Fortinet recently announced plans to acquire cloud security startup Lacework. The deal marks a significant step for Fortinet, which potentially puts it at the forefront of the high-growth cloud security market and strengthens its position to compete with rivals such as Cisco and Palo Alto Networks amid the consolidation and convergence trend in cybersecurity.

“Fortinet historically has not been acquisitive. They've made very small acquisitions. And this is, I think, the largest one they've made either by headcount or dollar amount,” 650 Group co-founder and Technology Analyst Chris DePuy told SDxCentral.

“They thought it was a bargain, right? They're getting a lot of revenue for not much of an acquisition price, and they're getting into a market that they have not served very much in the past,” he added.

Fortinet and Lacework didn’t disclose the financial terms of the transaction, which is expected to close in the second half of 2024, subject to required regulatory approvals and other customary closing conditions.

However, in April, cloud security unicorn Wiz was reportedly in advanced negotiations to acquire Lacework for $150-$200 million, a fraction of its previous valuation of $8.3 billion after its Series D funding round in November 2021. But the deal later collapsed.

Why Lacework is a strategic bargain for technology Lacework developed a cloud security platform that provides several capabilities including cloud security posture management (CSPM), vulnerability scanning, cloud-workload protection, threat detection and response, runtime and build-time threat defense, and identity and access management across Amazon Web Services (AWS), Microsoft Azure, Google Cloud, and Kubernetes- and container-based environments.

The cloud security startup’s software and services address areas of the security market that Fortinet does not currently serve with very little product overlap, DePuy pointed out.

The deal brings Fortinet into the cloud native application protection platform (CNAPP) market, which is highly competitive and expected to grow significantly. 650 Group expects the CNAPP market to reach close to $10 billion by 2028.

“This brings Fortinet from very little market share to very significant market share once the deal closes,” DePuy said.

In addition, Lacework's cloud security technology, developed with substantial research and development investment, is now available to Fortinet, potentially saving significant internal development costs.

He expects Fortinet to add more functions to its cloud security portfolio, a much higher growth area than the premises-based security, to further expand its capabilities and market share.

“This cloud security part of the cybersecurity industry is very important. And if you're a large vendor trying to serve the needs of your customers having exposure here is very important,” DePuy said.

Fortinet gains immediate access to Lacework’s strong customer base Another significant advantage of acquiring Lacework is its robust customer base. Lacework serves nearly 1,000 customers, according to Fortinet.

The security giant can immediately get to work with these mid and large-sized organizations and can now upsell its products, like firewalls and secure access service edge (SASE) to Lacework’s customers. The deal “opens up a cross-selling opportunity in both directions,” DePuy said.

The acquisition also allows Fortinet to build relationships with CISOs, expanding its sales opportunities beyond the networking side of businesses. “Fortinet has not had such exposure to CISOs and will now have a bigger exposure, they can now sell some of the security operations related products that they've had in their portfolio.”

How the deal will impact customers from both companies Depuy notes that Fortinet will likely support both native Fortinet and Lacework customers for a considerable time before moving towards a consolidated platform.

Fortinet currently offers a number of cloud security solutions, including cloud workload protection, cloud access security broker (CASB) and cloud-native protection.

“I would expect that Fortinet would attempt to consolidate them [with Lacework] but not immediately. It's disruptive to the customers and it might make them leave, so you don't want to do that,” he said.

Fortinet claims Lacework customers will be able to benefit from access to its global reach, extensive scale, vast resources, and industry-leading threat intelligence.

“I think the primary benefit to Lacework customers will be the company that they bought technology from will survive,” DePuy said. “Lacework as a standalone organization, from what I understand, was running at a loss and might not have survived on its own.”

The startup announced cutting 20% of its workforce just 6 months after it closed its $1.3 billion Series D funding round.

Lacework customers will become part of a much larger, financially stable, high-growth and profitable company upon the deal closes, he added.

On the other hand, the acquisition allows Fortinet customers to access a wider range of security services from a single vendor, reducing the need to juggle multiple cybersecurity tools.

“One of the challenges that Fortinet customers historically had is that they could not buy all of the security they needed to secure their organization from Fortinet,” DePuy said. “With Fortinet’s expansion into CNAPP, [they now can] rely more on Fortinet.”

Fortinet will be able to offer more integrated and comprehensive solutions through its Security Fabric, simplifying security management for large organizations.

Enhancing its competitive edge against other security powerhouses The acquisition also positions Fortinet to better compete with industry giants like Cisco and Palo Alto Networks, both of which also have strong network security roots and have expanded to the cloud security market.

Fortinet’s Lacework buy aligns with its Security Fabric strategy, aiming to integrate and offer comprehensive security solutions. “It's a pretty good fit for Fortinet. And I just think they were being opportunistic as well as pursuing this Security Fabric strategy,” DePuy said.

Similar to Palo Alto Networks’ platformization and Cisco’s consolidation and their acquisitive strategy, Fortinet's move follows the industry trend of consolidating and expanding portfolios to offer broader security solutions.

“There has been a lot of consolidation in this industry. The biggest, kind of more important deals in the past have been Palo Alto Networks buying IBM SIEM products and Cisco acquiring Splunk. And now we've got Fortinet acquiring Lacework. This is allowing these very large vendors to offer a broader portfolio to its customers,” DePuy said. “And that is now becoming very common.”