The state of Falco: A year of progress since CNCF graduation

This update covers key advances in the Falco ecosystem since CNCF graduation: the donation of Falco Talon for automated response, a Sysdig Windows agent leveraging ETW, a substantial expansion of Falco plugins (including Entra and Okta integrations), enterprise-curated detection content via Falco Feeds, and the launch of Stratoshark built on Falco’s core libraries. It also previews a roadmap focused on deeper Kubernetes integration, a more sophisticated plugin system, and automated detection–investigation–response workflows (KDR).