Black Hat USA–Sysdig today announced the launch of Sysdig Secure AI, a new AI-native offering built on the Sysdig Secure CNAPP that helps teams defend at the speed of AI-powered attacks. With frontier AI models like Claude Mythos uncovering new software vulnerabilities by the thousands [1] and threat actors breaking into cloud environments in minutes, security teams can’t match the pace of threats just by adding headcount. Sysdig Secure AI helps enterprises close that gap, built on the industry’s deepest runtime intelligence to investigate, prioritize, and remediate the risks that matter most the moment they appear. It gives teams the choice to harness machine-speed defense however it best fits them and moves defenders from operators to orchestrators, so people set the goals while AI creates personalized outcomes to keep them ahead.

“For decades, security tools worked like cameras, recording break-ins for humans to review and act on. But attackers changed the game the moment they picked up AI – by the time you receive an alert, your data’s already gone,” said Loris Degioanni, Sysdig Founder and CTO. “You need a response, not just a recording. Security teams need an active defense that reacts in real time to what’s actually happening in their environments. That’s what Sysdig Secure AI delivers, adapting to your business and moving at the speed and shape of the threats it helps defend against.”

The window for defenders to respond to threats is collapsing. Vulnerabilities are now exploited within hours of advisories going public, and the Sysdig Threat Research Team (TRT) recently watched an AI agent move from a single vulnerability to an organization’s internal database in under one hour. They also exposed JADEPUFFER, the first documented case of ransomware run end to end by an AI agent, which shows that attackers have only scratched the surface of what autonomous threats can do. As the window for defenders to respond shrinks toward zero, AI-powered defense is no longer optional; 83% of organizations are either adopting or planning to adopt AI for cybersecurity [2].

An expert AI security team, built for how you work

Sysdig Secure AI powers a coordinated team of AI security experts built on deep runtime telemetry and tuned for each domain of cloud defense. When real threats and risks surface, they work together, analyzing environments, pinpointing what’s actually running and exploitable, confirming whether any common vulnerabilities and exposures (CVEs) are present and reachable, surfacing zero-day activity, and containing threats or fixing risk at the root.

But AI is not one-size-fits-all, and neither are security teams. Organizations vary in size, industry, and regulation, and no two are at the same point in their AI journey. Sysdig Secure AI gives every organization three ways to put machine-speed defense to work, designed to complement one another so that all teams can work at machine speed:

  • Agentic AI: Sysdig’s AI security agents build a prioritized, personalized list of a business’ most urgent risks and deliver the remediations and mitigations to close them, helping teams stop threats before they escalate. Here, teams define what “good” looks like, and Sysdig Secure AI works toward achieving it.

  • Headless cloud security: For teams that operate through AI agents, like Claude, Cursor, or Codex, headless cloud security leverages Sysdig’s expertise to help accelerate investigations spanning technology stacks and adjust controls for the fastest, safest mitigations and remediations – right in the workflows they already rely on.

  • GenAI assistant: Sysdig’s GenAI assistant, formerly Sysdig Sage™, is a fully integrated AI cloud security analyst that anyone on the team can ask to explain risk, help navigate the platform, and recommend remediation guidance in plain language.

Across all three options – which teams can use in combination – organizations stay in control. Sysdig Secure AI keeps a human in the loop where decisions are critical and works autonomously where speed matters most, auditing every action so that accountability is always clear. For organizations still planning the initial stages of their AI-powered security journey, the Sysdig Secure cloud-native application protection platform (CNAPP) remains foundational.

Better runtime data, stronger security outcomes

Data is what sets Sysdig apart. AI is only as good as the foundation it’s built on, and as a full CNAPP, Sysdig sees more of the cloud than anyone – from posture and identity to runtime. That foundation is the industry’s deepest runtime intelligence, drawn from its deep telemetry; years of frontline research from the Sysdig TRT; and Falco, its open source runtime threat detection engine. To date, Falco has been downloaded over 200 million times and is trusted by 60% of the Fortune 500. As a result, Sysdig Secure AI acts on live, real-world risk.

Sysdig Secure AI is powered by expert-written skills and tuned for each pillar of cloud defense, so teams are never starting from scratch. It’s also hyperpersonalized to how each organization works, learning what’s normal, what’s critical, and which assets matter most, sharpening its understanding the longer it runs.

The payoff is measurable. Sysdig Secure AI helps teams shrink their exposure windows; contain threats before they escalate; and shift the repetitive work of investigation, reporting, and ticketing to AI. It can help teams handle more than 10 times as many investigations as human experts alone at 88% lower cost. For example, a vulnerability investigation that takes three skilled analysts 45 minutes each at about $135 today can be done by one analyst with Sysdig Secure AI in under 15 minutes for $16, roughly $3.75 of that in tokens.

“Adding headcount fast enough to match the speed of today’s threats is a real challenge, so AI-powered security that amplifies the impact of human effort is critical,” said Frederic Alex, Senior Security Engineer at a crypto exchange. “Sysdig Secure AI meets teams where they are. Experts set the priorities and AI agents do the heavy lifting using deep runtime data. That helps us close the gap between knowing about risk and resolving it, and it’s how we stay ahead of a threat landscape that changes by the hour.”

“What sets Sysdig Secure AI apart is that it acts on what is actually running our environment, so we can act on the findings that matter most as they’re detected,” said Teo Lopez, Manager of Platform Engineering at SonderMind. “As a mental health tech company, keeping clients’ personal information secure and protected is a non-negotiable. Sysdig equipped us to bring AI into our security program on our own terms and see real, measurable risk reduction almost instantly. We didn’t have to wait until we felt ready to rebuild everything around it.”

Availability

Sysdig Secure AI is generally available today. Existing Sysdig Secure customers can contact their account teams to get started. For others interested in learning more, schedule a demo.

[1] Anthropic, “Project Glasswing: Securing critical software for the AI era,” April 2026.

[2] Information Systems Security Association (ISSA) and Omdia, “New Study Shows 83% of Organizations Are Adopting AI for Cybersecurity, But Cyber Pros Say the Job Has Become Harder,” June 2026.

Resources

About Sysdig

Sysdig delivers cloud security the right way through open innovation, agentic AI, and the uncompromising truth of runtime. In a world of blind spots and black boxes, Sysdig empowers security and development teams to prevent, detect, and respond to threats in real time.

Fueled by the industry’s deepest runtime intelligence, Sysdig meets organizations where they are in their AI journey. From its fully integrated GenAI assistant to Sysdig Headless Cloud Security, which runs inside AI coding agents and moves security beyond one-size-fits-all dashboards, Sysdig gives teams the flexibility to work where and how they want. Founded by the creators of Falco and Wireshark, Sysdig is trusted by more than 60% of the Fortune 500 and built for organizations that refuse to compromise.

Media gallery

About The Author
Business Wire