Sysdig

Overview

Sysdig is a runtime-first cloud-native application protection platform (CNAPP). Its security product, Sysdig Secure, combines posture management, vulnerability management, container and Kubernetes threat detection, and cloud infrastructure entitlement management (CIEM). Founded in 2013 in San Francisco and privately held, Sysdig created Falco, the open-source runtime detection engine that graduated in the CNCF in February 2024. That lineage explains the product's center of gravity: what is happening in running workloads, not just how they are configured.

What it is good at

Sysdig's CIEM is built on observed usage. It analyzes the actions each user and role actually performs, tracks unused permissions, inactive users, and high-risk policies, shows last-active dates per identity, and generates a suggested least-privilege version of the existing policy. Recommendations grounded in real activity are less likely to break a deployment pipeline than ones derived from policy text alone, which makes engineering teams more willing to apply them.

Cloud Identity Insights goes a step further, using runtime context to flag an identity that shows early indicators of privilege escalation or account compromise, and to recommend restricting it to the permissions it used before the incident. For Kubernetes-heavy teams, entitlement risk sits beside container image vulnerabilities and live Falco detections in one place, so an over-privileged role attached to a workload under active attack is obvious. Sysdig also covers on-premises and private-cloud Kubernetes, which most agentless CNAPPs do not.

Where it falls short

The workload half of the runtime advantage requires agents. Correlating entitlements with live container activity depends on deploying the Sysdig agent across clusters and hosts, which is more rollout work than an agentless read-only connector and needs platform-team buy-in. CIEM itself is a module, not a governance product: there is no access-request, certification, or broad just-in-time access workflow comparable to Britive or Sonrai Security, so remediation means editing policies or opening tickets. Estates with few containers get less from Sysdig's main differentiator. Our confidence is medium because Sysdig's public pages do not list exactly which cloud providers and identity sources the CIEM module covers; confirm that in a proof of concept.

Pricing

Quote-based. The public pricing page covers Sysdig Monitor, not the security product, so CIEM pricing requires a sales conversation. Compare how vendors in this category disclose prices in the pricing transparency index.

Best for, and who should look elsewhere

Sysdig fits platform and security teams running Kubernetes at scale who want entitlement cleanup driven by what identities actually do. Expect a real rollout: the runtime-based prioritization pays off only once agents are on every cluster that matters. Look elsewhere if you want agentless onboarding in an afternoon (Orca Security, Wiz), deep multi-cloud entitlement governance (Tenable One Cloud Exposure, formerly Tenable Cloud Security), or mostly run VMs and serverless. See the best CIEM for enterprises ranking and the CIEM primer.

Bottom line

The strongest choice when containers are your estate and you want permissions trimmed to observed behavior; a weaker one if you need standalone entitlement governance or cannot deploy agents.