License & Deployment Mix: 10 tools – 7 OSS, 3 commercial.
Color: Blue team.
What Is This Category?
Container runtime security is the layer that watches running containers / pods for malicious behaviour: unexpected exec into a container, kubectl-proxy abuse, container escape, cryptominer process trees, credential theft. Distinct from image scanning (“does this image contain a known-vuln library?”) and from CSPM (“does this cluster config follow CIS?”), runtime security operates on live syscalls inside the running container.
The category also covers admission control – the deploy-time gatekeeper that validates / mutates Kubernetes resources before they apply. Most production deployments stack at least one runtime detector with at least one admission controller.
Distinct from neighbouring categories
- Cloud Security Posture (CSPM / CNAPP) – CNAPP scans the cloud / cluster configuration; container runtime watches the running workloads
- EDR / XDR – EDR is per- host endpoint telemetry; container runtime is per-pod / per-container syscall-grade telemetry
- IDS / IPS – IDS is on- the-wire; container runtime is on-the-host / on- the-pod
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
Overview
Container runtime security splits into three sub- layers in practice: runtime detection (Falco / Tetragon / Tracee tap syscalls and emit alerts), runtime enforcement (Tetragon / KubeArmor block in-kernel), and admission control (Kyverno / OPA- Gatekeeper validate / mutate at deploy time). Most production deployments stack at least one tool from each sub-layer. StackRox / Red Hat ACS is the OSS platform that bundles several sub-layers; the commercial CNAPPs (Sysdig Secure, Aqua, Prisma Cloud Compute) take the same engines (or similar) and ship managed delivery.
Capability Matrix
| Tool | Runtime Detect | Enforce | Admission | Image Scan | Network Policy |
|---|---|---|---|---|---|
| Falco | yes (first-class) | observation only | – | – | – |
| Tetragon | yes | yes (eBPF) | – | – | partial (Cilium) |
| Tracee | yes | observation only | – | – | – |
| Kyverno | – | – | yes (first-class) | image-verify | yes (NetworkPolicy generation) |
| OPA / Gatekeeper | – | – | yes (first-class) | partial | partial |
| KubeArmor | yes | yes (LSM) | – | – | – |
| Sysdig Secure | yes (Falco) | yes | yes | yes | yes |
| Aqua Cloud Security | yes (Tracee) | yes | yes | yes (Trivy) | yes |
| Prisma Cloud Compute | yes (deepest) | yes (in-line) | yes | yes | yes |
| StackRox / Red Hat ACS | yes | yes | yes | yes | yes (first-class) |
License Comparison
| Tool | License | OSI | Type |
|---|---|---|---|
| Falco | Apache-2.0 | yes | OSS engine |
| Tetragon | Apache-2.0 | yes | OSS engine |
| Tracee | Apache-2.0 | yes | OSS engine |
| Kyverno | Apache-2.0 | yes | OSS admission controller |
| OPA / Gatekeeper | Apache-2.0 | yes | OSS policy engine |
| KubeArmor | Apache-2.0 | yes | OSS enforcement engine |
| Sysdig Secure | Proprietary | – | Commercial CNAPP |
| Aqua Cloud Security | Proprietary | – | Commercial CNAPP |
| Prisma Cloud Compute | Proprietary | – | Commercial CWPP (Palo Alto) |
| StackRox / Red Hat ACS | Apache-2.0 (OSS) | yes | OSS platform; ACS is the supported commercial tier |
Mechanism Comparison
How each tool actually sees / acts on events.
| Tool | Mechanism | Observe | Enforce |
|---|---|---|---|
| Falco | eBPF or kernel-module | yes | – |
| Tetragon | eBPF (Cilium) | yes | yes (eBPF override) |
| Tracee | eBPF | yes | – |
| Kyverno | K8s admission webhook | yes (audit mode) | yes (block) |
| OPA / Gatekeeper | K8s admission webhook | yes (audit mode) | yes (block) |
| KubeArmor | LSM (AppArmor / BPF-LSM / SELinux) | yes | yes |
| Sysdig Secure | Falco engine + extensions | yes | yes |
| Aqua | Tracee + Aqua agent | yes | yes |
| Prisma Cloud Compute | Twistlock Defender (proprietary) | yes | yes (deepest) |
| StackRox / ACS | collector + admission | yes | yes |
SSO / OIDC
| Tool | OIDC | SAML | SCIM | Notes |
|---|---|---|---|---|
| Falco | n/a | n/a | n/a | Headless agent |
| Tetragon | n/a | n/a | n/a | Headless agent |
| Tracee | n/a | n/a | n/a | Headless agent |
| Kyverno | n/a | n/a | n/a | Admission controller |
| OPA / Gatekeeper | n/a | n/a | n/a | Admission controller |
| KubeArmor | n/a | n/a | n/a | Headless enforcer |
| Sysdig Secure | paid | paid | paid | Enterprise tier |
| Aqua Cloud Security | paid | paid | paid | Enterprise tier |
| Prisma Cloud Compute | paid | paid | paid | Enterprise tier |
| StackRox / Red Hat ACS | native | native | – | Native OIDC + SAML in OSS |
Composition Patterns
1. OSS-only stack (zero license cost)
Falco -- runtime detection (rich rule library) Tetragon -- in-kernel enforcement (eBPF) Kyverno -- admission control (YAML policies) Trivy (see cnapp/) -- image scanning at build + cluster scan
Output: full Kubernetes-security coverage on customer clusters without commercial license. Standard managed pattern.
2. Red Hat / OpenShift stack
StackRox / Red Hat ACS -- bundled platform (detection + admission + image + network)
Output: one platform for OpenShift customers. Single-vendor managed support.
3. Commercial CNAPP
Sysdig Secure (or Aqua, or Prisma Cloud Compute) -- managed bundle
Output: trade operational work for license cost. Same underlying engines (Falco / Tracee) as the OSS path in many cases.
Cost Tier
Approximate annual TCO for a 50-node Kubernetes fleet.
| Tier | Tooling | Approx Cost |
|---|---|---|
| Free | Falco + Tetragon + Kyverno + Trivy | $0 + operator time |
| Mid | StackRox / Red Hat ACS | $30,000-100,000 / year (RHEL/OpenShift subscription tier) |
| High | Sysdig Secure / Aqua / Prisma Cloud Compute | $50,000-300,000 / year |
Tools
10 tools.
Aqua Cloud Security
Aqua Cloud Security is a commercial cloud-native application protection platform (CNAPP) from Aqua Security, delivering image scanning, eBPF runtime protection, and CSPM/CWPP/KSPM built on the Trivy and Tracee engines.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, native · SSO: OIDC, SAML
Falco
CNCF-graduated open-source container runtime threat-detection engine; eBPF / kernel-module syscall taps + policy engine.
License: Apache-2.0 (OSS) · Kind: service · Deploy: k8s, native, docker, package · SSO: none
KubeArmor
CNCF-incubating runtime-security enforcement engine; uses LSM (AppArmor / BPF-LSM / SELinux) for in-kernel enforcement.
License: Apache-2.0 (OSS) · Kind: service · Deploy: k8s, native · SSO: none
Kyverno
CNCF-graduated Kubernetes-native policy engine; YAML-based admission control without a separate policy DSL.
License: Apache-2.0 (OSS) · Kind: service · Deploy: k8s, docker · SSO: none
OPA / Gatekeeper
CNCF-graduated general-purpose policy engine (OPA) plus Kubernetes admission controller (Gatekeeper); Rego policy language.
License: Apache-2.0 (OSS) · Kind: service · Deploy: k8s, docker, native · SSO: none
Prisma Cloud Compute
The Twistlock-derived container runtime tier of Palo Alto’s Prisma Cloud; CWPP leader; depth-of-runtime differentiator.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, native · SSO: OIDC, SAML
StackRox / Red Hat ACS
Red Hat-owned Kubernetes security platform; open-sourced 2022; ships as Red Hat Advanced Cluster Security (ACS) for OpenShift.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s, native · SSO: OIDC, SAML
Sysdig Secure
Commercial CNAPP from the Falco creators; Falco runtime + CSPM / vulnerability + managed SaaS console.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, native · SSO: OIDC, SAML
Tetragon
CNCF eBPF-based security observability from Isovalent / Cilium project; kernel-level enforcement + observability.
License: Apache-2.0 (OSS) · Kind: service · Deploy: k8s, native, docker, package · SSO: none
Tracee
Aqua Security’s eBPF runtime-security engine; signature-based threat detection from kernel-level syscall observation.
License: Apache-2.0 (OSS) · Kind: service · Deploy: k8s, native, docker · SSO: none
