Sysdig

Sysdig made runtime the organizing principle of cloud security — the argument that you should prioritize the vulnerabilities and misconfigurations actually in use, detected by real signals from running workloads, rather than drowning teams in theoretical CVE lists — and that thesis is winning as CNAPP consolidates. Its stewardship of Falco, the open-source runtime engine it created and donated to the CNCF (now a graduated project with 130M+ downloads), gives Sysdig deep roots in the cloud-native detection ecosystem and a credibility with practitioners that acquisition-assembled CNAPP suites lack. The business is scaling fast: ARR reached roughly $283M in 2025, nearly doubling from $147M the prior year, and management targets $1B ARR within three to five years. The late-2024 appointment of CEO William Welch, a veteran operator, signals a push toward that milestone and, plausibly, an IPO or strategic exit. Sysdig Secure unifies CSPM, vulnerability management, permissions, and runtime detection-and-response behind its "555 Benchmark" — detect, correlate, and respond to cloud attacks in minutes — a differentiated speed message in a market where dwell time is the whole game. In a CNAPP field increasingly defined by runtime, the vendor that authored the standard runtime engine and is doubling revenue is positioned to be a durable independent or a coveted acquisition target.

Sysdig is racing a market that a single competitor may have already won: Wiz redefined CNAPP go-to-market with an agentless, fast-onboarding model and — after Google's ~$32B agreement to acquire it — now sits behind a hyperscaler's balance sheet and distribution, while Palo Alto (Prisma Cloud), CrowdStrike (Falcon Cloud Security), and Microsoft Defender for Cloud all bundle CNAPP into platforms enterprises already buy. Sysdig's runtime-first pitch is real, but "runtime" has become the industry's favorite marketing word, and every CNAPP vendor now claims it, eroding the differentiation. Falco's open-source ubiquity is a double edge: competitors and cloud providers can and do build on the same free engine, so community stewardship does not translate cleanly into commercial lock-in. The $2.5B valuation was set in the December 2021 Series G at the top of the last cycle, and $283M ARR growing into a field of giants must sustain torrid growth to grow into — let alone exceed — that mark. An agent-based architecture is also a harder enterprise sell than agentless onboarding when the category leader has made frictionless deployment the buying criterion. If CNAPP resolves into a platform-suite market, a mid-scale independent selling a runtime philosophy risks being out-distributed regardless of technical merit.