Falco for MSPs: runtime detection from CI pipelines to Kubernetes fleets

Managed Kubernetes fleets and the CI pipelines that ship code into them are two different attack surfaces, and MSPs increasingly need a tool for each. This guide covers Falco, a CNCF-graduated runtime engine that turns suspicious container behaviour into a tuned alert pipeline, and zizmor, a static analyzer that catches risky GitHub Actions configuration before a workflow ever runs.

What Falco is, and what it catches

Falco was created by Sysdig and is now a graduated project of the Cloud Native Computing Foundation. It watches system calls through eBPF-based monitoring and flags process, file and network activity that looks wrong inside a running container. That makes it a way to catch an intrusion in progress, rather than finding it only during a post-incident review.

What to alert on first

Not every signal Falco can generate is worth an on-call page. For MSPs running many tenants, the rules that matter most combine a low false-positive rate with a high cost if missed: an interactive shell spawned inside an application container that should never need one, a process reading from a sensitive mount path such as a host filesystem, and privilege or Linux capability changes inside a running pod. These three cover most of the scenarios where something is actively happening that operators care about.

Routing alerts so they get acted on

A detection tool only helps if the alert reaches someone who can act on it. Falco events should carry enough context — cluster, namespace, tenant and pod identity — to route directly into an MSP's on-call or ITSM tooling, with a documented containment step before any alert gets closed. Tuning rules per customer baseline avoids alert fatigue: a shell that is normal in a CI runner namespace is not normal in a customer-facing web pod.

Where Falco stops

Falco is a detection layer, not a response system. It does not isolate a workload, roll back a deployment or rotate credentials on its own; those steps still need a playbook and a human or automated responder behind the alert. Treat it as the sensor, not the whole security program.

MSPs that need outside help building that playbook, or evidence of a tested detection-and-response process for NIS2, DORA or GDPR audits, can turn to Altovar's cybersecurity services, which cover penetration testing, vulnerability assessment and incident response.

A CI-side companion: zizmor for GitHub Actions

Falco only sees a workload once it is already running. zizmor, a Rust-based static analyzer, reads GitHub Actions YAML files without executing them, looking for issues such as unpinned third-party actions, overly broad permissions, and patterns that can lead to cache poisoning. It can emit results in SARIF format, so findings show up directly in GitHub's code-scanning tab instead of a separate dashboard.

The current zizmor release, v1.30.1, follows v1.30.0's fixes for action-pin matching and a parser crash on deeply nested workflow expressions. On the runtime side, Falco 0.45.0 reached its final stable release on 21 September 2026 after a release-candidate cycle; teams still running the earlier 0.45.0-rc4 candidate should move to the stable build rather than staying on a release candidate in production.

What to do

• Turn on Falco's default rules for interactive shells, sensitive mount reads and privilege changes first, since they carry the clearest signal.
• Tag every alert with cluster, namespace, tenant and pod identity, and route it into the on-call or ITSM tool the team already uses.
• Run zizmor on every pull request that touches a workflow file, and fail the check on new high-severity findings.
• SHA-pin third-party GitHub Actions and scope permissions: down to what each job actually needs.
• Deploy Falco on production clusters with alert-only rules first, then tighten toward blocking behaviour once the baseline is understood.
• Forward both tools' output into the same alerting pipeline used for other security signals, so nothing gets missed in a separate dashboard.

Sources: Falco on GitHub, Falco documentation, Falco 0.45.0 release notes, zizmor documentation.