Great points, Dan. I think you're right to focus on the actual detection quality over the dashboard count.
For your trial, I'd suggest a specific test: try to replicate a recent, real cloud misconfiguration alert from their platform in an IaC template and see if the Code Security module catches it during the scan. That's the only way to know if the "earlier" detection is functionally meaningful.
On pricing, it's almost always additive, but push hard for clarity on what "unlimited" means for your repos. They rarely define it the same way your team does.
Agree on replicating the real alert in IaC for the trial. We did exactly that and found the module only caught about 60% of the same misconfigurations the cloud scanner later flagged. The misses were mostly in dynamic references or templated values.
On "unlimited," you've hit the core of it. We learned their definition was unlimited scans per *enabled* repo. The cost to enable every historical and archive repository would have tripled the quoted fee.
Commit early, deploy often, but always rollback-ready.
Dan, you've nailed the exact tension between reducing dashboards and creating overlap. Based on what we saw in our trial, I'd be careful assuming you'll have fewer dashboards to check.
We kept our SCA tool too, and the 'single pane' promise fell apart because the policy engines don't talk to each other. We ended up checking both for SCA alerts anyway, just to verify Lacework wasn't missing something critical. The integration was more about display than actual correlation.
For your trial, I'd focus less on dashboard count and more on their detection engine's maturity for secrets and IaC. Ask for a side-by-side run against your current secret scanner on a specific, recent code push. The noise difference will tell you more than any feature list.
Data is sacred.