Skip to content
Find Cloud Security

Kubernetes security: where Falco, Trivy and the commercial platforms fit

By The Cloud Map Desk. Published , updated .

Desk research from public vendor pages. Vendor facts read September 2026, updated 2026-11-03. Profiles follow our published method; we did not run the products.

Coverage, Agents, 3 min read.

What do the two projects do?

Falco watches system activity on hosts, containers and Kubernetes and raises alerts when rules match. It was created by Sysdig and is a CNCF graduated project. Version 0.45.0, released on 21 September 2026, added raw byte matching in rule conditions, reload status endpoints, driver 11.0.0 and new rules that flag containers accessing GPU devices.

Trivy scans container images, file systems, code repositories and infrastructure-as-code for vulnerabilities and misconfigurations. It is maintained by Aqua Security under the Apache-2.0 license.

Together they cover two of the jobs on the workload protection and vulnerability management pages: build-time scanning and runtime detection.

Where do they stop?

Neither reads cloud account configuration, computes identity permissions or classifies data. Neither gives you a managed console, routing to owners or a joined view of risk. Running them well also takes engineering time: rules to tune, alerts to route, versions to upgrade.

How do the commercial platforms describe Kubernetes runtime?

From pages read in September 2026 and updated on 11 October 2026:

  • Sysdig Secure: runtime detection for containers and Kubernetes built on Falco.
  • Aqua: kernel-layer enforcement that blocks attacks without killing the container.
  • Wiz: the eBPF-based Wiz Sensor, with Kubernetes file integrity monitoring and drift detection in Wiz Defend.
  • Orca: the eBPF-based Orca Sensor runs on Kubernetes; container and Kubernetes security is a listed module.
  • Upwind: container and Kubernetes security with eBPF sensors.
  • CrowdStrike and SentinelOne: workload protection that covers running containers.
  • Cortex Cloud: a runtime agent and CDR; Kubernetes-specific controls are not detailed on the pages we read.
  • Defender for Cloud: agentless Kubernetes discovery in the paid Defender CSPM plan.

The finder's Kubernetes runtime check scores the last two as partial matches and the others as matches.

Which path suits which team?

  • A team with strong Kubernetes skills and little else to cover can go far with Falco and Trivy and add posture later.
  • A team that already runs Falco or Trivy and wants a managed platform has an obvious first look at Sysdig or Aqua. The finder adds existing-product points for exactly this answer.
  • A team with many clouds and accounts, where Kubernetes is one part, may value posture and identity coverage over runtime depth, and look at platforms with an agentless core and an optional sensor.

Questions to put to any vendor

How is the sensor deployed per node, what does it cost in CPU and memory, does it block or only alert, which Kubernetes distributions are supported, and can it import your existing Falco rules?

Sources