Integrate Lacework with Vulnetix. Use the Lacework CLI to trigger container vulnerability assessments and export JSON findings for upload to Vulnetix.
Run Lacework in CI
Scan on every push and upload the report as a workflow artifact:
- name: Install Lacework CLI
run: curl https://raw.githubusercontent.com/lacework/go-sdk/main/cli/install.sh | bash
- name: Configure Lacework
run: |
lacework configure set --account ${{ secrets.LACEWORK_ACCOUNT }} --api_key ${{ secrets.LACEWORK_API_KEY }} --api_secret ${{ secrets.LACEWORK_API_SECRET }}
- name: Scan container image
run: |
lacework vulnerability container scan index.docker.io ${{ github.repository }} ${{ github.sha }} --json > lacework-findings.json
- name: Upload to Vulnetix
run: vulnetix upload --file lacework-findings.json
How Vulnetix compares: better together
Vulnetix does not replace Lacework. Keep running it. Vulnetix sits on top of Lacework (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Lacework is strongest at its core category and also carries features in Container & Image Scanning, IaC & Cloud Configuration, SCA, SAST, Secret Scanning, just as Vulnetix spans categories.
| Capability | Vulnetix | Lacework |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✓ First-party SAST with data-flow modeling and low false-positive/negative claims |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✓ Code Security SCA covers direct + transitive deps with function-usage visibility |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✓ On-demand and registry-polled container image vulnerability scanning |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✓ Kubernetes manifests and Helm charts via the Code Security module |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✓ Agentless secrets scanning of workloads |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✓ Core CNAPP: CSPM + CWPP unified on the Polygraph Data Platform, multi-cloud (now Fortinet FortiCNAPP) |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ~ Polygraph unifies findings + attack paths, but scoped to Lacework's own telemetry |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ~ Risk-based prioritisation correlating severity with active exploit and reachability signals |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ~ Tracks where vulnerable functions are used and network reachability in attack paths |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Lacework does well
- Patented Polygraph behavioral analytics that builds unsupervised-ML baselines for every process, container, host, identity and cloud resource and flags anomalies without hand-written rules
- Attack-path analysis that ties vulnerabilities, misconfigurations, network reachability, secrets and IAM roles together per host to prioritise real risk
- Agentless workload scanning for vulnerabilities and secrets that gives cloud-wide visibility in minutes
- Code Security module adds first-party SAST (data-flow modeling to catch injection/zero-days) and SCA that pinpoints exactly where vulnerable functions are used and who owns them
Where Vulnetix adds to it: Lacework's strength is behavioral cloud-workload analytics and attack-path context; Vulnetix does not replace that runtime engine. Instead Vulnetix ingests Lacework's cloud, container and Code-Security findings into one cross-scanner deduplicated queue spanning other vendors' scanners too, and layers on capabilities Lacework does not offer: immutable versioned VEX + audit, explicit EPSS/KEV/ESS/CWSS/LEV exploit-intel, EOL and SSVC policy, Safe Harbour autofix PRs, dual CycloneDX 1.7 + SPDX 2.3 SBOM, and the 25+ registry install-time package firewall.
No migration, no rip-and-replace. Lacework keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Lacework results in Vulnetix
Upload Lacework JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.