Platform Page Live

Visibility into all processes and applications within your cloud and container environments from a single, unified view.

Watch Lacework in Action. Complete the form to watch the 4 minute demo.

Workload and Account Security for Multicloud and Container Environments

The public cloud enables enterprises to automatically scale workloads, deploy faster, and build freely. This supports their speed and scale needs, but it has made it increasingly difficult to make sense of the activity happening within their environments.Lacework’s lightweight agent provides visibility to all processes and applications within an organization’s cloud and container environments. The breadth and depth of visibility helps detect vulnerabilities, and then uses Lacework’s machine learning analysis to identify anomalous behavior that poses threats.

Learn More

The Journey to the Cloud

Lacework is the only complete cloud security platform designed to effectively accelerate and secure your journey to the cloud.

Security and Compliance for the Cloud

The Power of the Polygraph

AWS Security

Azure Security

GCP Security

Container Security

Workload Security

Container Security

GCP Security

Azure Security

AWS Security

The Power of the Polygraph

Our foundation is based on the patent-pending Polygraph technology, a context-rich baseline built from collecting high-fidelity machine, process, and user interactions over time. This technology dynamically develops a behavioral and communication model of your services and infrastructure that understands natural hierarchies (processes, containers, pods, machines, etc.) and aggregates them to develop behavioral models at scale. Together with a behavioral model, the Polygraph is able to monitor your infrastructure for activities that fall outside the model and dynamically update as behaviors change over time.Using this information, the Polygraph detects anomalies and generates high-fidelity alerts appropriate to your unique environment.

Lacework Polygraph uses deviation from a temporal baseline to detect deviations or changes in the behavior resulting in meaningful alerts. Alerts are either due to a desired change, misconfiguration, or malicious activity. The Lacework Polygraph then scores the alerts based on severity and threat.Lacework Polygraph breach detection is more precise and accurate because of key technology innovations:

• Capturing behavior at process/container- level

• Separating interactive and non- interactive traffic

• Alert generation at the analysis group- level

Polygraph maps the truth of your cloud instance and helps users quickly visualize the ‘who, what, where, and how far’ of an event.

Lacework provides comprehensive, continuous end-to-end security and configuration support for workloads and accounts running in AWS and in multi cloud environments.

Comprehensive, continous end-to-end AWS security and configuration support. Be the envy of the AWS security community.

AWS SECURITY SOLUTIONS FOR AMAZON WEB SERVICES

Find Identity and Access Management (IAM) vulnerabilities, including the use of “root” account, password requirements, and use of multi-factor authentication. Check for logging best practices, ensure AWS CloudTrail is enabled across regions, and log files validated and encrypted. Monitor critical account activity such as unauthorized API calls and use of the management console and the “root” account. Confirm secure network configurations, including limiting access to vulnerable ports, enforcing “least access” privileges and checking for the use of flow logging. Assess your S3 settings for S3 buckets at risk.

AWS Security

AWS users feel the security pinch. The burden of keeping your cloud safe requires more than signatures and custom rules — every activity in the cloud environment drives potential threats, and AWS users need solutions that go beyond identifying changes to describing the security context and implications of changes. Lacework delivers comprehensive and continuous end-to-end AWS security and configuration support for both workloads and accounts running in Amazon and multi-cloud environments. The cloud is not going away, and neither is the need for a single, unified security solution. Lacework relieves your security pinch by identifying, analyzing and reporting all misconfigurations, vulnerabilities, and behavioral anomalies.

Threat Detection, Compliance, and Automated Monitoring for AWS Cloud Environments

Find and fix potentially exposed S3 buckets configured for external access and identify out of compliance buckets with CIS Benchmark for AWS. This also includes: Monitoring for encryption at rest and in transit. Ensuring only users with multi-factor authentication delete S3 buckets. Versioning that protects against deletion or overwrites. Context-aware recommendations to help prioritize and fix violations.

Actionable Auditing of AWS Security Configurations for S3 Buckets

Find Identity and Access Management (IAM) vulnerabilities including root account use, lax password requirements, and the lack of multi-factor authentication (MFA). Check for logging best practices and ensure AWS CloudTrail is enabled across regions. Verify that log files are validated and encrypted. Monitor critical account activity like unauthorized API calls and unauthorized access to the management console and root account access . Drive secure network configurations and limit access to vulnerable ports, enforcing “least access” privileges and checking for the use of flow logging. Assess your S3 settings for S3 buckets at risk.

Robust AWS Configuration Audit

See all activity on AWS resources, such as new activity in a region, activation of new AWS services, or changes to access control lists. Quickly visualize all changes to users, roles, or access policies. Receive notification of access tampering or customer master key tampering. Reduce alert fatigue with customizable alerts and reports that eliminate repetitive or irrelevant results.

Continuous AWS Security Monitoring of User Activity

Our foundation is based on a patent-pending Polygraph technology, a deep temporal baseline built from collecting high-fidelity machine, process, and user interactions over a period of time. The Polygraph detects anomalies, generates appropriate alerts, and provides a tool for users to investigate and triage issues. This technology dynamically develops a behavioral and communication model of your services and infrastructure that understands natural hierarchies (processes, containers, pods, machines, etc.) and aggregates them to develop behavioral models. Together with a behavioral model, the Polygraph is able to monitor your infrastructure for activities that fall outside the model and dynamically update as behaviors change over time.

The Power of the Polygraph

Pinpoint exactly how files change — from content and metadata to whether the file was modified or simply appended. Extended information on executables, such as files created without a package installation, command lines used at launch, or currently running processes (with users and network activity). Boost intelligence with 5 billion files from ReversingLabs’ library. Leverage one-click investigation of events and activities related to FIM signals. Drive cloud-wide search with file type summaries and new file detection. Operate at cloud scale with unprecedented speed. Automate configurations, file discovery and operations. Scale architecture without adding complexity or performance penalties. Included with all Lacework AWS Cloud Security agents.

Speed, Scale, and Integration

Lacework provides comprehensive, continuous end-to-end security, compliance, and configuration support for workloads and accounts running in AWS and in multi cloud environments. Protect log and AWS configuration files against tampering. Daily re-check of all monitored files in AWS Accounts. Monitor critical account activity including unauthorized API calls. Pre-defined directory maps monitor critical files and directories. Assess your S3 settings for S3 buckets at risk.

Meet AWS Compliance mandates

Lacework is fully container-aware and monitors all container activities regardless of the container distribution you rely on (Docker and/or Kubernetes). Any malicious activity in a containerized environment will generate an anomaly at one layer or another – Lacework’s threat detection and behavioral analysis identifies anomalous activities across your cloud and containers so issues can be remediated before any damage is done.

Address Container Security

Lacework’s lightweight agents collect and send data to Lacework’s backend in the cloud where this data is aggregated, and a baseline of the activity in the cloud environment is created. The automated method of detecting undesired activity in cloud and container workloads provides great benefits over traditional rule writing.

Enforce Workload Security

Learn More

For all Azure events and configurations, Lacework monitors activities and behaviors of cloud entities beyond network traffic to detect anomalies indicative of a misconfiguration, a human error, malicious activity or a threat. Lacework enables security and development teams to identify escalation of privileges, lateral movement, misuse of Azure resources early on so that breaches can be stopped early.

Advanced Microsoft Azure Security with Unrivaled Visibility and UEBA

Boost Your Azure Security with Lacework Solutions

Lacework monitors all Azure events and configurations, including activities and behaviors of cloud entities, to detect anomalies indicative of misconfigurations, human error, or malicious activity. Identify escalation of privileges, lateral movement, and misuse of Azure resources early on so that breaches can be stopped quickly. Our intuitive dashboard lists cloud risks and threats, ranks them by severity, and are compatible with common modern ticketing platforms like Slack channel or Jira. We also integrate with PagerDuty to integrate notifications and alerts into your current workflows.

Not Your Average Threat Protection

Lacework provides enterprises with a comprehensive, continuous end-to-end Azure security solution that advances configuration support for workloads and accounts running in Microsoft Azure. Protect assets deployed on Azure, from the initial configuration to everyday operations by: Checking for a series of additional controls specific to Azure resources. Validating that data is not inadvertently exposed to unauthorized users. Continuously protect every layer of your Azure deployment including accounts, workloads, and Platforms as a Service (PaaS) like Azure SQL. Receiving notification of changes that might trigger a security weakness.

Threat Detection, Configuration Compliance, and Continuous Monitoring for Azure and Multi-Cloud Environments

Lacework’s Azure Security Platform automatically validates all configurations against the controls established as best practices for securing your cloud environment. Our interactive report delivers insights into “passed or failed” controls with recommendations on how to fix out-of-compliance configuration components. A similar report is available for additional security controls specific to Azure resources and Lacework ensures continuous compliance in Azure by auditing your configuration daily and alerting you of any change that represents a degradation in compliance.

Security and Compliance for any Azure Configuration

As Azure environments continuously adapt to new users, services, and resources, the corresponding security landscape changes in a dynamic way. We make it easy for you to get an accurate assessment of your Azure and multi-cloud workloads and accounts by providing a single, comprehensive Microsoft Azure security solution that captures, analyzes, and reports on all cloud activity, so you’ll never be left in the dark again.

Continuous Monitoring Made Simple

Clear & Easy Our fast, simple, and agentless installation provides interactive data on individual violations with explicit instructions on how to fix each issue and comes with customizable reports and alerts. Continuous Auditing Our daily re-audits notifies you when changes impact your security in Azure accounts. Continuous usage monitoring alerts you of anomalous behaviors and activities –without manual rule or policy development. Integrated with Azure Services Integration across Azure services ensures the most complete visibility into Azure configuration. Get exceptional visualizations, search by service and other investigative tools focused on Azure account security.

What Makes Our Azure Security Solution a No-brainer

Lacework checks for a series of controls specific to GCP resources like Storage Buckets, ACLs and other resources, and for processes like Cross-Origin Resource Sharing (CORS), access logs, and other elements that can be targeted in the course of attacks.

Monitor and identify threats for workloads and accounts in the Google Cloud Platform

Peace of Mind Security for Every Google Cloud Platform

Lacework is purpose-built to deeply learn and detect anomalies across a customer’s server hosts and resources, including GCP, other cloud platforms, containers, Kubernetes, processes, users, networks, and file behavior. Lacework is a single, comprehensive GCP security solution that captures, analyzes, and reports on all cloud activity so you are able to get an accurate assessment of your GCP and multi-cloud workloads and accounts.

Purpose-Built for Modern Cloud Infrastructures

For all GCP events and configurations, Lacework’s GCP security solution monitors activities and behaviors of cloud entities beyond network traffic to detect anomalies indicative of misconfigurations, human error, malicious activities or threats. Lacework enables security teams to identify escalation of privileges, lateral movement, and misuse of GCP resources quickly on so that breaches can be identified and stopped early. Risks and threats are visible within the Lacework dashboard, are ranked by risk severity, and can be delivered through the most common modern methods such as a Slack channel or a Jira ticket.

Automated Threat Detection

Lacework is built to detect anomalies across your server hosts and resources, including GCP, other cloud platforms, containers, and Kubernetes. It also finds anomalies involving processes, users, networks, and files. Lacework achieves this by: Capturing, analyzing, and reporting on all cloud activity so you are able to get an accurate assessment of your GCP and multi-cloud workloads and accounts. Leveraging Polygraph — a deep temporal baseline built by collecting high fidelity machine, process, and user interactions over a period of time — to detect anomalies, generate appropriate alerts and provide a tool for users to investigate and triage issues.

Modern Security for Modern Cloud Infrastructures

Lacework automatically checks, reviews, and alerts on configuration issues that run counter to controls established as best practices for securing GCP. Lacework supports common compliance standards such as SOC2, PCI DSS, and CIS benchmarks. An interactive report, generated from deep insights from activity happening in the environment, delivers insights into passed or failed controls with specific remediation recommendations to fix non-compliant configuration components. A similar report is available for security controls for Google Cloud Storage. Lacework’s GCP security solution ensures continuous compliance by auditing your configuration daily and alerting you of any change that represents a degradation in compliance.

Compliance and Misconfiguration Identification

For all GCP events and configurations, Lacework’s security solution monitors activities and behaviors of cloud entities beyond network traffic to detect anomalies indicative of misconfigurations, human error, malicious activities, and threats. Lacework enables security teams to identify escalation of privileges, lateral movement, and misuse of GCP resources quickly so that breaches can be identified and stopped early by: Ranking all risks and threats visible within the Lacework dashboard by risk severity. Scheduling automatic checks, reviews, and alerts for configuration issues Providing support for common compliance standards such as SOC2, PCI DSS, and CIS benchmarks.

Security Built for Tomorrow, Today

Google Cloud Platforms (GCP) are not immune from some of the biggest security risks. Potential threats to GCP include data breaches, credential and access management issues and identity protection. Achieving peace of mind requires partnering with a company that understands GCP security. Lacework offers an automated, end-to-end GCP security and configuration solution that monitors threats for workloads and accounts in the Google Cloud Platform and across multi-cloud and containerized environments. Lacework is architected as a host-based intrusion detection that identifies and alerts based on behavioral anomalies that could pose threats to an organization’s data and resources.

Automated, Continuous GCP Security Monitoring and Threat Detection for Google Cloud Platform and Multi-Cloud Environments

Visualize your containerized applications in real-time, for a clear understanding of communications, launches and other cloud runtime behaviors.

CLOUD CONTAINER SECURITY FROM BUILD-TIME TO RUN-TIME

Polygraph, Lacework’s foundation for securing containers, helps customers visualize their cloud, containers, and workloads by organizing activities into behaviors and tracking those behaviors over time. By collecting and correlating high-fidelity machine, process, and user interactions, Polygraph can detect anomalies, generate high-quality alerts, and provide a tool for users to investigate and triage issues across their cloud container environments.

Visualize Your Containers and Workloads with Polygraph

Unlike most other container security solutions that only identify non-conforming compliance rules, Lacework goes a step further and alerts your team about any behavioral anomalies – even when the associated configurations meet the required standards. Lacework’s cloud container security monitoring platform brings multi-cloud checks into one dashboard by continuously monitoring configuration changes and API activity for containers across AWS, Azure, and GCP platforms. CIS benchmark scans are performed during container image development and container deployments. Our security platform also includes supplemental checks based on industry best practices and common compliance frameworks like PCI-DSS, SOC 2, HIPAA, NIST, etc. From automated threat detection to compliance, Lacework’s offers a comprehensive approach to container security that ensures nothing is left unprotected, which point solutions can’t guarantee.

Visit for the Security, Stay for the Compliance

Containers with similar behaviors are placed into a single, logical cluster – called a Polygraph – each with a baseline of expected characteristics and behaviors. The Polygraph is Lacework’s foundation for securing containers, where a deep temporal baseline is built from collecting high fidelity machine, processes, and user interactions over a period of time. Clustering containers based on behavior dramatically simplifies the visualization of a containerized cloud in a Lacework Polygraph by representing dozens or even hundreds of similar containers as a single item. This means new containers or configuration changes do not generate alerts as long as behaviors stay within the expected baseline. Lacework’s container security platform creates multiple types of polygraphs based on different behavioral categories.

Cloud Container Security Accomplished

Containers can be thought of as lightweight virtual machines with much leaner system requirements. Virtualization emulates the guest system, translating every instruction between the guest and host. Containers, on the other hand, share the kernel and execute instructions on the host directly. This implies that the main attack surface is still the host as it is shared across containers and any compromise at the host level can compromise all containers. The other challenge is that not all services are run in the container as there is a long list of OS level and management services which run outside containers and are part of the attack surface.

Host Security

The truth is scary: any compromise at the host level will compromise all other containers. Containers share the same kernel and execute instructions as the host, which greatly complicates the attack surface for IT security teams. Lacework delivers native container security support, reducing the attack surface, and detecting threats in a containerized environment. Our cloud container security monitoring platform automatically discovers every container across a user’s environment and clusters them based on different behaviors. We then visualize your containerized applications in real-time, providing a clear understanding of communications, launches and other cloud runtime behaviors.

Better Container Monitoring Means Better Container Security

Get deep visibility into all processes and applications within your container and cloud workload environments, all without any rule writing.

CLOUD WORKLOAD SECURITY SOLUTIONS

The modern cloud infrastructure allows organizations to deploy, scale, and configure their infrastructure faster than ever. The ability to automate and operate at DevOps speed poses a challenge to traditional security approaches. Lacework’s approach is to automate workload security with the detection of threats and anomalies and provide human-understandable investigative insights. Lacework’s cloud workload security solution supports public clouds AWS, GCP, Azure and supports computer hosts and containers.

Cloud Workload Protection at Scale & The Speed of Business

No Missed Events: Lacework will always alert you on new activity so that you are given a chance to investigate any behavior within your workload environment that could potentially be malicious. Low Alert Noise: Lacework will only alert you on what is new or anomalous, preventing alert fatigue within your organization. Simple Operations & Maintenance: Automated workload detection means no writing and maintaining error-prone rules. With Lacework you will not need to constantly maintain rules, allowing you to focus on securing your environment.

Lacework’s Automated Cloud Workload Security Approach Provides the Following Benefits

Lacework’s cloud workload protection security platform is fully automated with no rule-writing required. Using sophisticated machine learning, our workload security platform learns what constitutes normal behavior versus those that indicate potentially malicious activity. Examples of such anomalous activities are when a user launches a new unknown application, when an application connects to a suspicious endpoint, or when privileges are unexpectedly escalated. When Lacework identifies a potential threat, a contextual alert is generated with relevant data to allow users to investigate and triage the issue within your cloud workload environment.

Automated Workload Intrusion Detection

Lacework’s cloud workload security platform provides visibility to all processes and applications within an organization’s cloud workloads and container environments. The breadth and depth of workload visibility provided by Lacework helps security teams detect vulnerabilities and then utilize our machine learning analysis to identify anomalous behavior that poses threats. Traditional security solutions rely on network logs and the firewall rules to identify potential risks, but those approaches required a manual effort, and could not keep pace with the speed of modern cloud deployment methodologies. Lacework was built specifically to deliver contextual data about cloud events; every update, configuration change, access point, and a million other activities that might represent potential threats.

Visibility and Analysis for Container and Cloud Workloads

• Advanced deductive analysis that does not rely on heuristics