Sysdig introduced AI Defense on November 4, 2026, describing runtime monitoring and controls for AI agents. Its launch blog also describes a customer pilot in which every policy ran in Alert for a month and nothing was blocked. That detail matters when you read a pilot report: an observed event and an enforced restriction answer different questions.
Write down the response mode
Sysdig describes Confirm as pausing a call for developer approval and Block as refusing it. It also describes a response that ends a process when it starts. Before a trial, record the mode for each policy you intend to evaluate. If your goal is an inventory, an Alert-only period can show activity without demonstrating that the product prevented that activity.
Reconcile one known workflow
Use an approved test environment and a harmless task, such as having a coding agent read a synthetic project file. Record the device, account, agent and expected action. Compare that list with the inventory and event records returned by the product. Ask the administrator to resolve missing or unexpected entries before treating the inventory as complete.
For example, a fictional team runs the same task on two managed laptops under two different accounts. If the dashboard shows only one account, a count of two devices cannot resolve who performed each action. Check the deployment and identity mapping. These are proposed evaluation steps, not results from testing Sysdig.
Keep observation and enforcement results separate
For each pilot entry, keep the expected action, observed event, policy mode and actual outcome together. An Alert event shows that the system recorded something under that configuration. It does not establish that the action was denied. If you later evaluate enforcement, write a separate test plan with a defined permitted action and a defined restricted action.
Sysdig’s launch blog lists macOS and Windows availability and recommends at least ten machines for a fuller trial. Confirm coverage for your exact devices and deployment before expanding the pilot. No software was installed and no agent task was run for this article.