runtime security

Falco

Falco is a runtime security tool for containers and Kubernetes. This profile covers what it does, how it is deployed, and where it stops being the right choice.

What the product actually does

Falco reads system calls through a kernel module or an eBPF probe, evaluates them against a set of rules, and raises an alert when a rule matches. A shell spawned inside a container that should never run a shell is the canonical example.

The rules are the product. They are written in a small expression language over the syscall stream, and the community rule set covers the common container escape and privilege escalation patterns.

How it is deployed and what it costs

Open source and free. The cost is a daemonset on every node plus the backend that receives the alerts, and the operational work of tuning rules so the alert volume is actionable.

The commercial offering adds a managed backend and a rule library. The engine itself remains the open-source project.

Where it breaks down

Alert volume. A default rule set on a busy cluster produces a great deal of noise, and a team that does not invest in tuning will stop reading the alerts within a month.

It is a detection tool rather than a prevention tool. Falco tells you a shell was spawned; it does not stop it. Blocking requires a different mechanism.

What switching costs

Low. The rules are portable expressions and the syscall source is the kernel. A replacement reads the same events.

Sources

Falco public documentation, read October 2026.