Overview
Product Information on Sysdig Secure
What is Sysdig Secure?
Sysdig Secure Pricing
Sysdig Secure Product Images






Sysdig is a cloud security company that focuses on runtime in order to both prevent, detect, and respond to attacks in real time. The company combines the ability to detect changes in risk using runtime insights, an AI-based architecture, and open source Falco. This technology base enables the company to correlate signals across cloud workloads, identities, and services to uncover hidden attack paths.
Do You Manage Peer Insights at Sysdig?
Access Vendor Portal to update and manage your profile.
The compliance section is really well done. Being able to see frameworks side-by-side, understand which controls we are failing, and mark certain findings as accepted risk has been helpful for our audits. I also like how vulnerabilities are separated by where they show up - makes it easier to figure out if something slipped through CI or came from the base image. The Falco rules give us a lot of control once you figure out how to use them properly.
The meta data for the vulnerabilities is quite good. Integration with cloud and k8s is easy and painless. Anomaly detection is pretty good
Sysdig's vulnerability management tools have excellent context-aware filtering that allows us to filter CVEs by those that are critical, in-use by the workload at runtime, exposed, exploitable, and have a fix available. This has allowed us to cut 99.99% of CVE noise from our environments and focus on fixing the most important things first. We also like the runtime security features - Sysdig is able to sort through and filter out noise and false positives and is able to learn your environment. This has led to a massive reduction in alert fatigue. It is also very easy to apply runtime security tools to workloads (such as preventing the execution of specific binaries, etc). We've also been enjoying the network security tools. Sysdig is able to track which workloads communicate with each other and provide diagrams and network policy suggestions.
Too many medium-severity alerts that turn out to be nothing. We're constantly triaging stuff that doesn't matter for our actual environment. The prioritization isn't smart enough - it doesn't seem to consider whether a vulnerable package is actually being used or exposed to the internet. We need better context around which CVEs actually pose risk to us, versus just existing somewhere in the stack. Also, the data security features feel pretty basic compared to what you get for infra security.
The UI needs a lot of improvement, it's confusing and not intuitive. Opening tickets per image is a big missing feature to complete the vuln mgmt workflow. The automatically generated remediation guidance from Sage is missing key information. The pricing model is a huge pain, as it's difficult to estimate growth in nodes and not all nodes are created equal and it emphasizes you to use the largest node size possible to save money. Constantly needing to true-up within the year. My infra team also says the agent consumes too many resources is and much heavier than other equivalent agents. There's also no internet exposure or attack path feature, as it's only for the ingress controllers, but nothing behind them.
We wish that Sysdig offered more tooling to help developers deploy secure applications to Kubernetes - such as secure container images and other kinds of SAST/DAST tooling to help developers catch issues before they make it to the clusters. We also wish that Sysdig's integrations and plugins with other products (like IDEs, CI/CD pipelines, etc) were more well maintained. Many of these are open source integrations and have had many bugs and issues. Granted, they were addressed and fixed, but they do not seem very active. The final thing is we wish that Sysdig supported on-prem environments better when it comes to workload exposure filtering. Currently, it only works on cloud platforms. While there is a feature request for this to work on prem, it has been in the works for almost a year with little update.