Just got the email from our account rep. Effective next quarter, our Sysdig Secure + Monitor commit is going up 15%. No new features, no increased data retention, just "platform investments" and "inflation adjustments."
We're monitoring ~500 containers across dev, staging, and production. The bill was already substantial. This is pushing it into "justify to the CFO" territory.
Before I start that battle, I want to see what others are doing. We need runtime security, vulnerability scanning, and Prometheus-compatible monitoring. Our non-negotiables:
* Must support Kubernetes and container runtime security (file integrity, anomaly detection).
* Must have robust, out-of-the-box dashboards for container metrics.
* Must be able to ingest custom PromQL metrics from our apps.
* API-first for automation into our existing BI and ticketing systems.
I've done preliminary scans. The usual suspects:
* **Datadog**: Obviously. But their security module pricing is opaque, and their all-in cost could be higher. Anyone have a direct cost-per-container comparison?
* **Wiz**: Comes up a lot for CSPM/CNAPP. How deep is their runtime protection and actual monitoring/metrics visualization compared to Sysdig?
* **Palo Alto Prisma Cloud**: Heard mixed reviews on agent overhead and UI complexity.
* **Self-managed Falco + Prometheus/Grafana stack**: The OSS route. We have the team to potentially manage it, but what's the *real* TCO including engineering hours for maintenance and alert tuning?
What I'm not interested in: vendor marketing slides. I want actual numbers and operational experience.
* If you switched from Sysdig recently, what did you move to and what was the % cost change?
* What performance/feature gaps did you have to accept?
* What's your approximate cost per monitored container/node with your current stack?
We'll likely run a POC on the top contenders. I'll share our evaluation criteria if there's interest.
Ah, the classic "platform investments" line. I've seen that one before, usually right after they've locked in a decent chunk of their customer base on a multi-year.
You're right to be suspicious of Datadog's opaque security module pricing. Their sales playbook is to get you on the core infra monitoring, then the per-container security add-on becomes a multiplier on an already high bill. I'd wager your total cost would end up higher than the Sysdig hike.
Wiz is strong on posture and vulnerability management, but their runtime protection and metrics visualization are still catching up. It's more of a CSPM that's bolted on runtime features, not a born-and-bred monitoring platform. For your PromQL and dashboard needs, you'd likely be stitching two systems together.
Have you actually run the numbers on what 15% more of your "already substantial" bill looks like over three years? That's the real fight. Before you jump to another vendor with their own opaque pricing, get your account rep to define what "platform investments" actually are, in writing. Sometimes pushing back on the vagueness can get you a discount or a fee waiver for a year.
Procurement Cynic