Falco Feeds extends the power of Falco by giving open source-focused companies access to expert-written rules that are continuously updated as new threats are discovered.
Plain language. Live data. A fix decision in one conversation.
Dashboards answer the questions someone already decided to build a screen for. Every other question — the one a new CVE just made urgent, or the one no vendor anticipated — waits until someone writes a report or files a ticket. Anyone who has lived through a critical CVE disclosure knows the drill: The board wants an exposure answer in hours, and the honest answer is “we’re still pulling the data.” Vulnerabilities are now weaponized within 10 hours of disclosure, and a manual exposure assessment often takes longer than that. The team burns days reconciling scanner exports against deployment reality, spending their time finding the answer instead of fixing the problem.
That’s the ceiling of dashboard-driven security. The SysQL Skill removes it.
Watch: three questions, from exploit discovery to fix decision, in one Claude Code session.
The SysQL Skill brings Sysdig’s security graph into Claude Code so you can ask any question in plain language and get back a validated query, real blast-radius data, and a prioritized fix decision. No query language to learn. No console to navigate. This skill works in whatever language your team thinks in. It’s one of the latest agent skills in Sysdig’s headless cloud security platform.
From plain language to fix decision: What it looks like
The demo starts with a single question: “Find the vulnerabilities with a known exploit.”
The skill writes the query — MATCH Vulnerability WHERE v.hasExploit = true … ORDER BY cvssScore DESC — runs it live against your environment, and returns results ranked by severity. CVE-2024-41110, a Docker escape at CVSS 9.9, sits at the top.
That’s not a dashboard widget. That’s your live environment, answering the question you actually asked.
The more important moment comes next. It’s a natural follow-up question: “How many workloads are affected by CVE-2024-41110?”
The answer is zero KubeWorkloads, and the skill tells you why. The flaw lives in a Go dependency, not a directly linked workload. So the skill reasons about graph relationships, re-queries on its own, and finds the CVE in three sysdig/vuln-host-scanner images on quay.io. This is runtime insights at work: vulnerabilities linked to images, and images to workloads. The result is a real blast radius instead of a flat scan result.
One more question: “Should I fix this CVE? Look for an available fix.”
The response is yes, and it comes with the exact fixed-in version for every affected image.
Three questions, no pre-built reports, and a prioritized fix decision, all in one conversation.
The question you didn’t plan to ask
Every cloud-native vulnerability management platform eventually hits the same wall: You can only see what the vendor decided to surface. SysQL exposes the underlying security graph directly, so vulnerabilities, images, workloads, running containers, and exploitability signals are all connected and queryable. The most important question in an investigation is usually the one you didn’t plan to ask. Now you can ask it.
Not only that, but you can ask this question with control intact. Queries run through the Sysdig Secure MCP server with read access to the security graph, so every question is governed and auditable just like any other access to your Sysdig environment.
This is part of what Sysdig calls headless cloud security: Security stops being a destination your team navigates to and starts running where they already work. Earlier posts in this series covered the Runtime Investigation Skill, custom cloud security controls, and onboarding at cloud speed. SysQL extends the same principle to the full security graph. This is what CNAPP looks like when it stops requiring you to go somewhere to use it.
The bigger shift
Security investigation has always had a hidden constraint: You can only ask what the vendor built a screen for.
SysQL removes that constraint. Your data comes to you, answers the question you actually have, and ends the conversation with a fix, not a ticket to find one.
Want to see what security feels like when you can ask it anything? Request a demo and watch the SysQL Skill in Sysdig Headless Cloud Security take a plain-language question to a fix decision in one conversation.