Falco

ELI5 — The Vibe Check

Falco is a runtime security tool that watches system calls in your Kubernetes cluster. It knows what 'normal' looks like and screams when something weird happens — a shell spawning in a container, a binary being downloaded at runtime, privilege escalation. It's your cluster's immune system.

Real Talk

Falco is a CNCF graduated runtime security tool that monitors system calls via eBPF or kernel modules to detect anomalous behavior in containers and hosts. It uses rules to identify threats like container escapes, cryptomining, unexpected process execution, and sensitive file access.

When You'll Hear This

"Falco alerted when someone exec'd a shell into a production container." / "Our Falco rules detect any binary download inside running containers — that's never legitimate."