Both platforms offer IaC scanning. We found Wiz's ability to directly hook into our Terraform Cloud runs and provide pre-provisioning feedback slightly more integrated and actionable. Their CLI tool (`wizcli`) for local scanning became a standard gate in our pull request pipelines.
* **Alert Fatigue & Signal-to-Noise:** Lacework generated a higher volume of lower-level alerts (e.g., suspicious process spawned). Tuning was constant. Wiz's alerts are inherently higher-level and risk-correlated (e.g., "Critical vulnerability on a publicly accessible resource with sensitive data"), which significantly reduced daily alert volume and improved SOC analyst efficiency.
**Conclusion and Unresolved Trade-offs**
The migration was financially and operationally justified for our context. However, it is not a universal recommendation. The trade-off is clear: we exchanged deep, continuous runtime visibility for broad, contextual, risk-prioritized assessment at a fraction of the cost. For organizations with strict runtime security requirements (e.g., FIPS, intense insider threat programs), Lacework's agent-based depth may still be preferable. For our needs—cloud-centric, focused on mitigating misconfiguration, vulnerability exposure paths, and identity risks—Wiz's graph-based model has proven superior.
Our stack now supplements Wiz with a focused runtime detection tool for critical workloads, acknowledging that no single platform is truly "complete." The decoupling of CSPM and CWPP, while adding integration overhead, has given us greater control over cost and capability.
--from the trenches
infrastructure is code