Falco

What it is

Falco is a runtime security tool for containers, Kubernetes, and Linux hosts. It taps into kernel syscalls (via eBPF or a kernel module) and Kubernetes audit logs to detect anomalous behavior in real time — unexpected process execution, privilege escalation, shell spawned in a container, file writes to sensitive paths, that kind of thing. Rules are YAML-defined and pattern-matched against the event stream.

Note: the category tag here says "Provisioning," which is misleading — Falco doesn't provision anything. It's a detection/observability tool for security events. Worth flagging in case that tag is being used for filtering or comparison purposes.

Who builds it and why

Falco is a CNCF graduated project, which means it's cleared the bar for production adoption, governance, and multi-vendor maintenance — CNCF doesn't graduate side projects. Founding org and founding date aren't publicly available in the data provided, but the project's trajectory (266 contributors, active commits through mid-2026) shows it's not a single-vendor pet project anymore, even if it originated from one. Sysdig has historically been the primary commercial backer and still drives a large share of engineering, but the contributor base has broadened enough that it functions as genuine community infrastructure rather than a vendor's open-core bait.

Production readiness signal

• Graduated CNCF status: the strongest maturity signal CNCF gives out. Falco sits alongside Kubernetes, Prometheus, and etcd in that tier.
• 266 contributors: healthy bus factor, not dependent on 2-3 people.
• Last commit 2026-06-29: actively maintained, not abandoned.
• 9,107 GitHub stars: respectable but modest for a graduated project — reflects that runtime security is a narrower niche than, say, ingress controllers or CI tools.
• Latest release 0.44.1: pre-1.0 versioning despite graduated status and years of production use. This is common in the space (rules engines iterate fast) but check changelogs for breaking rule syntax changes between minor versions before upgrading blindly.
• Written in C++, which matters for a tool sitting in the kernel event path — performance and memory safety discipline are non-trivial here, and the codebase has had real-world hardening from running in production clusters at scale.

Who should use this

Teams running multi-tenant or externally-facing Kubernetes clusters who need runtime threat detection beyond static image scanning and admission control. If your compliance posture requires "detect and alert on anomalous runtime behavior" (PCI-DSS, SOC 2 with a security-conscious auditor, FedRAMP), Falco is a defensible, audited choice specifically because of the CNCF graduation. Also a good fit if you already have a SIEM or alerting pipeline and just need a solid event source for kernel-level container behavior.

Who should NOT use this

• Small teams without a security operations function: Falco produces a firehose of events. Without someone tuning rules and triaging alerts, it becomes noise that gets ignored — worse than not having it, because it creates false confidence.
• Anyone expecting a turnkey product: default rules generate significant false positives in real workloads. Budget real engineering time for rule tuning, not a weekend install.
• Non-Linux workloads: Falco is Linux kernel-dependent (syscalls, eBPF). Windows containers are not a fit.
• Teams wanting prevention, not detection: Falco alerts after the fact. If you need to block actions at admission time, pair it with OPA/Gatekeeper or Kyverno instead, or in addition.

Alternatives

• Tetragon (Cilium/Isovalent) — eBPF-native, tighter integration if you're already on Cilium for networking.
• Tracee (Aqua Security) — similar syscall-tracing approach, lighter footprint, smaller community than Falco.
• Commercial EDR agents (CrowdStrike, SentinelOne with container support) — if you want vendor support and a UI instead of self-managed rules and alert routing.

Pricing

Fully open source, Apache-2.0. No license cost. Sysdig sells a commercial platform (Sysdig Secure) built on top of Falco with managed rules, UI, and support, but Falco itself is free to run standalone.