Threat Detection Built on Falco

Our Vision

The cloud brings flexibility and dynamism to modern application development; but it poses new challenges for security. That's why we created Falco, the open source solution for threat detection in hosts, containers, and the cloud.

Years before anyone learned how to pronounce Kubernetes, we set the course for container and cloud threat detection, and ensured it was built on an open source platform.

We built on a heritage of detection and forensics. Twenty years ago, we created Wireshark, now an indispensable part of every network engineer's toolkit. Ten years ago, we saw the coming change in computing architectures, and how a similar approach was essential for observing what was happening in hosts and containers.

Falco is based on a unique technical vision, informed by deep experience, and now underpins everything we do. Our products have Falco at their core, delivering detection and runtime insights that power a suite of security solutions.

Open Source

Why did we choose to open source our platform? To be effective, the capability to observe workloads needs to be everywhere. We started with the tool that named our company, sysdig, and grew it into a mature solution for threat detection, Falco, now homed at the Cloud Native Computing Foundation (CNCF). As a CNCF graduated project, Falco sits at the same level as Kubernetes, a hallmark of broad adoption and dependability.

Modern platforms are built on an open source stack, and we knew that delivering effective security requires an open source solution. Runtime security must be broadly available in order to meet the challenges of modern infrastructure and threat vectors, and that happens best when it’s an integrated part of the stack: from hosts, to containers and Kubernetes.

Falco Feeds
by Sysdig

Falco is the standard for runtime threat detection in the cloud. But default Falco rules must be tuned and validated to accurately detect insecure behavior and evolving security threats. Falco Feeds by Sysdig extends the power of Falco by giving open source-focused companies access to expert-written rules that are continuously updated as new threats are discovered. Backed by the Sysdig Threat Research Team (TRT), a dedicated group of threat researchers on the leading edge of emerging cloud risks and vulnerabilities, Falco Feeds by Sysdig ensures you always have the latest defenses in place.