Let's be honest, comparing Sysdig to a traditional antivirus on a VM is like comparing a network of seismic sensors to a burglar alarm on a single door. They're solving different problems, and the "which catches more" question is almost a category error.
Traditional AV on a VM is looking at files and processes on that specific guest OS, using signature matching and maybe some rudimentary behavioral heuristics. It's blind to the context in which that VM operates. It doesn't see the container orchestrator scheduling it, the weird outbound network call to a mining pool that only happens at 2 AM, or the runtime file system anomaly that disappears a second later because the container died.
Sysdig (Falco, really, if we're talking open source core) operates at the system call level, across the entire host. It's watching behavior, not just files. A real attack nowadays isn't a virus.exe you downloaded; it's a container with a hidden crypto miner, a compromised package in your CI pulling data, or lateral movement through your microservices. An AV might miss that entirely if the malware is novel or lives in memory. Sysdig's policies can flag the `apt-get install curl` in a production container at runtime, or a shell spawned from a web server process.
The real metric shouldn't be "catches more," but "catches what matters in a modern stack." If your threat model is still exclusively Windows malware on static VMs, maybe stick with AV. If you have anything resembling cloud-native infrastructure, the AV is just a checkbox for compliance, while the system call monitoring is what might actually tell you you're owned.
Example of a simple Falco rule that an AV would never conceive of, because it's not about a file signature:
```yaml
- rule: Launch Suspicious Network Tool in Container
desc: Detect network tools launched inside a container
condition: >
container.id != host and
proc.name in (netcat, ncat, nc, socat)
output: "Network tool launched in container (user=%user.name container=%container.name tool=%proc.name)"
```
That's catching behavior, not a virus.
null