Falco
Falco is an open source runtime security project for Linux and self-hosted environments.
What Falco is
Falco is an open source runtime security project for Linux and self-hosted environments. It monitors hosts, containers, Kubernetes, and cloud environments to detect abnormal behavior, potential threats, and compliance violations in real time. Falco compares events against built-in rules, and users can create custom rules for their environment. It can ingest Linux kernel system calls, Kubernetes audit logs, cloud events such as AWS CloudTrail, and events from systems including GitHub and Okta. For kernel monitoring it uses a modern eBPF driver by default, with a kernel module available for wider compatibility. Deployment options cover Linux hosts, Docker containers, and Kubernetes, including official Helm charts; supported architectures include x86_64 and ARM64. Falcosidekick can forward events to more than 50 systems, including email, chat, message queues, serverless functions, and databases. Falco is free, with a plan listed as free. Detection depends on suitable rules, and resource use varies by workload.
Good
- Open source and listed as free.
- Monitors hosts, containers, Kubernetes, and cloud environments.
- Supports custom rules and multiple event sources.
- Falcosidekick forwards events to more than 50 systems.
- Installation options include Kubernetes and official Helm charts.
Watch out
- Detection depends on having suitable rules in place.
- Resource use varies with server load and workload.
- Enterprise offerings have no listed prices.
Who it suits
Falco may suit teams seeking runtime monitoring for Linux, containers, Kubernetes, and cloud environments. It is intended for self-hosted deployment and requires appropriate detection rules for the threats a team wants to identify.
Verdict
Falco offers broad event monitoring and routing options for self-hosted runtime security. Teams should account for rule coverage and workload-dependent resource use.
Plans and prices
From Falco's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Falco | Free | Zero cost to start · open source |
The facts
Each one read from Falco's own pages, with the date it was checked.
What it does
- Architectures
- Falco supports x86_64 and ARM64 architectures, with Linux packages listed for x86_64 and aarch64.checked 4 Oct 2026
- Commercial offering
- The project site links to partner commercial offerings for enterprise support and detection rules, but does not list their prices.checked 4 Oct 2026
- Deployment
- The project provides installation options for Linux hosts, Docker containers, and Kubernetes, including official Helm charts.checked 4 Oct 2026
- Detection rules
- Falco compares events against built-in rules and lets users create custom rules for their environment.checked 4 Oct 2026
- Event sources
- Falco can ingest Linux kernel syscalls, Kubernetes audit logs, cloud events such as AWS CloudTrail, and events from systems such as GitHub and Okta.checked 4 Oct 2026
- Integrations
- Falco's plugins include sources for GitHub webhooks, Kubernetes audit events, AWS EKS audit events, CloudTrail logs, Docker events, Okta audit logs, and Nomad events.checked 4 Oct 2026
- Notable detection limit
- Falco does not automatically cover every possible threat; detection depends on having appropriate rules in place.checked 4 Oct 2026
- Performance considerations
- Falco's resource use varies with server load and workload, and the project recommends testing performance in the target environment.checked 4 Oct 2026
- Project status
- Falco is an open source project hosted by the CNCF and is described on its site as a CNCF graduated project.checked 4 Oct 2026
- Purpose
- Falco provides runtime security across hosts, containers, Kubernetes, and cloud environments, detecting abnormal behavior, potential threats, and compliance violations in real time.checked 4 Oct 2026
- Security mechanism
- For kernel event monitoring, Falco uses a modern eBPF driver by default and offers a kernel module for wider compatibility.checked 4 Oct 2026
- Support
- Community support is available through Kubernetes Slack and the project's mailing list; the project also lists partner-provided enterprise offerings.checked 4 Oct 2026
- Threat response
- Falcosidekick can forward Falco events to more than 50 systems, including email, chat, message queues, serverless functions, and databases.checked 4 Oct 2026
The company
- Founded
- 2016checked 28 Sep 2026
Alternatives to Falco
- 1
Amazon GuardDuty
Free planWebAPILinux7.6From $0.03 a month - 2
Calico Cloud
Free planWebAPILinuxSelf-hosted7.6Free plan - 3
Sysdig Secure
WebAPILinuxmacOS7.2From $20 a month - 4
Qualys TotalCloud
Free planWebAPI7.0Free plan - 5
SentinelOne Singularity Cloud Security
AndroidiOSWebAPI6.9 - 6
KubeArmor
Free planAPILinuxSelf-hosted6.5Free plan