Overview
Product Information on Sysdig Secure
What is Sysdig Secure?
Sysdig Secure Pricing
Sysdig Secure Product Images






Sysdig is a cloud security company that focuses on runtime in order to both prevent, detect, and respond to attacks in real time. The company combines the ability to detect changes in risk using runtime insights, an AI-based architecture, and open source Falco. This technology base enables the company to correlate signals across cloud workloads, identities, and services to uncover hidden attack paths.
Do You Manage Peer Insights at Sysdig?
Access Vendor Portal to update and manage your profile.
Sysdig is the company behind Falco, an open-source CNCF project and the de facto threat detection system for Kubernetes. This fact alone is an indication of the caliber of the underlying product that Sysdig has built. Unlike most other vendors, Sysdig's security fundamentals are rock solid. The Sysdig platform provides an unprecedented level of detail on the security posture and active threat landscape of our cloud and container environment. Being able to define and tweak detailed rules, compare against industry benchmarks, and have Sysdig automatically generate network policies are all some simple highlights. Sysdig's new AI features also simplify RCA considerably. The best part about Sysdig is that it checks off many boxes, including threat detection, vulnerability scanning, cloud posture management, network monitoring, and much more.
The meta data for the vulnerabilities is quite good. Integration with cloud and k8s is easy and painless. Anomaly detection is pretty good
The compliance section is really well done. Being able to see frameworks side-by-side, understand which controls we are failing, and mark certain findings as accepted risk has been helpful for our audits. I also like how vulnerabilities are separated by where they show up - makes it easier to figure out if something slipped through CI or came from the base image. The Falco rules give us a lot of control once you figure out how to use them properly.
The Sysdig product is a bit rough around the edges. The UI can be a bit dense and difficult to navigate. This has been improving, but there's still some way to go. Onboarding was also unnecessarily difficult. The team has responded well to feedback and has made several improvements. I would like to see further improvements that make it easier to onboard (for example, managed docker registry scanning).
The UI needs a lot of improvement, it's confusing and not intuitive. Opening tickets per image is a big missing feature to complete the vuln mgmt workflow. The automatically generated remediation guidance from Sage is missing key information. The pricing model is a huge pain, as it's difficult to estimate growth in nodes and not all nodes are created equal and it emphasizes you to use the largest node size possible to save money. Constantly needing to true-up within the year. My infra team also says the agent consumes too many resources is and much heavier than other equivalent agents. There's also no internet exposure or attack path feature, as it's only for the ingress controllers, but nothing behind them.
Too many medium-severity alerts that turn out to be nothing. We're constantly triaging stuff that doesn't matter for our actual environment. The prioritization isn't smart enough - it doesn't seem to consider whether a vulnerable package is actually being used or exposed to the internet. We need better context around which CVEs actually pose risk to us, versus just existing somewhere in the stack. Also, the data security features feel pretty basic compared to what you get for infra security.