Sysdig

Founded in 2013 by Loris Degioanni, who had earlier co-created WinPcap and Wireshark. Its first product was the sysdig tool, which captures system calls in the kernel and lets you filter them much like network packets. Once containers took off, that turned out to be an excellent way to see what was actually going on inside a pod.

Falco followed in 2016: a rules engine that alerts when a container does something suspicious, like spawning a shell or reading /etc/shadow. Falco was donated to the CNCF and graduated in 2024. The company itself sells a commercial container security platform, and its data collection has moved from a kernel module to eBPF.