Tech riderRev. 4 Oct 2026

Falco

Ch 116.8of 24 Container Security Software

1Runs onLinux, self-hosted
2CostsFree plan

2 lines stated Written from the maker's own pages: falco.org

Visit site Alternatives

Overview

Falco is ranked #11 of 24 in container security software on Specifiction. It runs on Linux, Self-hosted. There is a free plan.

Falco plans and pricing

All plans

Falco Free Zero cost to start · open source falco.org · 4 Oct 2026

Compared on container security software

Free plan: Yesfalco.org

Facts

Purpose: Falco provides runtime security across hosts, containers, Kubernetes, and cloud environments, detecting abnormal behavior, potential threats, and compliance violations in real time.falco.org · 4 Oct 2026
Detection rules: Falco compares events against built-in rules and lets users create custom rules for their environment.falco.org · 4 Oct 2026
Event sources: Falco can ingest Linux kernel syscalls, Kubernetes audit logs, cloud events such as AWS CloudTrail, and events from systems such as GitHub and Okta.falco.org · 4 Oct 2026
Threat response: Falcosidekick can forward Falco events to more than 50 systems, including email, chat, message queues, serverless functions, and databases.falco.org · 4 Oct 2026
Integrations: Falco's plugins include sources for GitHub webhooks, Kubernetes audit events, AWS EKS audit events, CloudTrail logs, Docker events, Okta audit logs, and Nomad events.falco.org · 4 Oct 2026
Deployment: The project provides installation options for Linux hosts, Docker containers, and Kubernetes, including official Helm charts.falco.org · 4 Oct 2026
Architectures: Falco supports x86_64 and ARM64 architectures, with Linux packages listed for x86_64 and aarch64.falco.org · 4 Oct 2026
Security mechanism: For kernel event monitoring, Falco uses a modern eBPF driver by default and offers a kernel module for wider compatibility.falco.org · 4 Oct 2026
Notable detection limit: Falco does not automatically cover every possible threat; detection depends on having appropriate rules in place.falco.org · 4 Oct 2026
Performance considerations: Falco's resource use varies with server load and workload, and the project recommends testing performance in the target environment.falco.org · 4 Oct 2026
Support: Community support is available through Kubernetes Slack and the project's mailing list; the project also lists partner-provided enterprise offerings.falco.org · 4 Oct 2026
Project status: Falco is an open source project hosted by the CNCF and is described on its site as a CNCF graduated project.falco.org · 4 Oct 2026
Commercial offering: The project site links to partner commercial offerings for enterprise support and detection rules, but does not list their prices.falco.org · 4 Oct 2026