Originally announced August 22, 2019. Source: Sysdig via BusinessWire.
Sysdig Expands Open Source Leadership
In August 2019, Sysdig, Inc. announced the appointment of Kris Nova as Chief Open Source Advocate, a move intended to meet surging demand for the company’s open source security tooling. At the time of the announcement, Sysdig reported a 240 percent increase in adoption of Falco, its open source runtime security project, over the preceding nine months. To support that growth, the company stated it had more than quadrupled the engineering resources dedicated to its open source projects.
Falco was accepted into the Cloud Native Computing Foundation (CNCF) Sandbox in October 2018. By mid-2019 it had attracted production users across government agencies, financial institutions, Fortune 2000 enterprises, and web-scale companies, with contributions from organizations including Frame.io, Shopify, Snap, and Booz Allen Hamilton.
Who Is Kris Nova?
Kris Nova brought deep Kubernetes and cloud-native credentials to the role. Before joining Sysdig, she was a Senior Developer Advocate at Heptio/VMware and, prior to that, a developer advocate and Kubernetes engineer at Deis/Microsoft. Her open source contributions include creating kubicorn, a Kubernetes infrastructure management tool written in Go. Nova also served as a CNCF Ambassador and organized multiple Kubernetes Special Interest Groups (SIGs).
She is the author of Cloud Native Infrastructure (O’Reilly), a practitioner-focused book on designing and running distributed cloud-native systems. Her focus areas at Sysdig were defined as security, intrusion detection, Linux kernel internals, Kubernetes, and eBPF.
“Sysdig is full of genuine and smart Kubernetes experts, the people you want building the projects used to protect your environments. Falco needs to be in any stack and I look forward to helping people to understand why and how to implement.”
— Kris Nova, Chief Open Source Advocate, Sysdig (2019)
“Kris Nova is a Kubernetes pioneer, and we look forward to continuing to grow Falco and drive adoption together.”
— Loris Degioanni, CTO and Founder, Sysdig
Falco: Technical Highlights as of Mid-2019
By the time of Nova’s hire, the Falco project had reached several notable technical milestones:
- eBPF integration: Falco became, by Sysdig’s account, the first major security and behavioral activity monitoring tool for containers powered by Extended Berkeley Packet Filter (eBPF) at the Linux kernel level. This allows syscall capture without kernel module requirements on supported kernels.
- Kubernetes Audit Policy support: Falco was among the first open source security projects to integrate with the Kubernetes Audit Policy, enabling an additional stream of API-server events for threat detection.
- Falco Operator: A Kubernetes Operator was released to automate day-to-day Falco lifecycle management, with inclusion in OperatorHub.io.
- Google Cloud Platform Marketplace: In April 2019, Falco was added to the GCP Marketplace, lowering the barrier to deployment for GCP users.
- containerd and CRI-O support: The Falco 0.15.0 release added support for the containerd and CRI-O container runtimes, enabling compatibility with Red Hat, IBM Cloud, and GKE environments running older platform versions.
- Falco rules library: Released in August 2019, this library lets enterprises adopt community-contributed detection rules without writing them from scratch.
Open Source Roadmap and Governance
A central part of Nova’s mandate was establishing a formal governance model for Falco — a prerequisite for the project advancing beyond the CNCF Sandbox stage. The planned governance work included:
- Defining clear standards and guidelines for contributors and maintainers.
- Implementing Prow, the Kubernetes-native CI and developer productivity tooling already in use by other CNCF projects, to automate common maintainer tasks.
- Introducing more fine-grained access control for project resources.
- Reducing maintainer toil by enabling contributors to run common tasks via CLI commands rather than web GUIs.
Sysdig also noted that approximately 30 percent of its engineers were active contributors to the company’s open source projects at the time, with a commitment to grow that share.
Beyond Falco, Sysdig announced continued involvement with the OpenStack Security SIG — a cross-company working group focused on OpenStack ecosystem security — and membership in the Linux Foundation’s Continuous Delivery Foundation (CDF).
Sysdig’s Open Source History
Sysdig was founded in 2013 and launched with sysdig, an open source Linux system exploration and troubleshooting tool. The company subsequently created two additional open source projects:
- Falco — runtime security and anomaly detection for cloud-native workloads.
- Sysdig Inspect — an open source interface for analyzing sysdig capture files.
By mid-2019, the company reported that its three open source projects had collectively attracted a community of millions of developers, sysadmins, and IT professionals. Sysdig has also been an active adopter and contributor to third-party open source projects including Kubernetes, Prometheus, and Anchore.
Why This Matters for DevOps and Security Teams
The appointment of a dedicated open source advocate at a vendor-backed CNCF project reflects a broader trend: as cloud-native security tooling matures, projects require structured governance to remain credible with enterprise adopters. For DevOps and platform engineering teams, the implications are practical:
- Governance matters for compliance: Enterprises subject to regulatory requirements need assurance that open source tooling follows reproducible, auditable development processes.
- eBPF is becoming foundational: Falco’s adoption of eBPF for syscall capture signals a direction the broader security tooling ecosystem has continued to follow.
- Rules-as-code reduces toil: Community-maintained rules libraries mean security teams can benefit from collective threat intelligence without maintaining detection logic entirely in-house.
- Operator pattern simplifies operations: The Falco Operator enables declarative, Kubernetes-native deployment and lifecycle management, fitting naturally into GitOps workflows.
Note: Kris Nova passed away in August 2023. Her contributions to the Kubernetes and cloud-native communities remain widely recognized.