Runtime & Kubernetes Protection

Now pick what to compare Tetragon against.

Tetragon clear

Open a name for its full profile

Red Hat Advanced Cluster Security for Kubernetes
Capabilities only
Red Hat · Commercial · 4 capabilities in this domain
Compare →
Aqua Platform
Capabilities only
Aqua Security · Commercial · 3 capabilities in this domain
Compare →
KubeArmor
Capabilities only
AccuKnox · Open Source · 3 capabilities in this domain
Compare →
Kubescape
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 3 capabilities in this domain
Compare →
SUSE Security
Capabilities only
SUSE · Freemium · 3 capabilities in this domain
Compare →
Sysdig Secure
Capabilities only
Sysdig · Commercial · 3 capabilities in this domain
Compare →
Tetragon
Capabilities only
Isovalent · Open Source · 3 capabilities in this domain
selected
AWS WAF
Capabilities only
Amazon Web Services · Commercial · 2 capabilities in this domain
Compare →
Cilium
Capabilities only
Isovalent · Open Source · 2 capabilities in this domain
Compare →
Cloudflare WAF
Capabilities only
Cloudflare · Freemium · 2 capabilities in this domain
Compare →
Contrast Protect
Capabilities only
Contrast Security · Commercial · 2 capabilities in this domain
Compare →
Fastly Next-Gen WAF
Capabilities only
Fastly · Commercial · 2 capabilities in this domain
Compare →
Istio
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 2 capabilities in this domain
Compare →
Kyverno
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 2 capabilities in this domain
Compare →
OWASP Coraza
Capabilities only
OWASP Foundation · Open Source · 2 capabilities in this domain
Compare →
Datadog App and API Protection
Capabilities only
Datadog · Commercial · 1 capabilities in this domain
Compare →
Falco
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 1 capabilities in this domain
Compare →
Kata Containers
Capabilities only
OpenInfra Foundation · Open Source · 1 capabilities in this domain
Compare →
Kubewarden
Capabilities only
SUSE · Open Source · 1 capabilities in this domain
Compare →
Linkerd
Capabilities only
Buoyant · Open Source · 1 capabilities in this domain
Compare →

In Runtime & Kubernetes Protection

Sysdig Secure

Sysdig · Runtime & Kubernetes Protection

Close ×

CommercialCompany

Sysdig Secure combines Falco-based detection and response, image scanning, KSPM and CSPM, and uses runtime insight to show which vulnerable packages are loaded.

What it does7 capabilities · 6 at full coverage

6 of 7 at full coverage.

Cloud Infrastructure Entitlement ManagementPartialCLOUD · level 3 · 6 providers
Cloud Security Posture ManagementFullCLOUD · level 2 · 15 providers
Container Image Vulnerability ScanningFullCONTAINER · level 2 · 20 providers
Container Drift PreventionFullK8S · level 4 · 6 providers
Kubernetes Security Posture ManagementFullK8S · level 3 · 9 providers
Runtime Threat DetectionFullK8S · level 3 · 14 providers
Runtime Component InventoryFullSBOM · level 4 · 3 providers

What it proves29 controls across 11 frameworks

Satisfied through its capabilities, not claimed by the vendor.

CSF 2.07 / 106DE.AE-02 DE.CM-09 ID.AM-02 ID.RA-01 PR.AA-05 PR.PS-01 PR.PS-05
CNAS Top 106 / 10CNAS-1 CNAS-10 CNAS-3 CNAS-7 CNAS-8 CNAS-9
CIS Controls4 / 18CIS 13 CIS 4 CIS 6 CIS 7
CIS Benchmarks3 / 6CIS AWS Foundations Benchmark CIS Kubernetes Benchmark CIS Microsoft Azure Foundations Benchmark
DSOMM3 / 19IG-Monitoring TV-Dynamic-Depth-Infrastructure TV-Static-Depth-Infrastructure
AICM1 / 18IAM
ASVS 5.01 / 17V13
CRA1 / 41Annex I Part I (2)(a)
OWASP Top 101 / 10A02:2025
SAMM 2.01 / 90O-EM-1-B
SSDF 1.11 / 42RV.1.1

What it stops13 techniques · 3 risks

13 techniques countered, 13 of them common

Cloud Misconfiguration ExploitationVery Common
Command and Scripting InterpreterT1059Very Common
Exploitation of Known Vulnerable ComponentVery Common
Ingress Tool TransferT1105Very Common
Valid Accounts: Cloud AccountsT1078.004Very Common
Account ManipulationT1098Common
Container Administration CommandT1609Common
Container and Resource DiscoveryT1613Common
Data from Cloud StorageT1530Common
Escape to HostT1611Common
Exposed Kubernetes Control InterfaceCommon
Resource HijackingT1496Common
Unsecured Credentials: Container APIT1552.007Common

3 risks reduced

Container or Kubernetes workload compromise goes undetectedHigh
Exploitable vulnerabilities in container base imagesHigh
Exposed and over-privileged cloud resources go unnoticedHigh

Where it runs4 phases · 2 ways to deploy

Capabilities per lifecycle phase

Build1
Release1
Operate7
Monitor1

How it is delivered

Host agent or sensorSaaS

What it unlocks9 activities · reaches level 5

Program activities its capabilities support, reaching level 5. Supporting an activity is not completing it.

Level 1

Assess cloud accounts against benchmarksLow effort
Benchmark cluster configurationLow effort
Scan container imagesLow effort

Level 3

Right-size entitlements and prioritize attack pathsMedium effort
Runtime detection and network segmentationMedium effort

Level 4

Signed workloads onlyMedium effort

Level 5

Automated containment and zero-trust workloadsHigh effort
End-to-end supply chain graph including AI componentsHigh effort
Preventive cloud guardrails make misconfiguration impossibleHigh effort

How it holds up

Not assessed yet: no strengths, limits or evaluation scores. 47 of 340 products carry an assessment and 29 are scored.

What it costsPer workload

LicensingPer workload

Priced pernode

BillingSubscription

Scales withHosts, Kubernetes nodes or vCPUs protected

Total cost

Autoscaling and cluster growth increase cost; negotiate on average rather than peak.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with

No supported language, standard, integration or named feature recorded.

What else to look at

No alternative, competitor or family sibling is modeled for it.

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13