Fleet coverage
See which hosts and Kubernetes nodes are protected, online, dropping events, or drifting from the expected Falco and rules versions.
Coverage health, not just an install countFounding access · In development
Operate Falco across every host and cluster.
One control plane to verify coverage, triage runtime threats, and safely roll out Falco rules across Linux, Docker, and Kubernetes.
$9 per protected node, billed monthly. The first paid subscription starts a 30-day MVP delivery clock.
Falco-compatibleOpen connectorCancel anytime30-day delivery or refund
A runtime security control plane
From noisy Falco events to one actionable incident
A product preview of the founding MVP—not a claim that the service is available today.
app.openfalco.com / overviewPRODUCT PREVIEW
Protected nodes47 / 5094% coverage
Unhealthy sensors3Needs attention
Open incidents62 critical
Rules rollout82%41 nodes updated
Critical incident
Grouped from 18 Falco eventsUnexpected shell spawned in a production container
NODEprod-worker-07WORKLOADpayments/api-6f8cUSERroot (uid 0)COMMANDbash -i
Detected18 events groupedAwaiting triage
The operational layer Falco teams need
Three jobs. One focused product.
Falco remains the open detection engine on your infrastructure. OpenFalco adds the hosted workflow required to run it across a real fleet.
Incident inbox
Group repeated alerts into incidents with host, container, process, user, command, namespace, and severity context ready for triage.
Fewer alerts, more decisionsSafe rule rollout
Enable, tune, stage, and roll back rules across selected environments with rollout status and an auditable change history.
Policy control without YAML driftFocused by design
Not another SIEM. Not a full CNAPP promise.
The founding release focuses on operating Falco well. Vulnerability scanning, Windows coverage, attack graphs, and automated containment are intentionally outside the 30-day MVP.
CapabilityOpen-source stackOpenFalco
Runtime detection engineFalcoUses your Falco
Multi-host coverage healthBuild it yourselfFounding MVP
Incident grouping and triageForward raw eventsFounding MVP
Staged rule rollout and rollbackGitOps / custom toolingFounding MVP
Simple node pricing
$9 per protected node, per month.
A Linux host or Kubernetes worker node counts as one protected node. Pods, clusters, and alert volume do not add to the bill.
1 node = $9 · 10 nodes = $90 · 100 nodes = $900
Founding subscription
$9/ node / month
- Linux, Docker, and Kubernetes
- All three founding MVP capabilities
- Open Falco connector
- Customer portal and cancel anytime
- MVP within 30 days of the first paid subscription—or a full refund
Resources
Explore the Falco operations gap
FAQ
Founding access, clearly explained
Is OpenFalco available today?+
No. This is a paid founding subscription for a product in development. The first successful payment starts a 30-calendar-day MVP delivery clock.
What counts as a protected node?+
Each Linux server or Kubernetes worker node sending Falco health and event data counts as one node. We do not bill per pod, cluster, or alert.
What will the first release include?+
Fleet coverage health, an incident inbox that groups Falco events, and staged rule rollout with rollback and an audit trail.
What happens if the MVP misses the deadline?+
We will deactivate founding sales, cancel active founding subscriptions, and refund all founding subscription charges in full.
Can I cancel or change node quantity?+
Yes. Stripe's hosted customer portal lets you update payment details, view invoices, change quantity, or cancel using an email one-time passcode.