Falco review 2026: the CNCF-graduated, open-source runtime security engine for Kubernetes and Linux. See how it works, key features, and top alternatives.
Falco is an open-source runtime security tool that watches live system behavior on Linux hosts, in containers, and across Kubernetes clusters, and raises alerts when that behavior matches rules describing suspicious or malicious activity. It was created by Sysdig and open-sourced in 2016, then donated to the Cloud Native Computing Foundation, where it became the CNCF's first runtime security project and eventually reached Graduated status on February 29, 2024.
Unlike vulnerability scanners that inspect container images before deployment, Falco operates continuously in production by instrumenting the Linux kernel itself, so it can catch threats that only appear once workloads are actually running, such as a reverse shell spawned inside a compromised container or an unexpected outbound connection from a sensitive process.
Falco captures Linux syscalls using one of three interchangeable drivers: a traditional kernel module, a CO-RE eBPF probe, or a newer modern eBPF driver built on the kernel's BPF ring buffer. Captured events are enriched with container and Kubernetes metadata through Falco's internal libraries, libscap and libsinsp, then evaluated against YAML-based detection rules that combine macros, lists, and filter conditions.
Since 2022, a plugin framework has let Falco ingest event sources beyond syscalls, including AWS CloudTrail, Kubernetes audit logs, Okta, and GitHub activity, using the same rules engine and alert pipeline. Alerts are typically routed through Falcosidekick to more than 50 destinations such as Slack, PagerDuty, and SIEM platforms, with Falco Talon available as a no-code engine for automated response actions.
Falco's feature set centers on real-time kernel-level detection, flexible driver support for compatibility across kernel versions and hardened nodes, a large community-maintained rule library with maturity labeling, and a plugin architecture that extends detection to cloud service logs alongside host and container syscalls.
Its output ecosystem, built around Falcosidekick and Falco Talon, lets teams fan alerts out to existing observability and incident response tooling and automate containment actions, making Falco usable as a standalone detection engine or as the runtime security layer inside a larger commercial platform such as Sysdig Secure.
Falco is used to detect anomalous or malicious behavior in real time on Linux hosts, containers, and Kubernetes clusters, such as unexpected shell activity, privilege escalation, sensitive file access, or suspicious network connections.
Yes. Falco is fully open source under the Apache 2.0 license with no cost to download, deploy, or modify. Commercial platforms built on top of Falco, such as Sysdig Secure, are sold separately.
Falco was created and open-sourced by Sysdig in 2016. It was later donated to the Cloud Native Computing Foundation, which it now governs with maintainers from multiple companies including Amazon, Apple, IBM, Red Hat, and Sysdig.
Yes. Falco enriches every event with Kubernetes metadata such as pod and namespace, and it can also ingest Kubernetes audit log events directly, making it a common choice for Kubernetes runtime threat detection.
Falco focuses on broad detection and alerting with the largest rule library and plugin ecosystem in the category. Cilium's Tetragon adds in-kernel enforcement and blocking, while Aqua Security's Tracee emphasizes deep forensic data capture, typically at higher runtime overhead.
Not necessarily. Falco supports a traditional kernel module as a fallback, but most modern deployments use its CO-RE eBPF probe or modern eBPF driver, which avoid the need for a compiled kernel module on the host.