Sysdig Report Finds Cloud Security Shifting Toward Automated, Machine-Scale Defense

Summary

Sysdig’s 2026 report analyzes anonymized customer telemetry and Falco usage data from 2025, highlighting cloud-native security trends: AI package growth, persistent vulnerable workloads, increased behavior-based detection and automated response, and identity risks.

Key points

The report draws on anonymized, aggregated customer data covering runtime activity, vulnerability scans, identity configurations, and Falco community usage from January through December 2025.
Sysdig reports that AI-specific packages grew 25-fold year over year; 1.5% of the AI and ML assets it analyzed were publicly exposed.
About 5.5% of vulnerable images were present in running workloads, while the report says running images with known-exploited vulnerabilities fell 74% to nearly zero.
More than 70% of organizations used behavior-based detections across 91% of their cloud environments.
Organizations using automated process termination after detections increased 140%; use of the policy spanned 132% more policies than the prior year.
By the report’s criteria, an average of 67% of human user identities were considered risky; machine identities greatly outnumbered human identities.
Sysdig says more than 9,000 organizations use Falco, an open-source runtime security tool.

Article Details

Publisher: Sysdig
Report Period: 2025-01 to 2025-12
Scope: Anonymized, aggregated cloud customer data covering runtime activity, vulnerability scanning, identity configurations, Sysdig Threat Research Team intelligence, and Falco community usage.
Sample Size: Hundreds of thousands of cloud accounts, billions of Kubernetes containers, and nearly 13 billion packages analyzed for image bloat.
Key Statistics: Human error, including misconfigurations, was identified as the root cause of 26% of data breaches.
Approximately 5.5% of vulnerable images were present in running workloads.
Among workloads with critical or high vulnerabilities, 83% had a fix available and 0.18% had an exploit available.
More than 70% of organizations used stateful detections across 91% of their cloud environments.
Organizations using the "kill -9" response increased by 140%, across 132% more policies than the prior year.
Recommendations: Adopt runtime security as a foundational control.
Align runtime detections with regulatory and data-sovereignty requirements.
Use high-fidelity, behavior-based runtime detections that can safely power autonomous response.
Invest in human-driven detection engineering for rule tuning, validation, and maintenance before adopting agentic security.
Leverage open-source security tools to increase transparency, auditability, and the breadth of detection logic.