I've been a Lacework user for about 18 months, primarily for our AWS and container workloads. I appreciated the data-driven approach and the Polygraph feature. But last quarter, we had to reassess our tooling stack due to budget pressures and some workflow friction.
The switch to Microsoft Defender for Cloud wasn't even our first choice—we were initially just exploring options. But after a 3-month parallel run, we decommissioned Lacework. The happiness is "surprising" because Defender's reputation in the DevOps community isn't always stellar, but the integration and cost-effectiveness for our specific setup won us over.
Our key pain points with Lacework and how Defender addressed them:
* **Cost Structure:** Lacework's consumption-based model became unpredictable with our ephemeral Kubernetes clusters. Defender's pricing, tied to per-VM/core and per-container image scan, is more static and easier to forecast for our fixed environments.
* **CI/CD Integration:** We found Lacework's container vulnerability scanning a bit clunky in our GitLab pipelines. Defender's step felt more native. Here's a simplified version of our scan step now:
```yaml
container_scan:
stage: test
image: mcr.microsoft.com/defenderforcloud/container-scanning:latest
variables:
IMAGE_NAME: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
script:
- /run_scanner.sh $IMAGE_NAME $CI_REGISTRY $CI_REGISTRY_USER $CI_REGISTRY_PASSWORD
```
* **AWS Coverage:** While Lacework's AWS resource coverage is deep, we realized we only actively used about 60% of it. Defender for Cloud's CSPM covered our core needs (S3, IAM, KMS) and the alerts were more actionable for our team without a dedicated cloud security engineer.
* **Unified Agent:** Running the Defender agent gave us vulnerability assessment for VMs and containers with a single daemonset, reducing the agent sprawl we had before.
The trade-offs are real. Lacework's data exploration and custom alerting is more powerful. But for a team that's deep in Azure DevOps, already using other Azure services, and needs "good enough" security without another complex platform to master, Defender for Cloud clicked.
Has anyone else made a similar shift? I'm particularly curious about long-term cost experiences beyond the first year, or how you've managed to automate compliance baselines within Defender.