Sysdig Launches AI Defense to Govern Agent Actions From Endpoint to Cloud

Sysdig has launched AI Defense, a runtime security and governance product designed to inspect what AI agents do and intervene when their actions exceed an organization’s policies. The November 4 announcement makes the product generally available for macOS and Windows, with visibility intended to connect activity on employee workstations to the cloud resources their credentials can reach.

The product addresses the shift from AI that produces answers to AI that operates software. A coding agent can read files, invoke tools, start processes and change infrastructure. Securing that workflow requires understanding both the task the agent believes it is performing and the operations actually occurring underneath it.

Connecting Agent Intent With Operating-System Evidence

Sysdig says AI Defense combines instrumentation inside an agent’s harness—the framework that runs it—with operating-system telemetry. Harness instrumentation captures calls to tools, Model Context Protocol servers, skills and plugins, including their arguments and targets. System-level observation provides a separate record of the processes and activity those calls produce.

The distinction matters when an agent’s account is incomplete or compromised. One reported tool action can start several processes, and a connection or skill added during a session can change what the agent is capable of doing. Sysdig reports an early observation of roughly seven underlying processes for each action in agent logs; that is a company finding, rather than a universal ratio for all agents.

The system also considers authority: the same file-reading operation can carry different consequences depending on whether the credential involved reaches a test environment or administers production. An action graph is intended to connect the sequence of events, the accountable person, the agent’s stated activity and the resources within reach.

Policies That Allow, Pause or Block an Action

Organizations can start policies in alert mode before enabling enforcement. Once enforced, Sysdig says those policies can block unvetted tools and connections, stop risky credential access or hold an action for human approval. The release also describes terminating a process if an action gets past an earlier control.

These mechanisms serve different points in an execution sequence. Preventing an operation from completing is distinct from detecting activity and terminating a process afterward. The announcement does not provide a public matrix showing which controls are preventive on each supported operating system, harness and managed platform.

Policy templates include mappings to the OWASP Top 10 for LLM Applications, with developer exception paths. Sysdig also describes session records showing which policy applied, what was allowed or blocked and who approved an exception. Those records can support investigation and audit work without requiring teams to reconstruct a session after an incident.

What the Falco Foundation Adds

Sysdig connects the product to its history in cloud-native runtime security and Falco, the open-source project it originally created. Falco’s documentation describes observing Linux kernel events and plugin-provided event sources, enriching events with container and Kubernetes context, and applying rules to generate alerts.

That foundation helps explain why Sysdig emphasizes observed execution rather than relying solely on an AI system’s narrative. It does not mean the open-source Falco project itself supplies every agent-governance or blocking capability described in AI Defense. Falco’s documented detection architecture and Sysdig’s commercial product should be understood separately.

The release names Claude Code, Codex, GitHub Copilot and Cursor among the agent environments it aims to inventory and trace to a human owner. Its macOS and Windows availability statement is more specific than the broader description of coverage extending into Linux, Kubernetes and managed agent platforms; organizations will need to establish the applicable integration for each environment.

Runtime Governance Complements Model Testing

Sysdig’s technical discussion of shared responsibility frames runtime controls as a layer around the work an agent performs. The practical distinction is between asking a model to respect a boundary and enforcing that boundary when software attempts an operation.

AI Defense is positioned alongside existing endpoint protection, model testing and red teaming. Testing examines how a model or workflow behaves under selected conditions; runtime governance addresses actions during an actual session. Neither description establishes that a deployment is immune to compromise, and effectiveness depends on policy configuration and coverage of the execution path.

Attributing Agent Activity and AI Spending

Beyond security, Sysdig says AI Defense associates model calls with the agent, team and person responsible, including activity that does not pass through a centralized AI gateway. That could help organizations distinguish expensive model use on routine work from activity that warrants a more capable model.

The broader proposition is a common evidence layer for security, governance and cost management. As agents acquire more tools and operate under real employee credentials, their impact is defined by what they can execute. Sysdig AI Defense aims to make that authority visible and enforceable at the point of action.