Sysdig

• Cloud providers and larger security platforms can ship the Apache-licensed Falco detection core without paying Sysdig (s20), so a rival could offer the same open-source detection engine as a bundled feature while Sysdig Secure stays the paid product.
• The growth figures the reviewed record carries after December 2021 are all company statements: 110 percent net revenue retention in June 2026 and Falco downloads over 200 million in August 2026 (s7, s30), so the reviewed record carries no outside measure of how the business is growing now.
• Sysdig publishes the top rules of its managed Falco Feeds set with their descriptions and MITRE ATT&CK tags in an open explorer (s34), so part of the detection content it curates is readable by anyone evaluating a substitute.
• Adoption evidence for Sysdig Secure AI is two customer testimonials inside Sysdig’s own launch release (s30) and the trade coverage of that launch (s31), so no source in the reviewed record outside the company shows buyers running the agent product.

Sysdig sells to the security and platform teams that run cloud and container infrastructure. Its framing of the problem is speed: attacks against cloud workloads move quickly, and a team working from static configuration scans cannot tell which findings are exploitable in what is actually running (s3). The answer Sysdig offers is runtime evidence, using its sensor’s view of live workloads to rank risk and catch active threats (s3, s18).

The company pushed that framing further in 2026. Its headless product argues that the response window has collapsed to minutes and that security should be delivered as programmable capabilities an AI agent can call rather than as a dashboard a person reads (s5).

The demand evidence is review volume rather than independent quantification. Sysdig announced in January 2025 that Gartner Peer Insights had recognized it as a Customers’ Choice in the CNAPP category, on more than 100 customer reviews over the 18 months measured as of October 2024 (s8), and Sysdig publishes a Forrester Wave Leader placement dated Q1 2026 on its own pages (s1). The vendor frames the pain, and analysts and buyers already recognize the category. [s3, s18, s8, s1, s5]

Sysdig Secure builds its CNAPP capabilities around a runtime core. The platform combines risk prioritization, posture management, real-time threat detection, AI-guided remediation and attack path analysis (s3), and its documentation sets out threat detection, vulnerability management, posture management and entitlement management as the product areas (s18). Detection combines drift control, machine learning and Falco rules that Sysdig’s Threat Research Team curates (s3).

The detection core is independently governed open source. The Cloud Native Computing Foundation graduated Falco in 2024, describes it as the de facto Kubernetes threat detection engine, names maintainers from Amazon, Apple, IBM and Red Hat, and records more than 30 public adopters (s12). The project site states more than 100 million downloads and describes the two ways Falco instruments system calls, a modern eBPF probe or a kernel module (s13).

Sysdig rebuilt the product’s interface around AI agents across 2026. A headless interface exposes runtime, posture and vulnerability data to agents through APIs, MCP services and curated agent skills, so automation can investigate and remediate without the dashboard (s5). In August 2026 the company made Sysdig Secure AI generally available, adding agents that run inside its own interface alongside the headless mode and a plain-language assistant (s25, s28, s30). [s3, s18, s5, s25, s28, s30, s12, s13]

Sysdig positions runtime evidence as its difference in a crowded CNAPP field. Its pitch is that static configuration scanning flags theoretical risk while Sysdig Secure identifies what is exploitable in the environment right now (s3). The company points to a Gartner Peer Insights Customers’ Choice recognition and a Forrester Wave Leader placement as outside reference points for that positioning (s8, s1).

Sysdig and its rivals both benefit from Falco’s open license. Sysdig created the engine and open sourced it in 2016 (s12), and the cited record establishes open-source adoption and governance rather than a sales funnel, so open-source reach is not evidence of paid adoption (s12, s13). Under Falco’s Apache 2.0 license, competitors and cloud providers can use the code without a commercial relationship (s20).

What Sysdig sells around the engine is the platform and the detection content. Falco Feeds packages enterprise rules the Threat Research Team curates and distributes through falcoctl, with coverage the company maps to MITRE ATT&CK for Linux workloads and hosts (s26). Sysdig also publishes the top rules of that set with their descriptions and MITRE tags in an open explorer (s34), so a buyer comparing substitutes can read the content rather than only the claim. [s3, s1, s8, s12, s13, s20, s26, s34]

Named deployments carry the traction record. Sysdig publishes customer stories for India’s Unique Identification Authority, which runs the Aadhaar identity system and selected Sysdig after an open tender (s21), the core banking platform Mambu (s22), the payment processor Worldpay (s23), Zerobank Design Factory, which operates Minna Bank’s systems (s24), the graph database vendor Neo4j (s32) and the e-commerce platform BigCommerce (s33). Each of those pages names Sysdig Secure as the deployed product, and the company’s customer index carries further stories including BitMEX and Square Enix (s29).

Recognition comes from a buyer-review platform. Sysdig announced in January 2025 that Gartner Peer Insights had recognized it as a Customers’ Choice for CNAPP, on more than 100 reviews averaging 4.9 out of 5 as of October 2024 (s8).

Scale figures remain the company’s own. Independent press reported the $350 million round and $2.5 billion valuation of December 2021 (s10), while SDxCentral attributed the customer count of nearly 700 and the top-50 average recurring revenue above $875,000 to the vendor (s11). The June 2026 CEO announcement states 110 percent net revenue retention and the August 2026 launch states Falco downloads over 200 million and use by 60 percent of the Fortune 500, all company statements (s7, s30). An employee-reported tracker lists roughly 100 people cut in April 2024 and 50 in January 2025, with 575 days since the last entry (s16), so the reviewed record shows two rounds of cuts and none reported since. [s21, s22, s23, s24, s32, s33, s29, s8, s11, s10, s7, s30, s16]

The founder supplies the team’s open-source track record. Loris Degioanni, founder and chief technology officer, co-created Wireshark, the network analyzer the company says has more than 20 million users, created the sysdig troubleshooting tool and created Falco, and he holds a PhD in computer engineering (s2). The foundation graduation of Falco in 2024 is an outside judgment of that engineering lineage (s12).

Sysdig has changed chief executives twice in under two years. William Welch was the newly appointed chief executive as of the January 2025 recognition announcement (s8), and in June 2026 Sysdig announced the appointment of Hatem Naguib, formerly chief executive of Barracuda Networks, where Sysdig states he led the move to a platform-based, recurring-revenue business and doubled revenue to nearly $675 million (s7).

The bench around them is documented. Sysdig names a chief financial officer, a global chief information security officer, and senior vice presidents for product, engineering and sales, with prior roles at Tenable, Proofpoint, Symantec, PagerDuty and Uber among them (s2). The company’s own threat research group is named in its August 2026 launch as the source of the frontline research behind the product (s30). [s2, s7, s8, s12, s30]

The public attestation record is audited and discoverable, and it is narrow. Sysdig announced SOC 2 Type II compliance for its platform in December 2020 after an audit by Coalfire (s9). A Trust Center page, named on the homepage, describes that report as an annual examination and lists controls including penetration testing every quarter (s17). No trust portal answers at a trust or security subdomain of sysdig.com, and the Trust Center page describes the program without publishing the report, so current audit evidence is not available from the public surface.

Sysdig publishes the platform’s documentation and its detection code. The Sysdig Secure documentation portal covers the product’s security areas (s18), and the Falco detection core is open source under foundation governance (s13), so a buyer can read the code doing the detecting. [s9, s17, s18, s13]

Add analyzed competitors to compare them side by side with Sysdig.

Sysdig targets enterprise teams that secure cloud and container infrastructure. The platform pages address security teams that need real-time detection and platform teams that manage Kubernetes and cloud configuration (s3), and the customer record reaches regulated segments: a government identity authority (s21) and a payment processor working to PCI requirements (s23).

The company disclosed in 2021 that average annual recurring revenue tops $875,000 across its 50 largest customers, a vendor-stated figure covering Sysdig’s business rather than the Sysdig Secure line alone (s11).

Sysdig added a second audience inside the same buyer with its May 2026 headless launch (s14). The headless interface targets teams that want AI coding agents and automation, rather than analysts at dashboards, to consume security findings (s5). The more than 100 Gartner Peer Insights reviews behind the 2025 recognition came from customers of the existing platform (s8), so the reviewed sources evidence demand from those buyers rather than from the newer audience.

The platform’s organizing idea is runtime evidence. Sysdig Secure combines risk prioritization, posture management, real-time threat detection, AI-guided remediation and attack path analysis, using the sensor’s view of running workloads to rank what is actually exploitable (s3), and its documentation sets out those areas as the product’s structure (s18). The Falco engine underneath has independent standing, because the Cloud Native Computing Foundation graduated it in 2024 with maintainers from Amazon, Apple, IBM and Red Hat (s12) and the project site records more than 100 million downloads (s13).

Sysdig applies AI in two directions. The headless interface serves agents outside the product, exposing runtime, posture and vulnerability data through APIs, MCP services and curated agent skills so automation can operate the platform without its interface (s5). Sysdig Secure AI, generally available in August 2026, puts agents inside the product as well, each tuned to one security workflow and sharing the same runtime data (s25, s28, s30).

The content those agents run on is curated rather than only collected. Sysdig’s Threat Research Team curates the Falco rules the platform detects with (s3) and packages an enterprise set as Falco Feeds (s26). Sysdig also publishes the top rules of that set with their descriptions and MITRE ATT&CK tags in an open explorer (s34), and the cited record does not establish that the managed set retains content held back from those public surfaces.

Sysdig runs an enterprise sales motion and reaches practitioners through open source. The pricing page publishes licensing metrics and a request-a-quote path rather than prices (s19), and the customer record shows deals reached through formal procurement: India’s identity authority selected Sysdig after an open tender (s21).

Named customers document paid adoption. Published stories cover Mambu in core banking (s22), Worldpay in payments (s23), Zerobank Design Factory operating Minna Bank’s systems (s24), and further customers including BitMEX and Square Enix on the customer index (s29). Sysdig announced a Customers’ Choice recognition in a Gartner Peer Insights report, on more than 100 reviews (s8).

Growth figures come from the company. Independent press reported the December 2021 financing (s10), SDxCentral attributed the customer and contract figures at that round to the vendor (s11), and the 110 percent retention figure of June 2026 is a company statement (s7). The August 2026 launch states Falco downloads over 200 million and use by 60 percent of the Fortune 500, also on the company’s own account (s30).

The reviewed sources carry no published price for the security platform. Sysdig’s pricing page states that prices are tailored to the buyer and directs buyers to request a quote (s19).

What the page does publish is the licensing basis. Sysdig licenses the security platform on the number of hosts in a customer’s environment, using compute instances for posture management and events processed for cloud log detections (s19), so a buyer can model cost against its own estate before talking to sales.

Sysdig sells its monitoring product from the same surface. Sysdig Monitor, the Kubernetes monitoring product with a managed Prometheus service, is licensed from that same page (s19, s4), so a buyer evaluating monitoring meets the security line there too.

Sysdig delivers software the customer operates and owns the outcomes of. Security teams consume prioritized findings, detections and guided remediation through the platform (s3), with public documentation for operating it (s18). Sysdig Secure AI keeps that boundary explicitly: routine analysis and investigation run on their own while high-impact actions go to the customer’s team for approval, and the company describes the customer’s people as setting the goals and approving what matters (s25).

Some deployments carry more vendor involvement than that. Sysdig Professional Services handled the Unique Identification Authority of India deployment end to end, working alongside that authority’s engineers, with a dedicated resident engineer on site to support integrations and build internal maturity (s21).

Customers can automate more of the operating work through the headless interface. AI agents can investigate and remediate through APIs and MCP services, starting human-in-the-loop and expanding as confidence grows, in the vendor’s own description (s5). The customer’s team still operates the platform and owns the outcomes of acting on its findings.

The public attestation record is audited, discoverable and narrow. Sysdig announced SOC 2 Type II compliance in December 2020 after a Coalfire audit (s9), and a Trust Center page, named on the homepage, describes that report as an annual examination and lists controls including penetration testing every quarter (s17). No trust portal answers at a trust or security subdomain of sysdig.com, and the page describes the program without publishing the report, so current audit evidence is not available from the public surface. The reviewed sources name no government authorization.

Buyers can inspect the open detection engine itself. Falco is open source under foundation governance (s13), so its code and the rules published with it are open to review. A buyer reading them still cannot see the internal controls the SOC 2 Type II report covers (s17).

Sysdig built its ecosystem standing inside the Cloud Native Computing Foundation. Falco graduated in 2024 with maintainers from Amazon, Apple, IBM and Red Hat (s12), and the project records more than 100 million downloads (s13). The foundation now governs the engine Sysdig created, so platform engineers can adopt it without depending on one vendor. Sysdig named partnerships with Amazon Web Services, Google Cloud Platform, Microsoft Azure, IBM Cloud, Red Hat and SUSE Rancher at its 2021 round (s6).

Sysdig opens the platform to ecosystems it does not control. It exposes runtime data through APIs, MCP services and agent skills so outside AI agents and automation can operate the platform (s5). The Falco repository is licensed Apache 2.0 (s20), so competitors and cloud providers can use the code without paying Sysdig. The company states that open standards such as Falco and Prometheus help users avoid lock-in (s4).

What Sysdig sells into that ecosystem is content rather than code. Falco Feeds offers the Threat Research Team’s managed rules to organizations that keep their own open-source Falco setup (s26).

The founder supplies the technical lineage. Loris Degioanni, founder and chief technology officer, co-created Wireshark, created the sysdig tool and Falco, and holds a PhD in computer engineering (s2). Both earlier projects have documented wide adoption, Wireshark with more than 20 million users by the company’s account (s2) and Falco as a foundation-graduated project (s12).

Sysdig has changed chief executives twice while the founder stayed. William Welch was the newly appointed chief executive as of January 2025 (s8), and Hatem Naguib, formerly of Barracuda, replaced him in June 2026 (s7). Sysdig also names a chief financial officer with pre-IPO and public-company experience and a global chief information security officer who came from Apollo Global Management and CLEAR (s2).

The record documents workforce cuts separately from those changes. An employee-reported tracker lists layoffs of roughly 100 people in April 2024 and 50 in January 2025, with 575 days since the last entry, entries the reviewed record does not show the company confirming (s16). The record documents the leadership changes and the reported cuts separately and establishes no connection between them. Sysdig’s own threat research group is named in its August 2026 launch as the source of the frontline research behind the product (s30).