Falco

Falco belongs in the database because runtime security is too important to leave implied when the catalog covers build-time and policy tooling so heavily. The official project and Sysdig surfaces position Falco as an open-source runtime threat detection engine for cloud-native environments, focused on suspicious behavior, compliance violations, anomalous activity, and real-time detection across containers, Kubernetes, and Linux systems. That makes Falco a different kind of security tool than Snyk or Trivy. It is not mainly about scanning artifacts before they ship. It is about observing what workloads actually do while they run.

That distinction is exactly why Falco is a valuable addition. Many real stacks combine static or build-time scanning with runtime visibility, and Falco is still one of the most recognized OSS names in that runtime layer. Pricing is also straightforward to frame honestly: the upstream project is free and open source, while paid value usually appears through supporting products, managed security platforms, or premium rule content in the broader ecosystem.