Fortinet FortiCNAPP

My main use case for FortiCNAPP , from my previous experience distributing it or now as a reseller, is for anyone who's looking for a strong cloud security platform and gaining visibility into risk, malicious configurations, any vulnerabilities, as well as your workload behavior across cloud environments.

The fact that it is built as a cloud native application protection platform means it is aimed at helping security teams manage their cloud posture, the workload protection, identity risk, and compliance from a central place. When you consider it as a solution that someone can use in their SOC, it is most valuable when you need clearer visibility across multi-cloud environments, which is a challenge in today's environment. If you want to turn your cloud findings into actionable security work, FortiCNAPP  is the way to go.

FortiCNAPP offers features that stand out to my clients and to me as a reseller. It is not just a reporting tool; it gives you the actual context around cloud risk in a way that helps with prioritization, investigation, and compliance tracking, taking away a lot of your time and saving your resources to focus on what's important. The vulnerability and workload risk detection with severity-based prioritization is a key player, compliance reporting that supports frameworks such as PCI, SOC 2, and CIS is a game changer, and noise reduction by consolidating and prioritizing alerts saves a lot of time.

I can tell you more about how the compliance reporting helps my clients. I have not had feedback from them regarding how it made it easier, but I have had showcases where I can demonstrate from a PCI perspective as well as a SOC 2 that it is a requirement and how it addresses that compliance framework.

FortiCNAPP has impacted my clients positively. The strong visibility into the cloud security posture and operational risk is a massive impact for clients. From a compliance reporting perspective, it is valuable when they need evidence for audit and control testing, fitting well into security operations models where cloud findings need to be handled alongside broader SOC activity.

FortiCNAPP can be improved because the platform can feel complex at the start, especially for teams new to CNAP tooling. Some users mention that they found the interface and data models less intuitive than expected, and I have had situations where reporting and alert configurations might require time.

Regarding other improvements needed for FortiCNAPP, the majority of the time is that reporting and alert configuration might require time to tune properly. This is the significant issue, combined with the fact that some users find the interface and data model less intuitive than expected.

Regarding FortiCNAPP's AI capabilities, I think there might be a bit of improvement needed. However, since Fortinet is a security vendor overall, keeping the data safe is not a problem. I know they have invested a lot in getting it to a place where it is a trusted platform.

FortiCNAPP is stable. I have not experienced any downtime or issues reported by my clients.

From a licensing perspective, FortiCNAPP's scalability is good. It can handle growing workloads or expanding environments smoothly.

The customer support for FortiCNAPP is pretty good from a South African perspective. Most support runs via the distribution channel, and only once it gets to layer two or tier two does it get pushed through to your Fortinet system engineers, where support is very quick.

My experience with pricing, setup cost, and licensing for FortiCNAPP revolves around Fortinet being an enterprise vendor. Pricing is always a discussion point. FortiCNAPP is not a cheap solution, and licensing around it can become very expensive for specific customers. However, if the use case is there and the need is a demand, then pricing is the last thing that will be the focus.

I have seen a return on investment for my clients. They need fewer employees from a SOC perspective where people are deployed in their SOC, as well as significant time saved. When you save time, you save money.

FortiCNAPP is not a cheap solution, and licensing around it can become very expensive for specific customers. However, if the use case is there and the need is a demand, then pricing is the last thing that will be the focus.

Before choosing FortiCNAPP, I believe my clients did evaluate other options, but I have no insight into what they used prior.

I must ensure that you understand the interface and the model that you want to expect from it. I believe it is flexible enough to get the right interface or data that you want to see from a CNAP perspective.

From a feature perspective, I wish more people knew about the integration potential with the broader Fortinet ecosystem, which is a massive game changer. If you are already invested in a Fortinet ecosystem, it is a no-brainer to go for FortiCNAPP to look after your cloud platform.

Integration depth can matter a lot for FortiCNAPP. Value can be improved significantly when it is connected into an existing SOC stack. However, if you are not running any form of a Fortinet estate, it can become complex.

I rate FortiCNAPP an eight because, from my experience, it is best viewed as a platform that helps a SOC make cloud risk visible, understandable, and actionable, which is exactly what I prefer using it for or positioning it to customers. However, as a stand-alone product, if you do not have the experience from an existing cloud or understanding of how to manage cloud security at scale, then there might be a bit of a challenge. FortiCNAPP is a credible solution that adds real value when you properly integrate it with your existing security operations.

My main use case for FortiCNAPP  is majorly for AWS , specifically for security posture management and auditing so that the user and whoever is using this can capture what is necessary.

A specific example of how I use FortiCNAPP  for AWS  security posture management is that we created resources manually, which sometimes led to misconfigurations in the customer requirements, and we have used FortiCNAPP to detect services that are publicly exposed and security groups with wide ranges of open IPs for ingress or egress, along with checking unencrypted databases and tightening IAM  permissions.

I also have a unique use case of FortiCNAPP for one of Asia's largest growing country government projects where we identified users with excessive permissions not required by them, due to many users being onboarded in the government sector, so we used FortiCNAPP to identify all cloud identities and recommended the right permission sets for them.

FortiCNAPP has positively impacted my organization by providing centralized visibility and consolidating our cloud security posture management, helping us identify misconfigurations and public accessibility issues, which allowed us to enhance IAM  governance and visibility on vulnerabilities.

Although I don't have specific metrics, I can say it has reduced our operational overhead significantly by providing a centralized view, highlighting critical issues, and helping us tighten configurations that have reduced operational costs and time.

The best features FortiCNAPP offers, in my opinion, include compliance and audit capabilities, IAM  identity management, and security rectification in configurations, along with vulnerability management, which helped us rectify thousands of overwhelmingly security vulnerabilities. I find myself relying on all of them day-to-day, including threat detection, which is really good.

Regarding how FortiCNAPP can be improved, I would say there are a few things.

For improvements, I believe integrating FortiCNAPP with ITSM  tools to reduce manual ticket creation and allowing more customization in reports could be beneficial, as well as providing knowledge-sharing articles for remediation playbooks.

I have been using FortiCNAPP for almost three years.

FortiCNAPP is stable.

FortiCNAPP's scalability is open, and we can change instances easily as needed.

The customer support for FortiCNAPP is fine, though it can take time as we need to engage with AWS first, but I would rate it around 7 or 8 out of 10.

Previously, we have only used it as an add-on solution.

While I don't have specific metrics for ROI, I know that we save time on operations and manpower while improving our security posture.

Regarding pricing, setup cost, and licensing, since it's a marketplace, I find the pay-as-you-go model convenient and fair.

We did not evaluate other options before choosing FortiCNAPP, as it completed our use case right away.

For others looking into FortiCNAPP, I recommend it for tightening security in public clouds as it has worked well for us compared to other options such as Palo Alto Prisma and CrowdStrike. I would rate this product 8.5 out of 10.