Skip to content
SPECIFICTION
Get listed

Falco

falco.org

Free plan LinuxSelf-hosted
Visit falco.org
Spec score 7.7 #9 of 23 in Cloud Workload Protection Platforms

What it is

Falco is a free, open source runtime security project for Linux and self-hosted environments. It monitors hosts, containers, Kubernetes, and cloud environments for abnormal behavior, potential threats, and compliance violations in real time. Events are compared with built-in detection rules, and users can create rules for their own environments. Sources include Linux kernel system calls, Kubernetes audit logs, cloud events such as AWS CloudTrail, and events from GitHub and Okta. For kernel event monitoring, Falco uses an eBPF driver by default and offers a kernel module for wider compatibility. Installation options cover Linux hosts, Docker containers, and Kubernetes, including official Helm charts; supported architectures include x86_64 and ARM64. Falcosidekick can forward events to more than 50 systems, including email, chat, message queues, serverless functions, and databases. Falco is hosted by the CNCF as a graduated project. Detection depends on having appropriate rules in place, while resource use varies with server load and workload. The project recommends testing performance in the target environment.

Spec sheet

Purpose
Falco provides runtime security across hosts, containers, Kubernetes, and cloud environments, detecting abnormal behavior, potential threats, and compliance violations in real time.Read 4 Oct 2026 · falco.org
Deployment
The project provides installation options for Linux hosts, Docker containers, and Kubernetes, including official Helm charts.Read 4 Oct 2026 · falco.org
Integrations
Falco's plugins include sources for GitHub webhooks, Kubernetes audit events, AWS EKS audit events, CloudTrail logs, Docker events, Okta audit logs, and Nomad events.Read 4 Oct 2026 · falco.org
Support
Community support is available through Kubernetes Slack and the project's mailing list; the project also lists partner-provided enterprise offerings.Read 4 Oct 2026 · falco.org
Founded
2016Read 28 Sep 2026 · falco.org
Architectures
Falco supports x86_64 and ARM64 architectures, with Linux packages listed for x86_64 and aarch64.Read 4 Oct 2026 · falco.org
Commercial offering
The project site links to partner commercial offerings for enterprise support and detection rules, but does not list their prices.Read 4 Oct 2026 · falco.org
Detection rules
Falco compares events against built-in rules and lets users create custom rules for their environment.Read 4 Oct 2026 · falco.org
Event sources
Falco can ingest Linux kernel syscalls, Kubernetes audit logs, cloud events such as AWS CloudTrail, and events from systems such as GitHub and Okta.Read 4 Oct 2026 · falco.org
Notable detection limit
Falco does not automatically cover every possible threat; detection depends on having appropriate rules in place.Read 4 Oct 2026 · falco.org
Performance considerations
Falco's resource use varies with server load and workload, and the project recommends testing performance in the target environment.Read 4 Oct 2026 · falco.org
Project status
Falco is an open source project hosted by the CNCF and is described on its site as a CNCF graduated project.Read 4 Oct 2026 · falco.org
Security mechanism
For kernel event monitoring, Falco uses a modern eBPF driver by default and offers a kernel module for wider compatibility.Read 4 Oct 2026 · falco.org
Threat response
Falcosidekick can forward Falco events to more than 50 systems, including email, chat, message queues, serverless functions, and databases.Read 4 Oct 2026 · falco.org

Plans and prices

Falco Free Zero cost to start · open source Read 4 Oct 2026 · falco.org

Every Falco plan and price →

Strong points and limits

Strong points

  • Built-in and custom detection rules.
  • Ingests kernel, Kubernetes, cloud, and service events.
  • Falcosidekick forwards events to more than 50 systems.
  • Supports x86_64 and ARM64 architectures.
  • Official Helm charts are available.

Limits

  • Detection depends on appropriate rules being in place.
  • Resource use varies with server load and workload.
  • Performance should be tested in the target environment.

Who it suits

Falco suits teams running Linux, containers, Kubernetes, or cloud environments that can manage detection rules and self-hosted deployment. It may also fit teams seeking community support or partner-provided enterprise offerings.

Verdict

Falco provides free runtime monitoring across Linux and cloud-related environments, with flexible event sources and forwarding options. Its coverage depends on suitable rules, and resource needs vary by workload.

Where Specifiction places it

Alternatives to FalcoAll alternatives →