We're evaluating Wiz and Sysdig. Focus on container runtime security. Which is less invasive?

Just started a 14-day trial for both, focusing on runtime security for our Kubernetes clusters. Main worry: agent performance hits and stability issues.

From my initial deployment:
* **Wiz:** Agentless. Scans via read-only cloud APIs. No kernel modules. Felt like a pure observer. Zero config changes to pods.
* **Sysdig:** Uses a DaemonSet with a kernel module (eBPF). You can tune it, but it's inside the node. Saw a slight CPU bump on a test node under load.

**Honest pros/cons so far:**
**Wiz**
- **Pro:** Truly non-invasive. Deployment took 10 mins.
- **Con:** Can't block in real-time (it's a scanner). You get alerts, not runtime enforcement.

**Sysdig**
- **Pro:** Real-time blocking and system call visibility. Powerful for active defense.
- **Con:** The kernel module feels invasive. Potential for more "works on my machine" issues?

For those running in production, which approach caused less headache long-term? Is the real-time protection worth the potential invasiveness? 🤔