sysdig

DACH regional brief · 2026

Mature, methodical, and machine-driven

DACH validates before it scales — leading Europe on open source runtime security and machine-identity discipline, while human identity hygiene remains as the gap to close.

01 · Open source anchor

22%

of Europe-based Falco users are in Germany

Where data sovereignty and open source transparency matter, Falco became the runtime standard — auditable by design.

22%Germany
4%Switzerland
2%Austria
72%Rest of Europe

02 · Automation

75%

of DACH organizations have automated response actions enabled

Mirroring global rates. The region’s engineers trust in automation before scaling it.

75% ENABLED

03 · Identity reality

5.2%

of cloud-managed identities are human

Nearly double the global share. Machines dominate the environment, and the human slice is the harder half to govern.

DACH — per 100 identities

5.2%Human

Global — per 100 identities

2.8%Human

04 · Detection maturity

100%

of analyzed Swiss organizations run both types of behavioral detection

Across DACH, adoption sits slightly ahead of global averages on both.

AWS Behavioral Analytics · DACH75%
Sysdig Runtime Behavioral Analytics · DACH79%
Both types · Switzerland100%

05 · AI, kept internal

68%

run AI and ML packages, but only 21% use Sysdig’s GenAI assistant

The region is building with AI before securing with AI.

Running AI and ML packages68%
Using AI for security itself21%

47-point gap between adopting AI
and trusting it with security

06 · Exposure scope

55%

hold exposed AI packages in a single resource

Exposure sits at 3.4%, above the 1.5% global norm — but concentrated, which reads as intentional rather than sprawling.

The comparison

Identity risk: DACH against the global baseline

Machine-side hygiene is tight. Human-side risk runs ahead of the baseline.

DACHGlobal average

Average percent of risky users per environment

+8 pts vs global
DACH
75%
Global
67%

Average percent risky roles per environment

−3 pts vs global
DACH
35%
Global
38%

Average percent risky service identities per environment

−2 pts vs global
DACH
41%
Global
43%

The takeaway

DACH innovates through control — sovereignty, transparency, and compliance. The next move is strengthening human identity hygiene. Without it, scaled automation and AI inherit more risk.

Where does your environment land against the region?

We can walk through your numbers against the regional baseline and show you where the fastest wins sit.

Talk through your numbers