Falco

Falco is ranked #10 of 24 in container security software on The Geeks Club. It runs on Linux, Self-hosted. There is a free plan.

Falco plans and pricing

All plans

Falco Free Zero cost to start · open source falco.org · 4 Oct 2026

Compared on container security software

Free plan: Yes

Best Falco alternatives

See all 12

7.8 Qualys External Attack Surface Management Free trial

7.5 Snyk Open Source Free plan

7.4 Docker Desktop Free plan

7.3 Kubescape Free plan

7.2 Deepfence ThreatMapper Free plan

7.2 RapidFort Free plan

Falco

Purpose: Falco provides runtime security across hosts, containers, Kubernetes, and cloud environments, detecting abnormal behavior, potential threats, and compliance violations in real time.
Detection rules: Falco compares events against built-in rules and lets users create custom rules for their environment.
Event sources: Falco can ingest Linux kernel syscalls, Kubernetes audit logs, cloud events such as AWS CloudTrail, and events from systems such as GitHub and Okta.
Threat response: Falcosidekick can forward Falco events to more than 50 systems, including email, chat, message queues, serverless functions, and databases.
Integrations: Falco's plugins include sources for GitHub webhooks, Kubernetes audit events, AWS EKS audit events, CloudTrail logs, Docker events, Okta audit logs, and Nomad events.
Deployment: The project provides installation options for Linux hosts, Docker containers, and Kubernetes, including official Helm charts.
Architectures: Falco supports x86_64 and ARM64 architectures, with Linux packages listed for x86_64 and aarch64.
Security mechanism: For kernel event monitoring, Falco uses a modern eBPF driver by default and offers a kernel module for wider compatibility.
Notable detection limit: Falco does not automatically cover every possible threat; detection depends on having appropriate rules in place.
Performance considerations: Falco's resource use varies with server load and workload, and the project recommends testing performance in the target environment.
Support: Community support is available through Kubernetes Slack and the project's mailing list; the project also lists partner-provided enterprise offerings.
Project status: Falco is an open source project hosted by the CNCF and is described on its site as a CNCF graduated project.
Commercial offering: The project site links to partner commercial offerings for enterprise support and detection rules, but does not list their prices.
Founded: 2016
Price from: Free

Visit site Alternatives

Where it ranks on The Geeks Club

Best Container Security Software in 2026#10 of 24
Best Kubernetes Security Software in 2026#5 of 24
Best Cloud Workload Protection Platforms in 2026#6 of 21

Is Falco yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Falco

Sources

falco.org· checked 4 Oct 2026
falco.org/about/· checked 4 Oct 2026
falco.org/about/ecosystem/· checked 4 Oct 2026
falco.org/docs/getting-started/· checked 4 Oct 2026
falco.org/docs/setup/download/· checked 4 Oct 2026
falco.org/community/· checked 4 Oct 2026
falco.org/enterprise/· checked 4 Oct 2026