Platform profile · Rank 6 of 9
Sysdig Secure review: Falco runtime depth, agent-dependent coverage
Short answer
Sysdig Secure builds runtime detection on Falco, the CNCF graduated project Sysdig created, and ties for the highest runtime score here. Agentless posture covers misconfigurations and permissions, and agentless host vulnerability scanning is documented for AWS, Google Cloud and Azure, but in-use analysis needs the agent, so it ranks 6 of 9 at 7.67. AWS Marketplace lists a monthly per-unit contract price.
Desk research from public vendor pages read in September 2026, updated 2026-10-11. Editorial assessment; we did not run the products.
Coverage score
Rank 6 of 9 on default weights. Change the weights in the coverage calculator
Which environments does Sysdig name?
Sysdig's docs say AWS, Google Cloud and Azure support all its agentless cloud features, and Oracle Cloud supports agentless CSPM only.
Source: Sysdig docs: connect cloud accounts · Read 11 Oct 2026
- Named on the vendor's pages we reviewed
- Not named on the pages we reviewed (this does not mean unsupported)
Learn more: what a vendor's list of named clouds tells you
How does Sysdig see workloads?
- Coverage model
- Agentless CSPM, CIEM and host vulnerability scanning on AWS, Google Cloud and Azure; in-use analysis and runtime detection need the agent.
Source: Sysdig docs: connect cloud accounts · Read 11 Oct 2026
- Path to first findings
- Agentless connection; Sysdig's docs say compliance results appear about 5 to 10 minutes after connection, varying with scale. In-use package insight needs the agent.
Source: Sysdig docs: compliance · Read 11 Oct 2026
What does Sysdig claim?
What does Sysdig cost?
AWS Marketplace, 1-month contract: CNAPP Enterprise $72.00 per unit per month (the unit was not captured in our read); 12-month contracts listed as saving up to 17%. Sysdig's own pricing page: licensing by number of hosts, prices by quote.
Source: AWS Marketplace: Sysdig Cloud Security and Observability · Read 11 Oct 2026
How does Sysdig score on each criterion?
| Criterion | Weight | Score | Why |
|---|---|---|---|
| Clouds and environments named | 20% | 8.0 | Docs name AWS, Google Cloud and Azure for all agentless features and Oracle Cloud for CSPM only. |
| Agentless workload depth | 25% | 7.6 | Agentless CSPM, CIEM and host vulnerability scanning are documented for AWS, Google Cloud and Azure; in-use analysis still needs the agent. |
| Path to first findings | 15% | 6.5 | Sysdig's docs say compliance results appear about 5 to 10 minutes after connection; in-use insight waits on the agent rollout. |
| Risk context from day one | 15% | 8.2 | Runtime insight into which packages are in use filters out vulnerabilities in code that never runs. |
| Runtime layer when you need it | 10% | 9.6tied highest in set | Runtime detection built on Falco, the CNCF graduated project Sysdig created. |
| Integrations and reach | 7% | 8.0 | Falco's open-source community and Kubernetes-native tooling extend its reach. |
| Cost visibility before purchase | 8% | 5.5 | Host-based licensing on its own site and a $72.00 per unit monthly contract price on AWS Marketplace, with the unit not stated in our read. |
- Clouds:
Source: Sysdig docs: connect cloud accounts · Read 11 Oct 2026
- Agentless:
Source: Sysdig docs: connect cloud accounts · Read 11 Oct 2026
- Setup:
Source: Sysdig docs: compliance · Read 11 Oct 2026
- Context:
Source: Sysdig Secure · Read 27 Sep 2026
- Runtime:
Source: Falco · Read 27 Sep 2026
- Integrations:
Source: Falco · Read 27 Sep 2026
- Pricing:
Source: AWS Marketplace: Sysdig Cloud Security and Observability · Read 11 Oct 2026
Briefings about Sysdig
- Which Clouds Each CNAPP Names: Nine Platforms, Eight Environments
- Agentless Reach by Workload Type: VMs, Containers, Serverless, PaaS
- Cloud Security Coverage News, September 2026: What Changed and Why It Matters
- Why Pricing Visibility Counts in a Cloud Coverage Ranking, and Why Only 8%
- Minutes, 30 Seconds, 15 Seconds: How to Read CNAPP Speed Claims
- Orca Security or Wiz for Multi-Cloud Coverage? Where Each Scores Higher
Where does it lead, and where does it fall short?
Leads
- Highest or tied highest in set on runtime layer when you need it.
- Runtime detection built on Falco, tied for the highest runtime score here.
- Publishes its licensing unit (hosts), which helps a buyer size a quote.
Falls short
- Scores below 4 platforms on pricing.
- Oracle Cloud gets agentless CSPM only; full agentless features are documented for AWS, Google Cloud and Azure.
- Runtime and in-use analysis need the agent, so the deepest coverage waits on a rollout.
Key facts
| Ownership | Sysdig |
|---|---|
| Open-source project | Falco (created by Sysdig, CNCF graduated project) |
| Best fit | Kubernetes-heavy teams that want Falco-based runtime detection |
| FedRAMP | Not in our sources |
| Compliance frameworks | NIST CSF v2.0, NIST SP 800-53 Rev 5, NIST 800-171, FedRAMP Rev 4 baselines, DISA STIG, CIS benchmarks, PCI DSS v4.0, HIPAA, HITRUST, ISO/IEC 27001:2022, SOC 2, GDPR, DORA, NIS2, SOX and FISMA policies, among others Source: Sysdig docs: compliance · Read 11 Oct 2026 |
| Website | www.sysdig.com/products/secure |
How does Sysdig compare head to head?
- Sysdig 7.67 v Orca 9.09 · Orca scores higherHead to head
- Sysdig 7.67 v Wiz 9.03 · Wiz scores higherHead to head
- Sysdig 7.67 v CrowdStrike 7.94 · CrowdStrike scores higherHead to head
- Sysdig 7.67 v Defender for Cloud 7.86 · Defender for Cloud scores higherHead to head
- Sysdig 7.67 v Cortex Cloud 7.75 · Cortex Cloud scores higherHead to head
- Sysdig 7.67 v Upwind 7.63 · Sysdig scores higherHead to head
- Sysdig 7.67 v SentinelOne 7.49 · Sysdig scores higherHead to head
- Sysdig 7.67 v Aqua 7.45 · Sysdig scores higherHead to head
Frequently asked questions
How does Sysdig Secure score for multi-cloud coverage?
7.67 out of 10, rank 6 of 9 on our default weights. Its highest score is on Runtime layer when you need it (9.6) and its lowest on Cost visibility before purchase (5.5).
Which clouds does Sysdig Secure name?
On the pages we reviewed: AWS, Azure, Google Cloud and Oracle Cloud. Sysdig's docs say AWS, Google Cloud and Azure support all its agentless cloud features, and Oracle Cloud supports agentless CSPM only.
What does Sysdig Secure cost?
AWS Marketplace, 1-month contract: CNAPP Enterprise $72.00 per unit per month (the unit was not captured in our read); 12-month contracts listed as saving up to 17%. Sysdig's own pricing page: licensing by number of hosts, prices by quote.