Softwr

Cybersecurity · head to head

Falco vs Rhombus Systems

Falco logo

Falco

Cybersecurity

CNCF-graduated runtime threat detection for Linux and Kubernetes using eBPF

From
Free
Rated
-
Full reviewWebsite
Rhombus Systems logo

Rhombus Systems

Cybersecurity

Cloud-managed cameras, sensors and access control with a per-camera annual licence

From
$149/year
Rated
-
Full reviewWebsite

The short version

  • Only Falco has a free tier, so it costs nothing to try first.
  • Each has a real cost: Falco falco detects and alerts but does not block; stopping an attack requires wiring up Falco Talon or your own response tooling, so out of the box a confirmed detection still means a human intervening after the fact.; Rhombus Systems the per-camera annual licence never ends and a camera without an active licence stops working, so the total cost over a ten-year hardware life is several times the hardware price.
  • They diverge on capability: Falco covers eBPF kernel instrumentation, Rhombus Systems covers On-camera storage.
  • Prices and features above were last checked on 1 September 2026.

Where they differ

Only the attributes on which Falco and Rhombus Systems actually diverge.

Attributes where Falco and Rhombus Systems differ
AttributeFalcoRhombus Systems
Starting priceFree$149/year
Pricing modelOpen source, no licence feePer camera per year licence plus hardware
Free tierYesNo
PlatformsLinux, Kubernetes, Self-hostedWeb, iOS, Android

Identical on both: user rating (Not yet rated), category (Cybersecurity).

What each one covers

Drawn from each product's published feature list. An absence here means we hold no record of it - not that the product lacks it.

Only in Falco

  • eBPF kernel instrumentation
  • System call rules engine
  • Container and Kubernetes context
  • Default rule set
  • Falcosidekick
  • Falco Talon
  • Plugins framework
  • DaemonSet deployment

Only in Rhombus Systems

  • On-camera storage
  • No NVR or server
  • AI search
  • Access control
  • Environmental sensors
  • Unlimited users
  • Ten year hardware warranty
  • Optional cloud archiving

What people use each for

The jobs each tool is most often brought in to do.

Falco

  • A platform team that needs to know when a shell is opened inside a production container, which image scanning cannot detect because it happens at runtimenot Rhombus Systems
  • A regulated business required to evidence host and container intrusion detection on Kubernetes nodes for an auditnot Rhombus Systems
  • A security team wanting a vendor-neutral detection layer whose rules they can read and modify rather than a black-box agentnot Rhombus Systems
  • A cluster where a compromised dependency might write to sensitive paths or open unexpected outbound connections, and only kernel-level visibility will catch itnot Rhombus Systems

Rhombus Systems

  • A school district running video across dozens of buildings with no local IT at each sitenot Falco
  • A clinic group needing door access and cameras in one console under a single audit trailnot Falco
  • A logistics operator that wants to search for a specific vehicle across sites without scrubbing footagenot Falco
  • An office estate replacing ageing NVRs where nobody remains who knows how to maintain themnot Falco

Where each one falls short

Documented limitations, not opinions. Every one is a constraint you would hit in normal use.

Falco

  • Falco detects and alerts but does not block; stopping an attack requires wiring up Falco Talon or your own response tooling, so out of the box a confirmed detection still means a human intervening after the fact.
  • The default rule set is noisy in real clusters and generates a large volume of benign matches from normal operational activity; without weeks of tuning, alert fatigue sets in and the team stops reading the feed, which is the usual failure mode.
  • There is no storage, console, search or case management in the project, so a working detection capability means also running Falcosidekick, an event store, a dashboard and alert routing, all of which you build, host and maintain.
  • The modern eBPF driver requires kernel 5.8 or later; older hosts fall back to the legacy probe or the kernel module, which brings driver-building against kernel headers and the operational fragility that comes with it on every kernel upgrade.
  • Per-node syscall instrumentation carries measurable CPU overhead on busy hosts, and the cost scales with syscall volume rather than with cluster size, so the noisiest and most performance-sensitive workloads are exactly the ones that feel it most.

Rhombus Systems

  • The per-camera annual licence never ends and a camera without an active licence stops working, so the total cost over a ten-year hardware life is several times the hardware price.
  • Cameras must be Rhombus, so there is no reuse of existing IP cameras and migrating away means replacing every device rather than changing software.
  • Cloud archiving is priced separately by retention and stream count, and long retention on multisensor cameras runs into five figures per camera, which can dwarf everything else in the quote.
  • On-camera storage is the default retention, so a camera physically stolen or destroyed takes its unarchived footage with it unless cloud archiving was paid for on that camera.
  • Analytics and integrations are good for mid-market needs but shallower than a dedicated enterprise VMS with a large third-party ecosystem, so specialist requirements like advanced LPR or forensic search hit limits.

Pricing, plan by plan

Falco

Free
  • Falco (open source)Free
    • Apache 2.0 licence, CNCF graduated project
    • eBPF and kernel module drivers
    • Full rules engine and default rule set

Rhombus Systems

$149/year
  • Professional$149/year
    • Per camera per year
    • Cloud console and management
    • On-camera storage retention
  • Enterprise$199/year
    • Per camera per year
    • Everything in Professional
    • Flexible cloud archiving options
  • Cloud archiving$undefined/year
    • Priced separately by retention period and stream count
    • Multisensor cameras cost several times a single sensor camera
    • Long retention on multisensor models can reach five figures per camera

Which should you pick?

Choose Falco if

  • You need ebpf kernel instrumentation.
  • You want to start without paying.
  • You work on Linux, Kubernetes, Self-hosted.
  • You also want system call rules engine.
Falco review

Choose Rhombus Systems if

  • You need on-camera storage.
  • You work on Web, iOS, Android.
  • You also want no nvr or server.
Rhombus Systems review

Questions people ask

Is Falco or Rhombus Systems better?
Neither clearly leads. Falco starts at Free and Rhombus Systems at $149/year, and user ratings are close enough to be indistinguishable. Choose on capability and platform support.
Which is cheaper, Falco or Rhombus Systems?
Falco has a free tier; the other does not. Paid plans start at Free for Falco and $149/year for Rhombus Systems.
Does Falco or Rhombus Systems run on more platforms?
Falco runs on Linux, Kubernetes, Self-hosted. Rhombus Systems runs on Web, iOS, Android.
Can I use Falco for free?
Yes. Falco has a free tier, so you can try it without paying. Rhombus Systems starts at $149/year.
What is Falco best used for?
Falco is most often used for a platform team that needs to know when a shell is opened inside a production container, which image scanning cannot detect because it happens at runtime, a regulated business required to evidence host and container intrusion detection on kubernetes nodes for an audit, a security team wanting a vendor-neutral detection layer whose rules they can read and modify rather than a black-box agent, a cluster where a compromised dependency might write to sensitive paths or open unexpected outbound connections, and only kernel-level visibility will catch it. Of those, a platform team that needs to know when a shell is opened inside a production container, which image scanning cannot detect because it happens at runtime and a regulated business required to evidence host and container intrusion detection on kubernetes nodes for an audit are not what Rhombus Systems is typically brought in for.
What can Falco do that Rhombus Systems cannot?
Falco covers eBPF kernel instrumentation, System call rules engine, Container and Kubernetes context, Default rule set. Rhombus Systems covers On-camera storage, No NVR or server, AI search, Access control.

Answered from the vendors’ own pages

Falco: Does Falco block attacks?

No. It detects and emits events. Response requires Falco Talon or your own automation on top.

Rhombus Systems: Do I need an NVR or a server?

No. Cameras record on board and connect directly to the cloud console, which is the main operational reason organisations pick it.

Falco: Is Falco owned by Sysdig?

Sysdig created and open sourced it, but it graduated within the CNCF in February 2024, so governance sits with the foundation rather than the vendor.

Rhombus Systems: What does the licence cost?

Roughly $149 per camera per year for Professional and about $199 for Enterprise, typically sold in one, three, five or ten year terms.

Falco: What does it cost?

The project is Apache 2.0 with no licence fee. The cost is the storage, routing, tuning and staff time needed to make its output useful.

Rhombus Systems: Is cloud storage included?

No. On-camera storage is the default. Cloud archiving is a separate charge priced by retention duration and number of streams.

Falco: What kernel version do I need?

Kernel 5.8 or later for the default modern eBPF driver. Older hosts need the legacy eBPF probe or the kernel module.

Rhombus Systems: Can I use my existing cameras?

No. The platform works only with Rhombus hardware, which is the trade-off for the zero-server architecture.

Share

Related pages

More on Falco

More on Rhombus Systems

Keep looking

Other head to heads