The Pulse
Sysdig makes Sysdig AI Defense generally available to assess and control all AI-agent actions at runtime
Sysdig has made Sysdig AI Defense generally available for runtime security and governance of AI agents. The product assesses each action against organizational policies and can allow it, ask the user for confirmation or block it before comp
AI.info Team · Written with AI · fact-checked ·
Sysdig's U.S. release said Sysdig AI Defense, its runtime security and governance product for AI agents, was generally available on Nov. 4.
Sysdig Japan's release says Sysdig AI Defense became generally available for macOS and Windows on Nov. 5.
Three outcomes for every agent action
Sysdig AI Defense tracks activity from the endpoint where an agent starts to the cloud resources it can access. It checks each action against an organization’s policies and assigns one of three outcomes: allow it, ask the user for confirmation or block it before completion. If an action slips through, it forcibly terminates the process.
The assessment combines three views: what the agent intends to do, what it actually does and what its credentials can reach. Sysdig says its system instruments the agent’s harness—the framework in which the agent operates—to record calls to tools, Model Context Protocol (MCP) servers, skills and plugins, including their arguments and targets. At the kernel level, it records what was actually executed, and a compromised or runaway agent cannot alter that record.
Sysdig AI Defense’s initial observations
Initial insights from Sysdig AI Defense indicate that about seven kernel processes do actual work for each action an agent logs. Sysdig says agents may take on new skills or connections while working, so an agent deployed in the morning may not be operating in the same state in the afternoon. Sysdig says agent logs show what an agent intended, while the kernel is the only source that can show what actually executed.
Sysdig describes reading a test-environment credential as trivial noise, while reading a key that manages production as an unmistakable incident. Sysdig AI Defense evaluates actions based on the agent’s access at the time, before an action is completed.
Inventory, policy controls and investigation records
Sysdig AI Defense uses runtime telemetry to build a live inventory of agents, harnesses, models, MCP servers, skills and plugins. Sysdig says the inventory can cover agents on Claude Code, Codex, GitHub Copilot and Cursor and connect them to the people responsible for them. The product also offers policy templates that include rules aligned with the Open Web Application Security Project (OWASP) “OWASP Top 10 for LLM Applications.”
Organizations can start policies in alert mode and move to blocking when ready. In blocking mode, the system can stop unreviewed MCP servers, skills and plugins before execution, or block risky credential reads and behavior outside expectations. It can also hold actions for human review, with an exception process for developers.
Sysdig says the product records sessions in real time and provides a live action graph that compares what an agent reports with what it did, along with the range it could access and the permissions under which it acted. Its records include which policy applied, when it applied and who approved it. It also tracks model calls by agent, team and responsible person, including calls that bypass an AI gateway. Leaders can use this information to identify premium models used for routine work and act without waiting for a month-end bill.
From workstations to managed agent platforms
Sysdig AI Defense can be deployed through existing management tools and is intended to complement endpoint protection, model testing and red-teaming tools rather than replace them. Its coverage includes employee workstations, production Linux and Kubernetes environments, and managed agent platforms that an organization does not own.
The product uses the same kernel-level instrumentation as Sysdig Secure, Sysdig’s cloud-native application protection platform, and is based on Falco. Sysdig describes Falco as an open-source standard for cloud-native runtime threat detection and says more than 60% of Fortune 500 companies use it.