Falcovs
Sysdig
Sysdig: If you want the commercial platform from Falco’s creators, with storage, console, triage and response included rather than assembled
Falco
CNCF-graduated runtime threat detection for Linux and Kubernetes using eBPF
As of 31 August 2026, Falco is free to use. Open source runtime security that watches kernel system calls and alerts on suspicious behaviour inside running containers. Softwr lists it under Cybersecurity. Falco is made by Cloud Native Computing Foundation, project created by Sysdig, available on Linux, Kubernetes, Self-hosted.
Overview
What Falco does
Falco taps the Linux kernel through a modern eBPF probe, reconstructs the stream of system calls made by processes on the node, enriches them with container and Kubernetes metadata, and evaluates them against a rules engine. When a rule matches, a shell spawning inside a container, a write to a path under /etc, an outbound connection from a process that should never make one, it emits an event. It ships as a DaemonSet so every node is covered, runs on x86_64 and aarch64, and is licensed Apache 2.0. The governance fact matters here. Falco was created and open sourced by Sysdig in 2016, entered the CNCF sandbox in 2018 and graduated in February 2024, making it the first runtime security project to reach that level. Graduation means the project is not Sysdig’s to change unilaterally, which is a genuine reduction in vendor risk compared with an open-core tool whose maintainer can relicense it. Sysdig still sells the commercial platform most large Falco users end up buying alongside it. Buyers are platform and security teams running Kubernetes who need detection at the kernel layer that image scanning cannot provide. The trade-off is that Falco is one component of a detection capability, not the capability itself. It has no storage, no console, no case management and no response action. You supply Falcosidekick, an event store, alert routing, tuning and the people to read what comes out. Untuned, it is loud enough that teams stop reading it, which is the most common way a Falco deployment fails.
What people use it for
- A platform team that needs to know when a shell is opened inside a production container, which image scanning cannot detect because it happens at runtime
- A regulated business required to evidence host and container intrusion detection on Kubernetes nodes for an audit
- A security team wanting a vendor-neutral detection layer whose rules they can read and modify rather than a black-box agent
- A cluster where a compromised dependency might write to sensitive paths or open unexpected outbound connections, and only kernel-level visibility will catch it
Related searches
The honest half
Where it falls short
Concrete and checkable, so you can decide whether any of them matter to you. This is the half of a review a vendor will not write about Falco.
- Falco detects and alerts but does not block; stopping an attack requires wiring up Falco Talon or your own response tooling, so out of the box a confirmed detection still means a human intervening after the fact.
- The default rule set is noisy in real clusters and generates a large volume of benign matches from normal operational activity; without weeks of tuning, alert fatigue sets in and the team stops reading the feed, which is the usual failure mode.
- There is no storage, console, search or case management in the project, so a working detection capability means also running Falcosidekick, an event store, a dashboard and alert routing, all of which you build, host and maintain.
- The modern eBPF driver requires kernel 5.8 or later; older hosts fall back to the legacy probe or the kernel module, which brings driver-building against kernel headers and the operational fragility that comes with it on every kernel upgrade.
- Per-node syscall instrumentation carries measurable CPU overhead on busy hosts, and the cost scales with syscall volume rather than with cluster size, so the noisiest and most performance-sensitive workloads are exactly the ones that feel it most.
Cross-shopped
What people choose instead of Falco
Each pairing was judged by two reviewers asking whether a buyer would genuinely weigh the two against each other. The ones that failed were deleted rather than published.
- FalcovsWiz
Wiz: If your priority is agentless cloud posture and risk prioritisation across accounts rather than per-node kernel detection
- FalcovsSnyk
Snyk: If the risk you are actually managing is vulnerable dependencies and images before deployment rather than behaviour at runtime
Pricing
What Falco costs
Taken from the vendor's own pricing page. Prices move, so check before you buy.
Falco (open source)
Free
- Apache 2.0 licence, CNCF graduated project
- eBPF and kernel module drivers
- Full rules engine and default rule set
- Falcosidekick and Talon
- Community support only; you provide storage, routing, tuning and staff
Capabilities
Features
eBPF kernel instrumentation
Modern CO-RE eBPF probe as default, with legacy eBPF and a kernel module for older kernels
System call rules engine
YAML rules matched against enriched syscall events
Container and Kubernetes context
Events tagged with pod, namespace, image and label metadata
Default rule set
Community-maintained rules for common container attack behaviour
Falcosidekick
Fan-out of events to Slack, webhooks, SIEMs, object storage and message queues
Falco Talon
Response engine for triggering actions on a rule match
Plugins framework
Extends detection beyond syscalls to sources such as cloud audit logs
DaemonSet deployment
Per-node coverage on x86_64 and aarch64 clusters
Apache 2.0 licence
CNCF-governed, no commercial licence tier in the project itself
Answered, with sources
Questions people ask
Each answer names the page it came from, so you can check it rather than take our word for it.
Does Falco block attacks?
No. It detects and emits events. Response requires Falco Talon or your own automation on top.
Is Falco owned by Sysdig?
Sysdig created and open sourced it, but it graduated within the CNCF in February 2024, so governance sits with the foundation rather than the vendor.
What does it cost?
The project is Apache 2.0 with no licence fee. The cost is the storage, routing, tuning and staff time needed to make its output useful.
What kernel version do I need?
Kernel 5.8 or later for the default modern eBPF driver. Older hosts need the legacy eBPF probe or the kernel module.
Keep looking
Where to go from Falco
- Falco alternativesEvery product people weigh against it
- Falco pricingPlans, floors and what the tiers exclude
- Falco badgesWhich rules it meets, and the figure behind each
- All Cybersecurity softwareThe full category
- Best Cybersecurity softwareThe shortlist, and how it was cut
Best Cybersecurity software for
Compare Falco with
- Snyk
- Teleport
- Darktrace
- LogRhythm SIEM
- Trend Micro Vision One
- Cybereason Defense Platform
- Splunk Enterprise Security
- WireGuard
- Bitwarden
- Infisical
- Semgrep
- Trivy
- One Identity
- Ory Kratos
- OWASP ZAP
- Palo Alto Networks Prisma Cloud
- Passbolt
- Ping Identity
Other Cybersecurity software
Certificate-based access to servers, Kubernetes, databases and apps, replacing shared credentials and VPNs
Pricing on request13 researched notesXDR platform correlating Trend Micro's endpoint, email, server, cloud and network sensors, licensed through a shared credit pool.
From $75/yr14 researched notesAI-driven endpoint protection and detection
From $50/yr11 researched notesModern, minimal-complexity VPN protocol with state-of-the-art cryptography
Free plan12 researched notesOpen-source static analysis tool for finding security bugs and enforcing code standards.
Free, then $30/mo10 researched notesQuest-owned identity governance, PAM and Active Directory management
Pricing on request11 researched notesFree, open-source web application scanner and intercepting proxy, now governed by the Software Security Project.
Free plan14 researched notesOpen-source password manager for teams with self-hosted or cloud deployment
Free, then $4.9/mo9 researched notesEnterprise identity for workforce and customers, with a 5,000 user floor
From $3/mo11 researched notes
Softwr does not host reviews and shows no star rating for Falco, because a rating we did not collect is not ours to publish. What is here is the pricing and platform detail from the vendor’s own pages, limitations we could state concretely, and alternatives a reviewer confirmed people weigh against it. Tell us if any of it is wrong.
More on Falco
Falco alternatives
What people switch to, and what they give up
Falco pricing
Every tier, and where the cost actually lands
Compare Falco
Put it head to head with anything we hold
Falco badge
Its rating, and an embed for your own site
Best Cybersecurity software alternatives
Large Chinese video platform that US federal buyers and federal contractors cannot lawfully use
quote
Managed video loss prevention with human auditors for restaurants, convenience stores and retail
quote
Workforce and customer authentication from a certificate authority
Per user per month
Privileged access management, endpoint privilege management and secure remote access
quote
Cloud video surveillance billed per camera per month, where retention length drives the bill more than anything else
Per camera per month
AI video search that runs on cameras you already own, starting near five dollars per camera per month
Per camera per month
Phishing-resistant passwordless authentication with device trust enforced at every login
quote