Showing

results

November 5, 2026

Securing the AI Stack From GPU Runtime to Kubernetes

No items found.

Most of the vulnerabilities in an AI application sit below it, in the model, in the GPU runtimes, inference servers, and Kubernetes components it runs on. For example, in one 13-image Kubernetes cluster, those inherited components carried 5,286 CVEs, and replacing them with near-zero CVE images and optimizing them left three, with no application code changes .

RapidFort Image Bundle for AI applies that approach to the full AI stack. It includes near-zero CVE images for NVIDIA CUDA, AMD ROCm, PyTorch, TensorFlow, Triton, vLLM, and the cluster components underneath, plus PyPI, npm, and Java libraries vetted for malware, tampering, and secrets. You adopt it with a one-line FROM change.

This article walks through each layer of the AI stack, where its CVEs come from, and what the bundle replaces at that layer. It then covers adoption, measured results, and the evidence your security and compliance teams get with every image.

Where CVEs enter the AI stack

Your team writes the model code and application logic, and everything beneath it comes from upstream images and packages. A typical inference deployment stacks a CUDA or ROCm runtime, a framework such as PyTorch, an inference server such as vLLM or Triton, a Python runtime with hundreds of packages, and a Kubernetes cluster running Istio, ArgoCD, Prometheus, and a vector store such as Postgres.

Upstream GPU and ML framework images are large because they're built to serve every use case. A general-purpose CUDA image can include compilers, headers, and libraries that an inference service never loads. Each of those packages is a potential scanner finding, and most findings in an AI workload trace back to base images and dependencies.

That inherited debt lands on your engineers. Scanner findings grow about 140% a year, remediation cycles can run from 60 to 90 days and the average exploitation window is about 12 days. Much of that time goes to triaging CVEs in packages the running workload never touches.

Two constraints make AI stacks harder to clean up than typical web services. Models are pinned to specific CUDA, framework, and runtime versions, so rolling forward to the latest patched image can break training or inference. AI frameworks also pull in thousands of transitive PyPI, npm, and Java dependencies, and coding assistants add packages that no one on the team reviewed.

What the RapidFort Image Bundle for AI covers at each layer

The RapidFort Image Bundle for AI provides a near-zero CVE replacement for each layer of that stack, built on Ubuntu, Debian, Red Hat, and Alpine. Images are pin-for-pin compatible with their upstream counterparts, so you keep the exact versions your models depend on.

GPU runtimes: NVIDIA CUDA and AMD ROCm images for training and inference nodes.
ML frameworks: PyTorch and TensorFlow images, with older and minor versions patched in addition to the latest release.
Inference servers: NVIDIA Triton and vLLM images for model serving.
Language runtimes: Python, Node.js, and OpenJDK base images, including FIPS and strict-FIPS variants. The strict Python mode blocks non-approved hashlib fallbacks.
Open source libraries: Curated Libraries for PyPI, npm, and Maven, checked for malware, tampering, and secrets with third-party threat intelligence.
Cluster components: minimal images for Kubernetes, Istio, ArgoCD, Prometheus, Grafana, Postgres, and Redis.

RapidFort rebuilds every image daily and patches against published SLAs: vulnerabilities in the CISA Known Exploited Vulnerabilities catalog in one day, Critical and High CVEs in seven days, Moderate in 21, and Low in 28. Images ship for amd64 and arm64. Because the bundle uses standard distributions instead of a vendor-specific OS, you can return to upstream images at any time.

The bundle draws on the RapidFort catalog of tens of thousands of curated near-zero CVE images, which come in many versions, such as minimal, scratch, FIPS, etc. Read more about Curated Images and Curated Libraries.

How to adopt the bundle with a one-line FROM change

For most services, adoption is a change to the base image reference. Point the FROM line at the RapidFort image with the same version tag, rebuild, and run your existing tests.

# Before
FROM vllm/vllm-openai:<version>

# After
FROM <rapidfort-registry>/vllm-openai:<version>

To route Python installs through Curated Libraries, point pip, uv, or Poetry at the curated index, or configure it as an upstream in Artifactory or Nexus.

pip config set global.index-url <curated-libraries-index-url>

Platform teams can mirror the images through pull-through caches in ACR, Artifactory, Google Artifact Registry, Harbor, and Nexus, and use Renovate to keep pinned tags current. Security teams verify each image signature before admitting the image to a cluster.

cosign verify --key <rapidfort-public-key> <rapidfort-registry>/vllm-openai:<version>

Results on a Kubernetes cluster and a Python image

RapidFort applied this process to a 13-image Kubernetes cluster. Swapping to curated images took about one day and eliminated 4,781 of 5,286 CVEs, leaving 505. Profiling and optimizing brought the total to about five days and left three CVEs, eliminating 99.9% of the original findings. No application code was modified.

The same steps on a single Python 3.13 image built on Debian 12 produced these results:

Image	Size	CVEs	Packages
Upstream	1.14 GB	167	473
Curated	250 MB	4	160
Curated and optimized	89.2 MB	3	34

Near-zero CVE means a small number of CVEs can remain, typically where no upstream fix exists yet. Both examples above use general-purpose images.

Across RapidFort customers, teams report about 60% less manual remediation effort and release cycles two to three weeks faster .

Evidence for security and compliance reviews

Every image in the bundle is Cosign signed and carries SLSA provenance that your security team verifies with the RapidFort public key. Each image also ships with an SBOM in CycloneDX JSON or XML, a STIG report, and a CVE report.

For regulated programs, the bundle includes FIPS 140-3 validated images, STIG and CIS benchmarked images hardened to NIST 800-70, and images that are Iron Bank approved and DISA validated.

That per-image evidence shortens the work of assembling a package for FedRAMP, ATO, CMMC, or the EU Cyber Resilience Act. RapidFort customers reach compliance up to 30% faster and take about three months off ATO timelines. Many RapidFort customers have achieved FedRAMP authorization or ATO using the platform and RapidFort Images.

“By leveraging the RapidFort platform, our organization halved our FedRAMP certification costs and reduced time to compliance by a full three months.”

— Director of Engineering, Cybersecurity & identify management company

Get started with the RapidFort Image Bundle for AI

The RapidFort Image Bundle for AI secures the software your AI workloads run on. Model behavior, prompt injection, and training data governance need their own controls, and the bundle runs alongside the scanners, CI/CD systems, registries, and cloud platforms you already use.

For developers, adoption is a FROM line and a package index setting. Platform teams get one standard base for every training and inference team. Security and compliance teams get signed provenance and per-image evidence they can hand to auditors.

Schedule a demo to see the RapidFort Image Bundle for AI on your own CUDA, PyTorch, or vLLM images.

blog

November 4, 2026

The Software Behind the Mission

No items found.

Why resilience depends on adapting software while sustaining essential services

Roughly six months after Anthropic introduced Claude Mythos Preview through Project Glasswing, I find myself returning to a question beyond what AI can discover. Can institutions safely change the software their missions depend on? The announcement brought attention to powerful new capabilities, but the institutional response now deserves equal consideration.

Identifying a weakness, producing a correction, and protecting an essential service are related achievements. They are not the same achievement. Between them sit decisions about ownership, trust, testing, deployment, and continuity. I believe the next chapter of resilience depends on turning technical progress into changes institutions can make with confidence.

The developments across government and industry this year offer a useful way to examine how that capacity is being built. They also reveal a central challenge for institutions whose responsibilities depend on software, expertise, and maintenance they do not fully control.

What this year’s response reveals

What stands out to me is the attention being given to the work between discovery and operational protection. The announcements differ, but each provides a way to examine who will do that work, how it will be supported, and whether institutions can use the result. Together, they offer a more useful story than a sequence of increasingly capable tools.

The March Cyber Strategy for America emphasized federal modernization, critical infrastructure protection, secure supply chains, and cooperation with industry and academia. The June executive order on advanced AI directed the formation of a clearinghouse to coordinate vulnerability discovery, validation, remediation, and patch distribution. These developments placed institutional coordination alongside technical capability as part of the national response.

CISA’s revised remediation directive connected urgency more explicitly to operational context. Its prioritization considers public exposure, known exploitation, the potential for automated exploitation, and technical impact. It also requires covered agencies to establish responsibilities, validation procedures, and reporting. Those requirements apply to covered Federal Civilian Executive Branch systems, not every enterprise or national security system, but they provide a concrete example of connecting risk assessment to accountable action.

Alongside those policy developments, industry initiatives are organizing capabilities around the software itself. Project Glasswing applies frontier AI to defensive security work. Akrites provides shared incident response and disclosure coordination for critical open source software, while OSERA focuses on shared remediation, backpatching, and standards that support enterprise adoption of fixes. Lightwell extends an enterprise open source maintenance model across a broader software footprint.

GOLD EAGLE addresses another part of the problem by augmenting the existing vulnerability coordination environment, including support for validation and deduplication of reports. These are distinct efforts, not parts of a single national program. Their significance, in my reading, is the investment they represent in the capacity surrounding software. Discovery needs coordination, corrections need maintenance and validation, and institutions need a practical way to consume the result.

The next test is whether those investments make action more dependable.

The distance between a fix and a protected service

JPMorganChase’s recent executive briefing makes an important distinction between deciding to address a vulnerability and completing the work required to protect an environment. Establishing exposure, identifying owners, coordinating suppliers, testing changes, and deploying them remain separate operational responsibilities. That distinction deserves attention because it is where technical progress meets institutional reality.

A correction can be available while an organization is still determining where it applies. A change can be approved while testing remains incomplete. A supplier can deliver an update while the consuming institution still needs to establish whether it can introduce that update safely. The availability of a fix matters, but leadership also needs to understand the organization’s ability to use it.

OSERA’s October announcement offers an example of progress on part of that journey. It reported a remediation and attestation standard and patched releases covering more than 50 projects in the Spring and Java ecosystems. Those are meaningful reported outputs, although they do not establish that every affected institution has deployed the resulting updates. A strong remediation process connects these stages, providing a path from a relevant finding to a trusted correction, through validation, and into the environment where the mission runs.

This is not a reason to discount upstream progress. It is a reason to understand the work required to realize its value. The outcome that matters to the institution is a change in its exposure, achieved without sacrificing the function the software supports.

Why critical infrastructure needs more than a patch

For essential services, remediation is itself an operational change. The urgency of a vulnerability does not remove the need to understand the consequences of altering the affected system. In operational technology environments, patching must account for safety, availability, and the behavior of the physical process. Joint guidance published by CISA emphasizes coordination with operational staff and the use of isolation and compensating controls when timely patching is not feasible.

The answer is not to accept exposure indefinitely. It is to prepare better choices. An operator with tested alternatives, clear decision authority, and a credible recovery path has different options from a team encountering those questions for the first time during an urgent response. Preparation can make the difference between a difficult but manageable change and a decision constrained by the absence of alternatives.

The operating context matters. A financial application, a hospital system, and an industrial controller do not share one maintenance model. Their requirements for testing, availability, and change approval need to be understood rather than compressed into a general instruction to move faster. A credible resilience discussion must account for those differences while keeping the obligation to reduce risk intact.

For national security, this creates two connected responsibilities. We need to reduce the opportunity for compromise while preserving essential functions as systems are corrected, isolated, replaced, or recovered. Preparedness should make those responsibilities easier to reconcile through testing arrangements, maintenance planning, clear authority, and alternatives that can be used in practice.

The goal is not speed in isolation. It is the ability to make a justified change without creating an unacceptable operational consequence.

Accountability in a shared ecosystem

Preparing those choices requires clarity about what an institution controls and what it relies on others to deliver. An institution can own a mission without owning every component that supports it. Dependence does not remove accountability, but it changes what an accountable institution must prepare for.

Leaders do not need to reproduce every upstream capability internally. They do need to understand which capabilities their mission depends on, what commitments support those dependencies, and what options remain if the expected response fails.

That requires a more practical view of relationships. A supplier relationship should establish how the organization obtains support when software needs to change. A maintenance arrangement should clarify what remains supported and what happens when that support ends. A partnership should make a necessary action possible, with responsibilities that remain clear when circumstances become difficult.

This connects with an interest I have carried from earlier roles into my work today. Institutions often meet their most consequential responsibilities through relationships that extend beyond their direct authority. The quality of those relationships becomes visible when something needs to happen. In software security, someone must investigate the issue, produce and maintain a correction, validate the result, and bring it into the relevant environment.

Institutions should also examine what they help sustain. Akrites was established to provide coordinated response and disclosure support for critical open source software, working with upstream maintainers. Its announced commitments include helping extend remediation support to critical infrastructure. That direction recognizes the need to accompany additional findings with the capacity to investigate and act on them.

Contribution can include engineering effort, maintenance support, responsible disclosure, validation expertise, or resources that help shared work continue. That support should reflect what maintainers need and have the capacity to take on, rather than creating additional demands without the resources to address them. Creating additional work without usable support is not the same as strengthening the ecosystem. The opportunity is to sustain capabilities that serve multiple institutions without expecting every consumer to recreate them independently.

The next frontier is the capacity to change

The capability I would prioritize next is the ability to update, replace, isolate, or recover a software dependency while preserving the essential function it supports. That work begins before an emergency. Institutions can examine whether required dependencies have credible maintenance paths, whether supported alternatives exist, and whether changes can be tested without unreasonable delay.

They can also question which components remain in the environment without serving a necessary purpose. The objective is not fewer components at any cost. It is software that is easier to understand, maintain, and change responsibly. Reducing unnecessary exposure and strengthening maintenance capacity should support the same operational goal, giving institutions better options when circumstances change.

Institutions do not need complete control of the software ecosystem or the ability to maintain every dependency independently. They need a clearer understanding of their dependencies, credible support around them, and practical options when those dependencies must change.

Those options also need to reach organizations with different levels of capacity. The June executive order explicitly recognizes access to defensive capabilities for organizations such as rural hospitals, community banks, and local utilities. That is an important part of the national resilience discussion. Shared capabilities fulfill their purpose when the institutions that need them can use them, not merely when those capabilities exist.

Build choices before they are urgently needed

Progress should be measured by whether institutions have better choices when a software dependency becomes unsafe. Can they obtain a trusted correction? Move to a supported alternative? Isolate the affected function? Recover while preserving the service people depend on?

Building those choices requires sustained technical work and relationships with clear responsibilities. It gives government, industry, academia, and the open source community a practical purpose around which to contribute. Behind that work are people responsible for services and missions that cannot simply pause while software gets fixed. Progress needs to reach them as something they can use with confidence.

I believe the next chapter of resilience will be built in the ability to change the software behind the mission while preserving the essential functions people depend on.

A SaaS Provider’s Path to GovRAMP Without OS Migration

blog

November 3, 2026

A SaaS Provider’s Path to GovRAMP Without OS Migration

Secure Base Images

How a small security team eliminated nearly all image-level CVEs while keeping developers on the Linux distribution they already run.

RapidFort Images eliminated all but three of the roughly 300 vulnerabilities in a typical container image at a SaaS provider for state and local governments during a proof of concept. The company needed that result to meet GovRAMP vulnerability remediation requirements without growing its security team or moving its developers off Ubuntu. If you lead security or engineering at a company that sells to state and local government, the tradeoffs this team worked through will look familiar. This article covers why GovRAMP put container CVEs at the center of the company’s compliance work, why it chose RapidFort over a competitor that required an OS migration, and what it has deployed so far.

At a glance

Customer	SaaS provider of revenue collection, billing, and payment software for state and local governments
Challenge	About 300 CVEs per container image, GovRAMP remediation requirements, and a small security team
Why RapidFort	Near-zero CVE images on Ubuntu, the distribution the company already runs, with no OS migration
Early result	About 300 CVEs per image down to three in the proof of concept (about 99%)

What the company does

The company builds software as a service for state and local governments, including revenue collection, billing, and payment processing. County and state agencies use its platform to run those programs, and residents use its public portal to make payments. The company runs its SaaS offering as containers on Kubernetes, across thousands of servers in its own data centers. Its growth plan includes expanding into additional states, which makes government security compliance a requirement for winning new business.

Why GovRAMP put container CVEs on the critical path

Because the company’s customers are state and local governments, FedRAMP doesn’t apply. GovRAMP fills that gap for providers serving state and local agencies, and the company’s director of information security and compliance has seen it listed in a growing number of RFPs. The company is enrolled in the GovRAMP Progressing Snapshot program, which scores providers against critical NIST 800-53 requirements, and plans to pursue Core verification next year.

Vulnerability remediation was the requirement that made the problem urgent. The company already patched its servers automatically every two weeks and pulled the latest Ubuntu LTS packages each week. Container images needed a different fix: vulnerabilities from the base layer surfaced at build time, after application teams had finished their code, and a typical image carried about 300 of them.

“We really need to get to a point where we can tell the staff, you can’t let a high or critical vulnerability go to production. That’s a government mandate. That’s a mandate I have to show.”

— Director of information security and compliance, SaaS provider for state and local governments

Asking developers to work through 300 CVEs per image, most of them in packages they never chose, wasn’t a realistic plan. The security team is small, and absorbing that volume was going to be unattainable.. The volume keeps growing as well; the director estimates the new vulnerability disclosures the team tracks have gone from about 20 a month to around 600. To meet GovRAMP, the company had to shrink the vulnerability list before it reached a developer.

Why the company chose RapidFort over an OS migration

The company’s infrastructure lead first flagged hardened container images as worth a look, and the director researched vendors in the space from there. The company evaluated RapidFort and one competitor, and three factors decided the choice.

The company stays on Ubuntu. The competitor required the company to move its images to a different base distribution. The director heard that the migration would be easy, but the development teams were already rewriting a large legacy application and moving it to a public cloud. That application is a data-heavy monolith where small platform changes tend to cause outsized problems, so an OS change would have added risk to projects already in flight.

“Why are you throwing extra risk and change into this when I didn’t have to?”

— Director of information security and compliance, SaaS provider for state and local governments

The company saw the reduction on its own distribution. RapidFort showed the vulnerability count of a standard Ubuntu image next to the matching curated Ubuntu image, so the director could judge the result on the distribution the company already runs. For the criteria that matter when you compare vendors, see the guide on how to evaluate near-zero CVE images.

The company gets a path to distroless without building it in-house. The team had planned a future project to investigate distroless containers. RapidFort can build custom distroless versions of the company’s images for its specific applications, which takes that project off the internal roadmap.

What the company deployed

The company purchased a bundle of RapidFort Images, which covers its priority workloads within this year’s budget. Curated Images are running in a limited set of applications carried over from the proof of concept, and the director expects broader production use within the next few months.

For developers, adopting a RapidFort Image means changing the base image their Dockerfiles reference. Application code and the rest of the build stay the same.

# Before
FROM ubuntu:22.04

# After
FROM quay.io/rfcurated/rfubu:22.04-scratch-rfcurated

The company is keeping its automated patching process and will align its cadence with RapidFort’s image updates. A container release can spend several weeks in testing and non-production environments, so the team will pin a specific RapidFort Image version to each deployment. That way, the image that passes testing is the image that ships, and working out that pinning workflow is part of the kickoff project.

Early results: from about 300 container CVEs to three

The company is early in its rollout, so the results below come from the proof of concept and the decisions it made possible. Each one maps to a problem the company brought to the evaluation.

About 300 CVEs per image dropped to three. In the proof of concept, RapidFort Images eliminated about 99% of the vulnerabilities in a typical container image (297 of 300). The base-layer CVEs that used to surface at build time are now handled upstream, because RapidFort continuously patches the curated images.

A remediation list sized for the team the company has. With three CVEs per image, the remaining work fits a few hours of developer time and a small security team, without a dedicated remediation staff. The director doesn’t measure the value in hours saved, since the company never would have hired the team needed to triage 300 CVEs per image. The value is that GovRAMP compliance is now within reach of the people already on staff.

“What it is allowing us to do is to move into an environment where we can become GovRAMP compliant without having to devote a whole lot more resources to it.”

— Director of information security and compliance, SaaS provider for state and local governments

No OS migration in the middle of a rewrite. Because RapidFort Images support Ubuntu, developers kept their distribution and their tooling, and the security project added no work to the application rewrite or the cloud migration.

A clear number for leadership. The director brought the proof-of-concept result to the company’s CTO and framed the decision plainly: meet the GovRAMP requirement with more people or with tooling. The drop from about 300 CVEs per image to three was enough to win approval.

The measured results so far come from the proof of concept. Production numbers across the full image estate will follow as the rollout continues.

Meeting GovRAMP on the distribution you already run

The company needed to show that high and critical vulnerabilities don’t reach production, with a small security team and container images carrying about 300 CVEs each. It chose RapidFort because RapidFort Images eliminated nearly all of those CVEs on Ubuntu, while the competitor it evaluated required an OS migration in the middle of an application rewrite. The proof of concept brought each image down to three CVEs, which won leadership approval and put GovRAMP within reach of the team the company has today.

If your team faces a GovRAMP, FedRAMP, or similar remediation deadline, schedule a demo to see how RapidFort Images could work for your team.

RapidFort and GitLab Partner for Hardened Self-Managed Deployments

blog

November 3, 2026

RapidFort and GitLab Partner for Hardened Self-Managed Deployments

No items found.

Near-zero CVE GitLab images, open-source flexibility, and audit-ready evidence help regulated organizations strengthen security without changing how their teams build and ship.

Your software supply chain depends on the infrastructure that builds, tests, and delivers your applications. That infrastructure needs the same security attention as the software moving through it.

For organizations running GitLab Self-Managed, this includes the container images used to deploy GitLab itself. Vulnerable packages, unnecessary components, and configuration gaps in those images can introduce exposure into a platform central to software delivery.

The RapidFort strategic partnership with GitLab addresses this foundation. Together, we are delivering hardened container images for regulated GitLab Self-Managed deployments, helping organizations reduce vulnerabilities, simplify security preparation, and maintain the flexibility of genuinely open-source software.

The goal is practical: make hardened GitLab deployments easier to adopt and sustain within the environments customers already operate.

Harden GitLab without rebuilding your environment

Security improvements are easier to put into practice when they fit existing operations.

RapidFort curated GitLab images retain GitLab’s existing functionality, version tags, and configuration surface. Teams can adopt hardened images without changing application code or migrating to a proprietary operating system.

That flexibility matters for organizations with established Linux standards, operational tooling, and deployment requirements. A security initiative should support those investments while giving teams a stronger foundation.

The GitLab offering is backed by the RapidFort Image Catalog, which spans every major Linux distribution. This broader approach gives organizations a path to standardize on hardened open-source images across their software environments while preserving distribution choice.

Start with patched images, then reduce the attack surface

RapidFort replaces vulnerable images with minimal, continuously patched alternatives. This reduces exposure at the source and the remediation work passed downstream to security and engineering teams.

Curated GitLab images are updated daily as upstream fixes become available. Published remediation SLAs are seven calendar days for Critical and High severity CVEs, 21 days for Medium severity CVEs, and 28 days for Low severity CVEs, measured from the availability of an upstream patch.

Patching is one layer of protection. Deploying minimal images provides another.

Minimal image variants remove unused packages, shells, and debugging utilities, reducing image size and the components available to an attacker. Organizations can select the appropriate variant for their operational requirements, combining a near-zero CVE posture with a smaller attack surface.

This combination is central to the RapidFort model with minimal, trusted, patched software.

Establish a golden image pipeline for GitLab

For regulated organizations, consistency is as important as the security of any individual image.

The partnership supports a golden image pipeline: a centrally governed, hardened source of GitLab images that moves through the customer’s build, security scanning, and deployment stages.

This gives platform and security teams a common foundation for managing image selection, patching expectations, and supporting evidence. It also helps reduce the repeated effort of preparing and assessing.

Onward and Upward!

Read the full announcement on RapidFort hardened container images for GitLab Self-Managed deployments.

How to Cut Container CVE Remediation from Months to 48 hours

blog

October 29, 2026

How to Cut Container CVE Remediation from Months to 48 hours

No items found.

A financial services team facing 5,286 container vulnerabilities got an estimate of three months and five to six engineers to clear them. They finished in 48 hours, with three vulnerabilities left that had no fix available yet. They got there in three steps: runtime profiling to close findings that couldn't affect them, drop-in curated images to replace inherited base layers, and removal of packages the application never loaded. This article walks through that container CVE remediation process, how CISA's BOD 26-04 changes which findings you fix first, and how to run the process on every build so the backlog doesn't return.

The examples come from RapidFort's work with a couple hundred customers preparing for FedRAMP, CMMC 2.0, and CRA compliance, as presented in our webinar, Best Practices for Software Supply Chain Security webinar.

Why container vulnerability backlogs keep growing

Most of the code in your containers came from someone else. Base OS layers, OS packages, language runtimes such as Python, Node, and Java, and their transitive dependencies sit underneath your application binaries. In a typical image, first-party code is 10% or less of what you ship, and open source components appear in 96% of commercial codebases.

Every inherited package multiplies across your estate. A base image with 100 CVEs, used by 100 services, produces 10,000 scanner findings from a single root cause. Scanners report each one because they check whether a vulnerable package exists in the image. They don't check whether that package loads or executes.

Patching those findings by hand has no finish line. In RapidFort customer environments, a set of eight freshly patched containers now accumulates a couple hundred new findings within a week. For engineering leaders, that makes vulnerability work a standing drain on roadmap capacity. The team in this article estimated a full quarter for five or six engineers, with a real risk that package upgrades would break the application.

Moving to a cleaner base image from a different Linux distribution creates its own problem. Your developers inherit a new package manager and new Dockerfile conventions, and a security fix turns into a migration project that stalls on adoption.

How BOD 26-04 changes which CVEs you fix first

Severity-first triage works through criticals within seven days and highs within 30, in CVSS order. CISA's Binding Operational Directive 26-04 sets remediation deadlines by four factors instead:

Exposure: Is the affected asset reachable from the internet?
KEV status: Is the CVE listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning attackers have exploited it in real incidents?
Automatability: Can an attacker exploit it without manual steps?
Technical impact: Would a successful exploit give an attacker control of the application or its data?

Those answers set the clock. An exposed KEV gets a 24-hour window. An exposed, automatable CVE with high technical impact gets three days, even when its CVSS rating is low. A critical that is unexposed, outside the KEV catalog, but is automatable gets 60 days. BOD 26-04 is expected to become a FedRAMP 20x requirement in December 2026.

For a CISO, this means a backlog sorted by CVSS no longer reflects real exposure, and a count of open criticals tells your board and auditors little. Each finding needs runtime evidence: whether the package loads, whether the vulnerable code runs in your configuration, and whether the workload is exposed. RapidFort's BOD 26-04 dashboard tracks those clocks per CVE; read more in Turning CISA's BOD 26-04 into live clocks for critical infrastructure.

That evidence shrinks most backlogs. Sysdig reported that 85% of critical and high vulnerabilities with an available fix sat in packages that weren't loaded at runtime, and JFrog found that 78% of CVEs across 200 popular Docker Hub images weren't exploitable in practice.

Not-affected decisions also have to hold up in an audit. FedRAMP and CMMC reviewers expect a plan of action and milestones (POA&M) with a justification for every exception. RapidFort records each not-affected determination in VEX format with a written summary and links to the NVD entry. For example, a glibc CVE that affects only IBM Power10 processors is marked not affected on an AMD64 image, with the architecture mismatch documented. A dedicated team of 50 RapidFort engineers reviews these determinations alongside multi-scanner comparisons.

How one team cleared 5,286 vulnerabilities in 48 hours

The customer needed zero critical and high vulnerabilities before deploying into a large financial institution. They worked through three steps, each one shrinking what the next had to handle.

Step 1: Profile the application at runtime

The team deployed the RapidFort Profiler in their QA environment to generate a runtime bill of materials (RBOM®), a record of the packages and files that actually load and execute, alongside the standard SBOM. Profiling showed that 1,700 of the 5,286 findings couldn't affect their deployment. Those tickets closed with VEX justifications attached, with no engineering work required.

Step 2: Replace base images with drop-in curated images

That left 3,586 vulnerabilities. Instead of upgrading packages image by image, the team replaced each base image with a RapidFort Curated Images equivalent on the same distribution and version, including Ubuntu 20.04 and Alpine 3.20. The operating system, package manager, and version numbers stayed the same, so developers kept their Dockerfiles. The rebuild took about 90 minutes and brought the count to roughly 500.

The same pattern holds in smaller estates. On one eight-container deployment, replacing a Docker Hub MongoDB image cut its findings from 155 to three, and rebuilding a Node application on a curated Ubuntu Jammy base cut 521 findings to nine. Across all eight containers, the total fell from 1,661 to 24 with no library changes.

Step 3: Remove what the application never loads

Most of the remaining 500 findings came from third-party packages installed on top of the base images. Profiling surfaced a Bluetooth driver package carrying 125 vulnerabilities in an application that never used Bluetooth. The RapidFort Optimizer removed the packages the RBOM® showed as unused, which shrank the image from 1.8 GB to 262 MB and left three vulnerabilities with no fix available yet.

Size reductions of 60% to 80% are typical for Python, Node, and Java images. Go and Rust images, and images already built on distroless or scratch bases, see about 30%. Removing unused shells, package managers, and build tools also takes away the utilities an attacker would use to move laterally after gaining access to a container.

How to run container CVE remediation on every build

A one-time cleanup starts decaying as soon as new CVEs are published. The team above keeps its count near zero by running all three steps in its CI/CD pipeline:

Profile in QA. Install the RapidFort Helm chart, which deploys a DaemonSet to your Kubernetes QA cluster. Run at least one full QA test cycle, then leave the profiler running so it keeps learning.
```
helm install rfruntime oci://quay.io/rapidfort/runtime \
  --namespace rapidfort \
  --set profile.enabled=true \
  --wait
```
Mirror curated images into your registry. Pull same-distribution curated images into your private registry so builds pick them up without developer changes. The images are patched daily, signed with Sigstore Cosign, and ship with SLSA attestations. You can verify the signature and re-sign with your own key.
Apply the optimization profile at build time. Before each build, take a snapshot of the current profile so the build strips components the application hasn't used.
Record not-affected decisions in VEX. Ship the VEX file with the image so auditors and downstream scanners see the same justifications your team does.

The profile combines behavior from every node in the cluster where the application runs. When a new code path appears, the profile updates and the next build keeps that package. For serverless workloads where you can't install a DaemonSet, the profiler runs inside the container in your staging environment. Profiling runs only in QA or staging and never ships to production.

Profiling depends on test coverage. A code path your tests never exercise, such as a quarterly batch job or a rarely triggered error handler, can end up on the removal list unless the profiler detects it. RapidFort supplements observed execution with memory-allocation and dependency analysis to catch infrequent paths, custom hardening profile files, and a thorough QA cycle remains your best protection. Review the removal list for rarely run functions before your first optimized release.

Four numbers to pull from your backlog this week

You can size the opportunity with data you already have:

The share of your last scan's findings that came from first-party code versus inherited base, OS, and framework layers.
How your backlog order changes when you sort by exposure, KEV status, and reachability instead of CVSS.
How many findings in last quarter's reports were CVEs your team had already closed once.
How many distinct base images your teams pull, and who approved each one.

If most findings are inherited, recurring, and unreachable, the three-step process above will return more engineering time than any amount of manual patching.

George Manuelian, RapidFort's Chief Strategy Officer, walks through each step with live dashboard examples and audience Q&A on RBOM accuracy, serverless profiling, and BOD 26-04 in the full session. Watch Best Practices for Software Supply Chain Security on demand

Shrink your Container Attack Surface in the AI Coding Era

blog

October 29, 2026

Shrink your Container Attack Surface in the AI Coding Era

No items found.

A RapidFort customer preparing a deployment for a large financial institution found a Bluetooth driver package carrying 125 vulnerabilities in an application that never used Bluetooth. No one on the team knew it was there. Removing that package and every other component the application never loaded shrank the image from 1.8 GB to 262 MB. As AI assistants write more of your code, packages like that Bluetooth driver pile up faster, and each one adds to your container attack surface. This article explains why unused components carry more risk now, which leftover tools attackers use first, and how to find and strip unused components from your images on every build.

How AI-assisted development grows your container images

Ask an engineer which Python version a service runs or whether it needs a particular system package, and a common answer today is that they'd have to ask the AI assistant that wrote the code. AI assistants now generate a large share of new code at many organizations. In fact, for about a quarter of Y Combinator startups, 95% of their code base was written by AI. Each time a developer changes a prompt, the assistant can add new libraries to satisfy the request. It rarely goes back to remove the ones the previous version needed.

Those additions land on top of a stack that was already mostly inherited. Base OS layers, OS packages, language runtimes, and their transitive dependencies typically make up 90% or more of what a container ships. When nobody tracks why each package is there, unused components stay in the image indefinitely and get copied into every service built from it.

For a VP of Engineering, this shows up as images nobody can fully explain and vulnerability findings that return every quarter. For a CISO, it means the software you're accountable for includes components no one chose, reviewed, or needs.

Why AI-driven vulnerability discovery raises the cost of unused code

AI models are also getting better at finding vulnerabilities in the code you ship. Anthropic's Claude Mythos Preview, for example, is being used by a limited set of organizations through Project Glasswing. In RapidFort customer environments, a set of eight freshly patched containers now accumulates a couple hundred new findings within a week.

Every package in an image is code that a person or a model can search for flaws. A package the application never loads still counts, because an attacker who gains a foothold in the container can call it. Removing it takes that code out of the search entirely: there is nothing left to scan, patch, or exploit.

Smaller images also make multi-step attacks harder. Attackers often chain several vulnerabilities to move from initial access to control of an application. Each component you remove is a link that chain can no longer use. Removal also ends recurring work, because a CVE in a package you've deleted can't reappear in next quarter's report.

What attackers use when you leave it in the image

NIST's container security guidance treats patching and removing unnecessary components as two separate controls. Many teams stop after the first one. The components most often left behind in production images include:

Shells and common utilities such as curl and wget
Package managers such as apt, apk, pip, and npm
Compilers and build tools left over from the build stage
Libraries the application never loads
Default accounts, sample files, and example configurations

Each of these gives an attacker something to work with after they get in. A package manager lets them install their own malware. A shell and a networking utility let them open a tunnel and move data out. Without those tools, an attacker who reaches the container has few ways to move laterally, and bringing their own tooling into a locked-down image is much harder.

The same reasoning applies to the tools you pull into your pipeline. Developer and security tools downloaded from public registries have themselves been compromised to steal credentials. Verifying what enters your registry and removing what you don't use address the same problem from two directions.

How to find and remove unused components on every build

You can't remove components safely until you know which ones run. A software bill of materials (SBOM) lists everything in an image. A runtime bill of materials (RBOM®) records what actually loads and executes. The gap between the two is what you can remove.

That gap is usually large. In one NGINX image, profiling found that 47 of 152 packages were in use. The other 105, about 69%, never loaded, because most deployments use only a few of NGINX's proxy and load-balancing functions.

The RapidFort workflow runs in three stages:

Profile in QA. Install the RapidFort Helm chart, which deploys a DaemonSet to your Kubernetes QA cluster and generates an SBOM and RBOM® for each image. Run at least one full QA test cycle.
```
helm install rfruntime oci://quay.io/rapidfort/runtime \
  --namespace rapidfort \
  --set profile.enabled=true \
  --wait
```
Review what's unused. The RapidFort dashboard shows each image's used and unused packages, down to the file level. Save your selections as an optimization profile.
Apply the profile at build time. The RapidFort Optimizer strips the unused components on every build, so packages an AI assistant adds and later abandons don't reach production.

The profile keeps learning after the first run. It combines behavior across every node in the cluster where the application runs, and when a new code path appears, the next build keeps the package that path needs. That matters when AI-generated changes ship often: the profile follows what the code does now, instead of what someone documented months ago.

Size reductions of 60% to 80% are typical for Python, Node, and Java images. Go and Rust images, and images already built on distroless or scratch bases, see about 30%. Smaller images also cost less to store and pull.

Where profiling needs your attention

Profiling depends on test coverage. A code path your QA suite never exercises, such as a quarterly batch job or a rarely triggered error handler, can land on the removal list unless the profiler detects it another way. RapidFort supplements observed execution with memory-allocation and dependency analysis to catch infrequent paths, custom hardening profile files, and a thorough QA cycle remains your best protection. Review the removal list for rarely run functions before your first optimized release.

Removal also has limits. In the Bluetooth example, the optimized image still had three vulnerabilities with no fix available yet. Pair optimization with RapidFort Curated Images for the base layers and exploitability-based prioritization for what remains, as covered in How to cut container CVE remediation from months to 48 hours.

Three questions to bring to your next security review

You can gauge how much unused code your images carry with information your teams already have:

For your five most-deployed images, can the owning team list every package and explain why it's there?
How many CVEs in last quarter's reports had already been closed once before?
Which production images still include a shell, a package manager, or build tools?

If the answers are "no," "many," and "most," unused components are a large part of your container attack surface, and removing them will cut both risk and recurring patch work.

Learn how the RapidFort Optimizer removes unused components from your container images

Recent Security Incidents and How to Reduce Open Source Risk

blog

October 26, 2026

Recent Security Incidents and How to Reduce Open Source Risk

No items found.

PHP2Shell, LiteLLM, React, Node.js, eMudhra, GitLab, and PyTorch reveal different paths into the software supply chain

A vulnerable PHP runtime can expose a website before its application code runs. A compromised AI gateway release can steal the credentials it needs to operate. An outdated certificate bundle can undermine an otherwise encrypted connection. October’s security disclosures show how much enterprise exposure sits inside the open source software and trust infrastructure that applications inherit.

Most of the events below emerged during October 19–25, with the related Next.js and React update released October 14. They include confirmed software vulnerabilities, a malicious release, a certificate authority failure, and a research demonstration. Those distinctions matter because each requires a different response.

RapidFort starts with image replacement: deploy patched near-zero CVE images and trusted libraries containing the required fixes, then profile execution and remove unnecessary components to reduce the attack surface. Continuous runtime monitoring helps teams track changes after deployment. For the CVE-bearing software covered here, RapidFort provides patches. Teams easily apply those fixes to the actual component in use, including dependencies installed above the base image. Over 200 RapidFort customers have been able to quickly protect themselves by deploying RapidFort Images.

The exploitation scenarios below are illustrative examples based on the disclosed conditions. They are not claims that these specific attacks occurred.

How does PHP2Shell expose the runtime beneath the website?

PHP’s October 21 security release addressed CVE-2026-109618 and CVE-2026-109619. One involves corruption during cleanup after an out-of-memory condition; the other involves request-owned state surviving after its memory has been freed and being reused by a later request. Both can allow unauthenticated remote code execution. PHP identified web-serving installations as at risk, with demonstrated exploitation before application code runs in mod_php. (PHP security advisories and October 2026 releases)

This reaches beyond images named php. WordPress, Drupal, FrankenPHP, and other PHP-based application images can inherit the vulnerable runtime. Updating a content management system does not necessarily update PHP inside its container. Upstream fixes shipped in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. RapidFort provides these patched images and goes beyond by also including fixes in php:8.1.34 along with important variations of each of these versions. (PHP security advisories and October 2026 releases)

What are Illustrative examples of PHP2Shell exploitation scenarios?

A company updates its WordPress plugins but continues running an older container with vulnerable PHP. An attacker sends crafted requests to the public site and exploits the underlying runtime. If successful, execution with the web process’s permissions could expose application configuration and database credentials.

How does RapidFort address PHP2Shell exploitations?

Replace the affected runtime or application image with a RapidFort Image containing the PHP patches, then rebuild and redeploy. Confirm that every serving replica uses the patched artifact. Runtime profiling and hardening can remove unused components that would otherwise add exposure, while monitoring supports continued visibility. Hardening complements the PHP patch; required vulnerable PHP code must be fixed. RapidFort has also made available patched images for Drupal, Dunglas/frankenphp, Moodle, and WordPress.

How does LiteLLM show how an authentic release channel is able to distribute malware?

On October 21, attackers compromised LiteLLM’s release pipeline and published malicious version 1.107.0 artifacts to PyPI and container registries. The release contained credential-stealing malware and remote-code execution tools. Affected container tags included v1.107.0, latest, main-latest, and main-stable during the incident window. This was a malicious distribution event, without a CVE identified in the incident advisory. (LiteLLM affected artifacts and incident response)

LiteLLM’s October 23 investigation traced the attack to an exposed Agent Platform master key that had not been revoked. The attacker obtained GitHub tokens, gained organization-level access, and redirected release builds to an attacker-controlled repository. The investigation superseded earlier theories about the attack chain. (LiteLLM canonical attack-chain investigation)

What are Illustrative examples of LiteLLM exploitation scenarios?

An organization automatically deploys the latest LiteLLM gateway image. During the compromise window, that update brings malware into a service holding AI provider keys and cloud credentials. The stolen secrets could then be used against services outside the container.

How does RapidFort help mitigate these LiteLLM exploitations?

Start from verified clean artifacts and use RapidFort Curated Libraries and independently malware-scanned images to reduce the chance that compromised dependencies enter a build. A clean base image cannot protect an application that later installs a malicious package, so the entire dependency path matters. Specific detection of this payload should be validated rather than assumed. If compromised artifacts run, replacing them must be accompanied by credential revocation, rotation, and investigation; no image patch can recover a stolen secret.

How do the React framework vulnerabilities reach application dependencies?

The October 14 Next.js update addressed two critical remote code execution issues. GHSA-673q-mjm6-r5xr concerns use cache functions returning typed arrays, with related upstream React advisory GHSA-xqc2-xf4c-x3h3. The second, CVE-2026-96889, concerns SVG processing through an upstream image library on glibc-based Linux. The update also addressed a high-severity Server Actions denial-of-service issue. (Next.js security update for upstream vulnerabilities)

Next.js released fixes in 15.5.28 and 16.4.1. The cache advisory did not list a CVE when reviewed. These issues should be tracked separately from Node.js TLS flaws, and exposure depends on the application’s framework version, dependencies, and features. (Next.js security update for upstream vulnerabilities)

What are illustrative examples of React exploitation scenarios?

A Next.js application processes attacker-controlled SVG content through an affected image-processing path. A crafted image triggers memory corruption in the vulnerable library. A successful exploit could execute within the application process and access data available to it.

How does RapidFort address these React exploitations?

RapidFort supplies patches for supported versions of CVE-bearing components, including the affected image-processing software. Apply the fixed component wherever the application obtains it, then rebuild. For the separately tracked cache issue, incorporate the patched Next.js and React dependencies identified by the upstream advisories. A curated Node.js base image secures the runtime it supplies; application-installed packages still need their own fixes. Profiling and hardening can further reduce unnecessary software around the application.

How does Node runtime combine decompression risk with TLS validation failures?

Node.js’s October 21 release included CVE-2026-111497, a Brotli decoder out-of-bounds write that can cause crashes, memory disclosure, or remote code execution when applications decompress attacker-controlled data. It also addressed TLS hostname-verification flaws: CVE-2026-105483 and CVE-2026-106069, involving unusual representations of IP addresses. (Node.js October 21 security releases)

The Brotli issue and CVE-2026-106069 affect Node.js 22.x, 24.x, and 26.x; CVE-2026-105483 affects 24.x and 26.x. A related medium-severity TLS issue, CVE-2026-106072, also concerns noncanonical IP spellings. The exact connection path and platform determine whether a bypass is reachable. (Node.js October 21 security releases)

What are illustrative examples of Node runtime with TLS validation exploitation scenarios?

A Node.js ingestion service accepts compressed external data. An attacker supplies malformed Brotli content that reaches the vulnerable decoder. Separately, a service using an affected TLS path could accept a certificate that does not correctly authenticate its destination when unusual IP notation is involved.

How does RapidFort fix the Node runtime with TLS validation exploitations?

Replace affected Node.js runtimes with RapidFort Curated Images containing the patches, rebuild dependent applications, and redeploy. Check for additional runtimes bundled inside applications so an updated base image does not leave another vulnerable copy behind. Hardening reduces unused supporting software; the decoder and TLS fixes address the flaws in code the service still needs.

How do eMudhra weak keys undermine certificate trust?

On October 20, Google disclosed compromised private keys associated with eight eMudhra intermediate CA certificates. Insufficient randomness made the keys recoverable and enabled forged HTTPS certificates against clients that still trusted the affected authorities. This was a certificate trust failure rather than a single CVE-bearing package flaw. (Google response to compromised eMudhra intermediate CAs)

Browsers can distribute emergency blocks, but containerized applications may use OS certificate bundles, language-specific stores, or embedded trust data. Google reported that its Certificate Transparency enforcement limited opportunities to use fraudulent certificates against protected clients. That protection should not be assumed for every server-side client. (Google response to compromised eMudhra intermediate CAs)

What are illustrative examples of eMudhra weak keys that undermine certificate trust exploitation scenarios?

An attacker able to intercept a service’s network traffic presents a forged certificate chaining to an affected CA. A client retaining the vulnerable trust chain and lacking effective blocking could accept the connection, allowing interception of credentials or data.

How does RapidFort help mitigate eMudhra weak keys that undermine certificate trust exploitations?

Use updated RapidFort Images and verify that their OS and application trust stores remove or distrust the compromised chains. Rebuild applications that ship independent certificate bundles. Because this incident has no single CVE, its remediation requires explicit trust-store validation in addition to ordinary vulnerability patching. Organizations serving certificates under affected hierarchies must also replace those certificates as required; container updates cannot perform that operational step.

How does GitLab place the software delivery system at risk?

GitLab’s October 21 critical release fixed CVE-2026-110264, a CVSS 10.0 integer overflow in regular-expression compilation. Under certain conditions, a crafted expression could let an unauthenticated attacker execute code on a GitLab server. The issue affects Community and Enterprise Editions across multiple release lines. (GitLab October 21 critical patch release)

Fixed versions include 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. GitLab stated that GitLab.com was patched and urged self-managed installations to upgrade. Teams should assess their server application images, including gitlab/gitlab-ce and gitlab/gitlab-ee. (GitLab October 21 critical patch release)

What are illustrative examples of Gitlab placing software delivery systems at risk?

A self-managed GitLab instance remains exposed while its upgrade awaits a maintenance window. An attacker reaches the vulnerable compilation path and gains server-side execution. Depending on permissions and configuration, that foothold could expose source repositories or credentials and provide an opportunity to tamper with future releases.

How does RapidFort help to mitigate the issue of Gitlab placing software delivery systems at risk?

Deploy the patched GitLab application components supplied through RapidFort remediation coverage for supported versions, following GitLab’s required upgrade path. The fix must reach GitLab’s vulnerable component; replacing an underlying Linux base alone is insufficient. Runtime profiling and hardening reduce unnecessary tools around the service. If exploitation is suspected, investigate repository integrity, tokens, and release artifacts alongside the upgrade.

What is PyTorch research that raises the question about trusted training code?

On October 20, researcher Elon Litman described a PyTorch backward-pass technique in which a crafted loss term reports zero while influencing gradients and driving computation through model weights. The demonstration exploits a mismatch between floating-point evaluation and automatic differentiation. (Elon Litman backward-pass research)

This should be described as research, not a confirmed production compromise or vendor-validated host-level remote code execution vulnerability. No confirmed CVE was identified for this specific technique. The threat model requires attacker-influenced training logic, such as a malicious regularization dependency. (Elon Litman backward-pass research)

What are illustrative examples of trusted training code risks raised by PyTorch?

An ML team adds an unfamiliar training optimization package. Its loss contribution appears harmless in dashboards but manipulates gradients during fine-tuning. Training metrics alone may fail to reveal the unwanted computation or weight changes. This scenario does not establish a container escape or operating-system takeover.

Reduce exposure before the next disclosure

These events require action at different layers. PHP and Node.js need patched runtimes. Next.js and GitLab require fixes inside the application stack. LiteLLM requires clean artifacts and credential recovery. eMudhra requires trust-store changes. PyTorch’s research case calls for scrutiny of the code shaping training behavior.

RapidFort starts by replacing vulnerable software with patched near-zero CVE images and trusted libraries. Runtime profiling then identifies what applications actually execute so teams can remove unused components, and continuous monitoring helps track subsequent changes. (RapidFort Platform Capabilities, RapidFort Curated Libraries)

For security and platform teams, the practical goal is to close the gap between a published fix and the software serving production traffic. Check running image digests, rebuild the dependencies above the base image, and confirm that the replacement reached every affected workload. A patched artifact in a registry only reduces production exposure once it is deployed.

Request RapidFort access at https://www.rapidfort.com/request-access to identify affected images and plan replacement with patched, curated alternatives.

200+ RapidFort Customers Protected From PHP2Shell, eMudhra and GitLab Flaws

blog

October 26, 2026

200+ RapidFort Customers Protected From PHP2Shell, eMudhra and GitLab Flaws

No items found.

Curated Images subscribers include leading AI companies, Fortune 500 security and networking vendors, and several of the top 20 U.S. financial institutions

RapidFort, the software supply chain security platform, today announced that more than 200 organizations subscribed to RapidFort Curated Images are protected against three of October's most serious open-source security events: the PHP2Shell remote code execution flaws, the eMudhra certificate authority key compromise, and a maximum-severity GitLab vulnerability. Customers include some of the world's largest AI companies, Fortune 500 security and networking companies, and a few of the top 20 U.S. financial institutions. Beyond its enterprise customers, RapidFort is also protecting public sector customers and partners.

A week of critical disclosures

PHP2Shell (CVE-2026-109618, CVE-2026-109619). Two critical (CVSS v4.0 9.2) unauthenticated remote code execution flaws in PHP 5.4 through 8.5. Details leaked before PHP's October 21 emergency release, and exploitation attempts were reported as early as October 17.
eMudhra CA compromise. Private keys for eight eMudhra intermediate certificate authorities were found to be recoverable, allowing forged TLS certificates. Fixes landed across Go (CVE-2026-111943), Java (CVE-2026-91403) and Linux ca-certificates packages. Containers that ship stale trust stores keep trusting forged certificates until they are rebuilt.
GitLab (CVE-2026-110264). A CVSS 10.0 unauthenticated remote code execution flaw in self-managed GitLab CE/EE reaching back to version 7.0, patched October 21, just nine days after a separate 10.0 fix (CVE-2026-97229).

Fixed at the source, with no code changes

RapidFort Curated Images are near-zero CVE base and third-party container images built on the LTS distributions teams already use. RapidFort continuously patches them as upstream fixes land while keeping original version tags, so customers pick up fixes by pulling the updated image rather than rewriting code or re-baselining. Under RapidFort's standard service levels, CISA KEV-listed vulnerabilities target resolution within one calendar day and critical and high vulnerabilities within seven calendar days of an upstream patch becoming available.

RapidFort followed coordinated vulnerability disclosure practice throughout. As soon as upstream fixes were published and no longer under embargo, patched drop-in replacement images were available to all Curated Images customers across every major LTS distribution, including Ubuntu, Debian, Red Hat and Alpine. Teams pulled the fixed images straight into their existing pipelines, with no code changes and no re-baselining.

blog

October 22, 2026

Docker Hardened Images Alternatives

No items found.

In brief

The free Community tier is real: Alpine and Debian images, SBOMs, provenance and signatures, usable in production, with no CVE fix SLA.
It stops at four points: no Ubuntu or Red Hat UBI, no SLA on the free tier, FIPS and STIG only on paid tiers, and a Docker login on pulls.
Compare any alternative on the same eight criteria, and for Ubuntu or Red Hat shops start with the providers that keep those distributions.

Docker Hardened Images (DHI) became free under the Apache 2.0 license on December 17, 2025. The free Community tier covers Alpine- and Debian-based images with SBOMs, SLSA Build Level 3 provenance, OpenVEX statements and signatures, and Docker says it may be used in production. A critical CVE fix SLA, FIPS and STIG variants and customization sit on the paid Select and Enterprise tiers, and Extended Lifecycle Support is a paid add-on that requires Enterprise (October 20, 2026). This guide sets out what the free tier does and does not give you, what to compare, and how the alternatives, RapidFort included, measure on the same criteria.

What Docker Hardened Images include, free and paid

Docker's own page and FAQ list three tiers, as of October 2026. Community: the full catalog, free, with SBOMs, SLSA Build Level 3 provenance, OpenVEX and signatures, usable in production, with no CVE fix SLA. Select: starting at 5,000 US dollars per repository, adds a critical CVE SLA of under 7 days, FIPS and STIG variants and up to five customizations. Enterprise: by quote, adds unlimited customization, a hardened system packages repository and eligibility for Extended Lifecycle Support, which continues hardened updates for up to five years after upstream end of life. Images are built on Alpine and Debian, and Docker says migration is designed to be as simple as changing one line in a Dockerfile.

Where the free tier is enough, and where it stops

DHI Community is enough when your services run on Alpine or Debian, you need no contractual fix window, no FIPS or STIG variant and no customization, and a Docker login on pulls is acceptable. It stops being enough at four points. Distribution: there is no Ubuntu or Red Hat UBI; teams on those distributions would move operating systems, which means a full rebuild and test pass, and Alpine Linux is built around musl libc and busybox, so test anything that depends on the C library. SLA: the free tier has none, so a critical CVE is fixed when Docker fixes it. Compliance: FIPS and STIG variants are paid, so the price for workloads that need those variants is the Select or Enterprise price, not zero. Access: Docker's quickstart has you sign in with a Docker account (docker login dhi.io) before pulling Community images.

The eight criteria to compare

The same eight criteria apply to any hardened image provider. Base distribution and compatibility. Migration effort: drop-in or Dockerfile rewrite. CVE patch windows, with the time unit, the clock start, whether there is a separate window for CISA Known Exploited Vulnerabilities, and whether it is contractual. Catalog coverage for the images you run, counted the same way across vendors. FIPS and STIG variants and the benchmark behind them. Scanner compatibility, SBOM and VEX. Free tier terms and production rights. Pricing model, price history and vendor stability. The full explanation of each criterion is in the companion guide. Chainguard alternatives

The alternatives

RapidFort Images

RapidFort Images are built on all major LTS releases of Ubuntu, Debian and Red Hat, plus Alpine, including minor and older versions, which covers the two distributions DHI does not. They are drop-in replacements, pin-for-pin compatible with no re-baselining: the same distributions and tags, with environment variables and paths unchanged. RapidFort engineers manually patch and rebuild them, and every image is continuously patched to eliminate all CVEs for which a patch is available, with up to 99.9% CVE elimination across distroless and full images.

Patch windows: CISA KEV 1 day, Critical and High 7 days, Moderate 21 days, Low 28 days, from when a patch is available. Images are hardened against their appropriate STIG or CIS Benchmark, when available, and FIPS and standard variants are available unless an image does not need one or upstream licensing prevents it. They carry rich metadata, work with every major scanner and are registry flexible, with CycloneDX and VEX on the Full Catalog plan. The catalog holds tens of thousands of images. Plans are at rapidfort.com/pricing, including a free tier.

Chainguard

Chainguard builds its images on its own distribution, Chainguard OS. Its pricing page lists a free tier of five images that are not covered by its CVE remediation SLA and a Containers Catalog starting at 19,000 US dollars for a team of 10, with an SLA of 7 days for critical CVEs and 14 days for all others, plus a 1-day KEV SLA (October 20, 2026). Its migration guide says Dockerfiles built on Debian, Ubuntu or Red Hat UBI need their package commands adapted to apk. Chainguard alternatives

Bitnami Secure Images

Bitnami Secure Images, from Broadcom, are built on a Photon OS base. Broadcom says a portion of the catalog is free for non-production use in the latest tag only and that pricing is through sales, and it lists FIPS and STIG support (October 20, 2026).

Iron Bank

Iron Bank is a secure container image repository within Platform One that provides hardened containers for the US Department of Defense, and there is currently no cost to contributors or users. Its FAQ states it "does not authorize or approve containers at this time" and that it provides an assessment teams use to obtain their own authorization. It is built for defense programs, and pulling images requires a Registry1 account.

Google Distroless

An open source project in the GoogleContainerTools organization on GitHub whose images contain only your application and its runtime dependencies. Images are based on Debian 13 and track Debian on its standard support timeline; the repository publishes no SLA.

Building your own

In-house hardening means tracking advisories, backporting, rebuilding, testing and distributing for every base, continuously. It suits teams with few bases and dedicated staff; the fix window is whatever the team sustains.

Comparison table

As of October 20, 2026; each cell from the named vendor's own page.

Criterion	Docker Hardened Images	RapidFort	Chainguard	Iron Bank	Google Distroless
Base distributions	Alpine, Debian	Ubuntu, Debian, Red Hat (LTS releases), Alpine	Chainguard OS	UBI, Ubuntu and others	Debian-based, static
Migration	Designed as a one-line Dockerfile change (vendor)	Drop-in: same distribution and tags	Package commands change from apt or yum to apk (vendor migration guide)	Varies	Change to a distroless base
Fix windows	Critical under 7 days on paid tiers; none on Community	CISA KEV 1 day, Critical and High 7 days, Moderate 21 days, Low 28 days, from when a patch is available.	Critical 7, other 14, KEV 1 day; contractual	No formal SLA in the FAQ	No SLA published; tracks Debian
FIPS and STIG	Paid tiers only	FIPS and standard variants unless not needed or license-restricted; hardened to STIG or CIS when available	FIPS-validated and STIG-hardened images on paid plans	No FIPS at this time; baseline security settings, images not STIG'd; no approval granted	Not mentioned in the README
SBOM, provenance, VEX	SBOM, SLSA Build L3, OpenVEX, signatures on all tiers	Every major scanner; SBOM export through RapidFort Analyzer in SPDX and CycloneDX; VEX on Full Catalog	SBOMs, signatures	SBOMs (Syft)	Cosign signatures; SBOM not mentioned in the README
Free tier	Full catalog, production allowed, no SLA, login required	Free tier available	5 images, no SLA	No cost currently	Free
Paid pricing	Select from 5,000 USD per repository; Enterprise by quote	Plans at rapidfort.com/pricing	From 19,000 USD for a team of 10	n/a	n/a
End of life	ELS add-on, up to 5 more years (Enterprise)	EOL versions can be supported on request; patching covers the open source packages when an upstream fix can be backported	EOL Grace Period: updated end-of-life images for up to 6 months (pricing page)	n/a	Tracks the Debian support timeline (support policy)

How to migrate between providers without breaking builds

Change the FROM line, keep everything else, and test. If the new image keeps your distribution and tags, the change is the registry and image name and the test pass is the one you run for any base image update. If the new image changes the distribution, plan a full rebuild and regression pass and check anything that depends on glibc, locale or DNS behavior. Pin the new image by digest, scan it with your own scanner before and after the change, and enforce the approved registry at admission so no service drifts back.

Frequently asked questions

Are Docker Hardened Images really free?

The Community tier is free under Apache 2.0, including for production use, according to Docker's page. The critical CVE SLA, FIPS and STIG variants and customization are on the paid Select and Enterprise tiers, and extended lifecycle support is a paid add-on to Enterprise.

Do Docker Hardened Images support Ubuntu or Red Hat UBI?

No. Docker's page lists Alpine and Debian. Teams on Ubuntu or Red Hat would change distribution to adopt DHI; RapidFort Images keep those distributions.

Do free Docker Hardened Images come with a CVE fix SLA?

No. Docker's SLA of under 7 days for critical CVEs applies to the Select and Enterprise tiers.

Which Docker Hardened Images alternatives offer FIPS variants?

FIPS and standard variants of RapidFort Images are available unless an image does not need a FIPS variant or upstream licensing prevents one. Chainguard offers FIPS variants on paid tiers. Verify other vendors on their own pages.

Can I switch between hardened image providers without rewriting Dockerfiles?

Yes, when the new provider keeps your distribution and tags; the FROM line changes and the rest stays. When the provider uses its own operating system, expect Dockerfile changes and a full rebuild and test pass.

What happens to my images if a provider changes its free tier?

Images you have already pulled keep running, but whether they keep receiving updates depends on the provider's new terms. Minimus shut down its registry on October 22, 2026, and images pulled before that date continued to function. Mirror approved images into your own registry and keep a second provider evaluated and ready.

blog

October 22, 2026

Chainguard Alternatives

No items found.

In brief

Compare on eight criteria: base distribution, migration effort, CVE patch windows (unit, clock start, KEV window, contractual or not), catalog coverage for your images, FIPS and STIG variants, scanner compatibility with SBOM and VEX, free tier terms, and pricing model with vendor stability.
For Ubuntu, Debian and Red Hat teams that need a drop-in change, RapidFort Images keep the distribution and tags; for Alpine or Debian teams with no SLA or FIPS need, the Docker Hardened Images Community tier is free, including for production use.
Whatever you choose, scan it with your own scanner and read the patch windows in the contract documents, not the landing page.

Teams look for Chainguard alternatives for three reasons that appear in buyer forums and reviews: moving to Chainguard OS means a one-time Dockerfile refactor for base images, pricing is per image or, for the full catalog, by engineering organization size, with the catalog starting at 19,000 US dollars for a team of 10, and the free tier is up to five images per organization, while the pricing FAQ says free images are not covered under the CVE remediation SLA (Chainguard pricing page and comparison FAQ, October 20, 2026). None of those is a reason to pick any particular alternative. This guide gives the eight criteria that decide the outcome and compares seven options, RapidFort included, against them; the comparison table sets five of them side by side with Chainguard. Each vendor fact is drawn from the vendor's own page.

Why teams look for a Chainguard alternative

The reasons are specific and documented. On migration, Chainguard's own comparison FAQ says its pre-built application images and Helm charts are designed as drop-in replacements for many common Bitnami deployments, while base images require a one-time Dockerfile refactor, and its migration guide maps Debian apt commands to apk, such as apt install to apk add. Reviewers put it more bluntly: "you have to modify your Dockerfiles to work with the Wolfi OS" and "Some image [sic] were missing which complicated the process of migrating all our services" (G2 reviews). On price, the pricing page lists the Containers Catalog as licensed by the size of the engineering organization, starting at 19,000 US dollars for a team of 10, as of October 2026; engineers on Hacker News reported per-image costs in August 2025. On the free tier, the same pricing page says free images "are not covered under our CVE remediation SLA", and Chainguard reduced its free tier on November 21, 2024.

None of this makes Chainguard a poor product. It makes the evaluation a question of fit, and fit is decided on the criteria below.

Eight criteria to compare before you choose

Base distribution and compatibility

Does the provider build on the distribution you already run, or on its own? Ubuntu and Debian ship the GNU C Library, glibc; Alpine is built around musl libc. A provider that keeps your distribution keeps your compatibility; one that moves you to a new operating system means a full rebuild and test pass for every service.

Migration effort: drop-in or Dockerfile rewrite

Ask whether the FROM line changes only its registry and image name, or whether tags, users, paths, environment variables and entrypoints change too. The accurate answer is per image type, as Chainguard's FAQ shows.

CVE patch windows: unit, clock start, KEV window, contractual or not

A "7 days" statement can mean seven calendar days from upstream patch availability, seven business days from CVE publication, or a target with no contract behind it. Ask for all four terms. The CISA Known Exploited Vulnerabilities catalog lists vulnerabilities with reliable evidence of active exploitation, so a separate KEV window matters.

Catalog coverage for your images, counted the same way

Providers count differently: some count open source projects, some count version tags, some count images. Compare on the list of images you actually run, not the headline number, and check whether older versions you still depend on are covered.

FIPS and STIG variants and the evidence behind them

For regulated workloads, ask whether FIPS variants exist for your images and whether the hardening is against a named CIS Benchmark or DISA STIG. FIPS 140-3 is the US federal standard for the security requirements of cryptographic modules.

Scanner compatibility, SBOM and VEX

Run the candidate image through your own scanner before you decide. In a 2024 study of 927 Docker images, Trivy and Grype disagreed on both the number of vulnerabilities and the vulnerability IDs across the 865 images found to have vulnerabilities (IEEE SCAM 2024). Ask for SBOMs in SPDX or CycloneDX and for VEX statements on remaining findings.

Free tier terms and production rights

Ask how many images are free, whether they may run in production, whether they carry an SLA, and whether pulls require a login. Free tiers have been cut before, by more than one provider.

Pricing model, price history and vendor stability

Per image, per repository, by team size or by catalog: each model scales differently with your service count. Vendor stability is now a real criterion: Minimus shut down in October 2026, and Echo acquired Minimus's key assets.

The alternatives

RapidFort Images

RapidFort Images are drop-in replacement container images built on all major LTS releases of Ubuntu, Debian and Red Hat, plus Alpine, including minor and older versions. They are pin-for-pin compatible with no re-baselining: the same distributions and tags, with environment variables and paths unchanged, so the migration is a change of registry and image name rather than an operating system move. RapidFort engineers manually patch and rebuild them, and every image is continuously patched to eliminate all CVEs for which a patch is available, with up to 99.9% CVE elimination across distroless and full images.

Patch windows: CISA KEV 1 day, Critical and High 7 days, Moderate 21 days, Low 28 days, from when a patch is available. Images are hardened against their appropriate STIG or CIS Benchmark, when available; FIPS and standard variants are available unless an image does not need one or upstream licensing prevents it. The images carry rich metadata, work with every major scanner, and are registry flexible; CycloneDX with VEX is included on the Full Catalog plan. The catalog holds tens of thousands of images. Plans are listed at rapidfort.com/pricing, including a free tier. Support is 24x7x365 by telephone and email.

Docker Hardened Images

Docker Hardened Images (DHI) are built on Alpine and Debian, licensed under Apache 2.0, and the Community tier is free, including for production use, with SBOMs, SLSA Build Level 3 provenance, OpenVEX and signatures. The Select tier starts at 5,000 US dollars per repository and adds critical CVE fixes within 7 days under an SLA, FIPS and STIG variants and limited customization; the Enterprise tier adds unlimited customization and eligibility for Extended Lifecycle Support of up to five more years after upstream end of life. Docker describes migration as changing one line in the Dockerfile (October 20, 2026). Users report that pulls require a Docker login. Hardened Images alternatives

Bitnami Secure Images

Bitnami Secure Images are built on Photon OS, support FIPS, STIG and FedRAMP, and are sold through Broadcom; developers can access a portion of the catalog free for non-production use. In August 2025 Broadcom began archiving the public Bitnami catalog to a Bitnami Legacy location.

Iron Bank

Iron Bank is the US Department of Defense secure container image repository within Platform One, providing hardened containers for DoD use at no charge. Its own FAQ states that "Iron Bank does not authorize or approve containers at this time" and that it provides an assessment teams use to obtain their own authorization. It is built for defense programs, and pulling images requires a Registry1 account.

Google Distroless

Distroless images contain only the application and its runtime dependencies, with no package manager or shell. They are an open source project in the GoogleContainerTools organization on GitHub rather than a commercial catalog. Its support policy tracks Debian's support timeline and publishes no CVE fix window or rebuild cadence. One practitioner on Hacker News reports that Google's distroless images "do not get updated frequently enough to handle security issues".

Echo (acquirer of Minimus assets)

Echo acquired key Minimus assets in August 2026, and the Minimus registry went offline in October 2026. Echo publishes target patch times of 7 business days for Critical and High CVEs and 10 business days for Medium and Low, with commercially reasonable efforts and no separate KEV window. Pricing is per artifact or by engineering organization size, by quote. RapidFort offers free migration support to Minimus customers.

Building your own

Building hardened images in house means tracking upstream advisories, backporting fixes, rebuilding, testing and distributing images for every base you run, continuously. The cost is engineering time rather than license fees, and the patch window is whatever your team can sustain. It fits teams with a small number of bases and the staff to maintain them.

Comparison table

As of October 20, 2026; each vendor cell is from the named vendor's own page unless marked otherwise.

Criterion	RapidFort	Chainguard	Docker Hardened Images	Iron Bank	Google Distroless	Build your own
Base distributions	Ubuntu, Debian, Red Hat (LTS releases), Alpine	Chainguard OS (Wolfi)	Alpine, Debian	Varies by image	Debian 13 based, including a static image (README)	Your choice
Migration	Drop-in: same distribution and tags	Base images need a one-time Dockerfile refactor; app images and Helm charts drop-in for many Bitnami deployments (vendor FAQ)	One-line Dockerfile change (vendor page)	Varies	Dockerfile change to distroless base	None
Fix windows	CISA KEV 1 day, Critical and High 7 days, Moderate 21 days, Low 28 days, from when a patch is available.	Critical 7 days, other 14 (contractual, pricing page); KEV 1 day (compare page)	Critical within 7 days under an SLA on Select and Enterprise; Community follows upstream cadence for Docker-released patches	No SLA published (vendor FAQ)	None published (support policy)	Your own
FIPS and STIG	FIPS and standard variants; hardened to STIG or CIS when available	STIG-hardened and FIPS-validated images (vendor pricing page)	FIPS and STIG variants on paid tiers	Baseline security settings; Iron Bank does not STIG images; no approval granted (vendor FAQ)	Not stated (README)	Your own
Scanner compatibility, SBOM, VEX	Every major scanner; SBOM export through RapidFort Analyzer in SPDX and CycloneDX; VEX on Full Catalog	SBOMs, signatures (vendor page)	SBOM, OpenVEX, signatures on all tiers	SBOMs generated with Syft (vendor FAQ)	Cosign signatures; SBOM not stated (README)	Your own
Free tier	Free tier available	Up to 5 images (FAQ also describes ~50 :latest images); not covered by the CVE SLA	Full Community catalog free, including production use (vendor page); users report a login is required (Hacker News)	Free; account required (vendor FAQ)	Free	n/a
Pricing model	Plans at rapidfort.com/pricing	Per image, or full catalog by engineering org size from 19,000 USD for a team of 10	Select from 5,000 USD per repository; Enterprise by quote	Free	Free	Engineering time
Catalog	Tens of thousands of images	3,000+ projects (compare page; the pricing page also shows 1,800+)	1,000+ images (vendor page)	Over 1,000 hardened vendor and open source containers (vendor FAQ)	12 images on Debian 13 (README)	Your bases

Matching the alternative to the situation

If you run Ubuntu, Debian or Red Hat and cannot change distribution, choose a provider that keeps it; that is where drop-in replacement is real. If your services are Alpine or Debian and you need no FIPS, STIG or SLA, the DHI Community tier is free, including for production use. If you are a defense program, Iron Bank provides an assessment you can use to obtain your own authorization. If you need contractual KEV and severity windows and FIPS variants, compare the windows and the clock starts side by side, in the contract documents. And whichever you choose, scan it with your own tools before you sign.

Frequently asked questions

What is the best alternative to Chainguard?

The one that keeps your distribution, fits your patch-window and compliance requirements and survives your own scanner. For teams on Ubuntu, Debian or Red Hat that want a drop-in change, RapidFort Images keep the distribution and tags.

Is Chainguard worth the price?

It depends on whether you need what the price buys: a contractual CVE SLA, a stated 1-day KEV SLA and FIPS variants, on Chainguard OS. If you can accept the operating system move and the pricing model, it is; if you cannot, the criteria above point to the alternatives.

Do I have to change my Dockerfiles to leave Chainguard?

To leave, you change the FROM line back to a distribution image or to another provider's image. Whether anything else changes depends on how far your Dockerfiles were adapted to Chainguard OS; a provider that keeps standard distributions and tags minimizes the rest.

Which Chainguard alternatives offer FIPS images?

RapidFort provides FIPS and standard variants of RapidFort Images unless an image does not need one or upstream licensing prevents it. Docker offers FIPS variants on its paid Select and Enterprise tiers. Verify any other vendor's FIPS claim on its own page.

Which alternatives publish a KEV fix window?

RapidFort fixes CISA KEV vulnerabilities within 1 day of a patch being available. Chainguard states a 1-day KEV SLA. Docker's published SLA is for critical CVEs on paid tiers.

Can I use free hardened images in production?

Read the terms; free-tier terms differ by vendor and should be checked. Docker states that its full Community catalog is available including for production use, and its SLA applies to the Select and Enterprise tiers (as of October 2026). Chainguard's free images are not covered by its CVE SLA (as of October 2026). RapidFort offers a free tier; check its terms.

How do I verify a vendor's CVE claims before I switch?

Pull the vendor image and the upstream image it replaces, scan both with your scanner, compare counts by severity, read the SBOM and VEX statements, and check the patch windows in the contract rather than on the landing page. What is a near-zero CVE image?

Top Minimus Alternatives 2026: Hardened Container Images

blog

October 8, 2026

Top Minimus Alternatives 2026: Hardened Container Images

No items found.

Minimus is ending operations and its registry goes offline on October 22, 2026. The best replacement for most teams is RapidFort Curated Images: tens of thousands of hardened, near-zero CVE images on standard LTS distributions, FIPS-validated, STIG and CIS benchmarking, published 7/14-day remediation windows, and no-cost migration support. The other four options, Chainguard, Echo, Docker Hardened Images, and Aikido, are also compared below.

In this article: Key dates · Our recommendation · Comparison table · Platform decision · How to evaluate · The 5 alternatives · Migration steps · FAQ

Minimus shutdown: key dates

August 24, 2026. Minimus entered a maintenance period that runs until the shutdown date.
August 27, 2026. Echo announced it had acquired key Minimus assets, including technology, technical data, security integrations, and customer relationships.
October 22, 2026. The Minimus registry (reg.mini.dev) is scheduled to go offline. Images already cached on your nodes or mirrored to your own registry will keep running. Any deployment that pulls from reg.mini.dev after that point will fail. No further updates will ship.

The acquisition does not move the deadline. Minimus's notice says no further updated images will be provided. Whichever vendor you choose, you will be moving to a different set of images.

The best Minimus alternative: RapidFort Curated Images

Every option in this comparison gives you hardened images. Plus, we go beyond the image and also cover which components your workload actually runs, and the evidence your auditors ask for, all in the same platform.

For the migration itself, Curated Images make the move off Minimus straightforward:

Coverage. Tens of thousands of images spanning major versions, minor versions, and older releases. Traditional roll-forward catalogs patch only the newest release, leaving teams pinned to older versions waiting for fixes or missing them entirely. In contrast, we patch older versions as well.
No new operating system. Ubuntu, Debian, Red Hat, and Alpine, with no proprietary base. Curated Images are drop-in replacements for upstream images, pin-for-pin compatible with existing CI/CD pipelines. If you are coming from a distroless Minimus base, expect a functional test pass, since the LTS image includes components that MinimOS stripped out. That is a test cycle, not a re-baseline.
Attested compliance. Hardened to NIST 800-70, FIPS 140-3 validated, STIG and CIS benchmarking, DoD Iron Bank support, and DISA-validated OS. Supports FedRAMP, cATO, CMMC, SOC 2, PCI DSS, NIS 2, CRA, and SLSA. As of October 2025, 40 of our customers had achieved FedRAMP authorization or ATO using the platform and Curated Images.
Published remediation windows. Critical CVEs are remediated within 7 days and everything else within 14, including on older versions.
Free migration. No-cost assistance for Minimus customers and for organizations running a Minimus trial or evaluation. We inventory your Minimus usage, map it to equivalent Curated Images, and move you before October 22.

Browse Curated Images Request Minimus migration help

Minimus alternatives compared

	Foundation	Catalog size	Compliance	Beyond the image
RapidFort	Standard LTS distros: Ubuntu, Debian, Red Hat, Alpine	Tens of thousands of images, including minor and older versions	FIPS 140-3 validated, STIG and CIS benchmarked, DoD Iron Bank support, DISA-validated OS, BOD 26-04 compliant live remediation clocks	Intake, build, and runtime: vulnerability analysis, runtime profiling, automated hardening, compliance evidence, and curated open-source libraries
Chainguard	Wolfi / Chainguard OS, built from source	Not stated	FIPS variants on Chainguard's CMVP-validated provider, DISA STIG hardening	Libraries, VMs, Helm charts, and OS packages
Echo	Rebuilt from source, Echo's own artifacts	Hundreds of FIPS and STIG images	FIPS-validated, STIG-hardened	Libraries, VMs, Helm charts, and OS packages
Docker Hardened Images	Standard Debian and Alpine	1,000+ images	FIPS-validated and STIG-aligned variants on paid tiers only	Helm charts, Extended Lifecycle Support add-on
Aikido Security	Patches your existing base in place	2,000+ images	Company-level SOC 2, ISO 27001, ISO 42001; FedRAMP: implementing	Broader security platform: code, cloud, attack, and protect products

Replacing Minimus is a platform decision, not an image swap

A hardened image addresses one layer: the CVEs you inherit from the operating system and runtime before you write a line of code. (Hardened means packages patched to current fixes, configuration locked down, and the image rebuilt as new vulnerabilities appear.) That is a significant share of the total, which is why hardened images matter. It leaves three other layers untouched:

The components you never execute. A standard hardened base image cannot detect what your workload actually executes. Many container images include libraries and binaries that your application never actually uses. These unused components still introduce unnecessary vulnerabilities (CVEs) and expand your attack surface.
The libraries you add. Application dependencies from npm, PyPI, Maven, and the rest are outside the base image and need their own patched, malware-scanned supply.
The evidence you owe. SBOMs and VEX documents are the minimum. An ATO package, a FedRAMP ConMon (Continuous Monitoring) cycle, or a CMMC assessment needs benchmark results, remediation reporting, and continuously current artifacts, mapped to the framework you are certified against.

Our platform covers all three, across the lifecycle:

Intake. Curated near-zero CVE images and malware-scanned open-source libraries replace the components you would otherwise inherit.
Build. Vulnerability analysis across images, registries, and CI pipelines generates the SBOM, and unused components are removed automatically without code changes.
Runtime. Profiling records what the application actually executes, producing a runtime inventory (RBOM®) that is distinct from the SBOM's list of everything present. That inventory drives further hardening.
Across all three. Security benchmarks are compiled into audit-ready evidence for ATO, NIST, FedRAMP, CMMC, and other frameworks.

The platform continuously eliminates up to 99.9% of CVEs and up to 90% of software attack surface without code changes. Runtime profiling and component removal are optional layers; nothing about adopting Curated Images requires you to profile a workload.

When you choose a Minimus replacement, you are also deciding where the ongoing maintenance and compliance burden will rest. With an image-only vendor, nearly all of that operational work remains your responsibility.

How to evaluate a Minimus alternative

Does the catalog cover the exact versions you run? Not just latest. Check minor versions, older releases, and every tag you have pinned against your image inventory.
Is the foundation a standard distribution or a vendor operating system? A standard LTS base means your tooling carries over and you can return to upstream at any time. A vendor OS means returning to upstream is another migration.
Is compliance attested or in progress, and is the evidence generated for you? Attested means independently validated or measurably benchmarked: CMVP validation for FIPS 140-3 cryptographic modules, or published results against DISA STIG and CIS configuration baselines. "STIG-ready," "aligned," and "pursuing certification" are not the same thing. SBOM and VEX are the floor; benchmark results and remediation reporting mapped to your framework are the ceiling.
Are remediation windows published in numbers? A target you cannot see is not a commitment you can record in a POA&M.
What happens above the base image? Unused components and runtime behavior are outside any catalog's scope, and library coverage varies by vendor. Decide now who will own them.

The 5 top Minimus alternatives in 2026

1. RapidFort

RapidFort is a software supply chain security platform for containerized applications that eliminates vulnerabilities continuously across intake, build, and runtime, rather than at a single point in time. Curated Images are the intake layer: tens of thousands of near-zero CVE images on Ubuntu, Debian, Red Hat, and Alpine, continuously rebuilt, patched, and scanned, with FIPS-validated variants and STIG and CIS benchmarked images available today.

Above the image, the same platform analyzes vulnerabilities across registries and CI pipelines, profiles what a workload actually executes, removes what it does not, and compiles benchmark results into audit-ready evidence for ATO, NIST, FedRAMP, CRA, and CMMC. We provide migration support from Minimus at no cost for customers, trials, and evaluations.

2. Chainguard

Chainguard rebuilds images from source on Wolfi and Chainguard OS, its own Linux distribution. Every image ships with a signed SBOM and Sigstore signatures, remediation is covered by a contractual SLA of 7 days for critical CVEs and 14 days for other severities, FIPS variants run on Chainguard's own CMVP-validated FIPS provider for OpenSSL, and DISA STIG hardening is available. Chainguard also offers Libraries, VM images, Helm charts, and OS packages. Adopting Chainguard images means adopting Chainguard OS, and fixes ship as new builds that you receive by updating your image reference. See our RapidFort vs Chainguard comparison.

3. Echo

Echo rebuilds open-source software from source and distributes hardened artifacts as replacements for vulnerable upstream components, using AI agents to investigate vulnerabilities, develop and validate patches, and regenerate artifacts. Its portfolio covers containers, libraries, virtual machines, OS packages, Helm charts, and serverless functions.

4. Docker Hardened Images

Docker's hardened catalog became free and open source under Apache 2.0 in December 2025. The Community tier includes the full catalog of more than 1,000 images on Debian and Alpine, with SBOMs, SLSA Build Level 3 provenance, OpenVEX data, and signatures, pulled from dhi.io. A DHI Select subscription adds SLA-backed remediation of critical CVEs within 7 days, FIPS-validated and STIG-aligned variants, and limited customization. A DHI Enterprise subscription adds unlimited customization and hardened system packages, and Extended Lifecycle Support is a paid add-on that provides five additional years of coverage past upstream end-of-life.

5. Aikido Security

Aikido Images focus on high and critical issues in the base layer you already run, delivered as a pull request through the AutoFix feature. It serves 2,000+ images from docker.aikido.io, each with SBOM, VEX, and SLSA provenance, and delivers 100+ patches per day across Images and Libraries. Hardened images sit inside Aikido's broader security platform, alongside its code, cloud, attack, and protect products. Aikido holds SOC 2, ISO 27001, and ISO 42001.

How to migrate off Minimus before October 22

Inventory. List every service that uses a Minimus image, with the exact tag and digest. This list becomes your evaluation checklist.
Match. Check each entry against the candidate catalog by version, not just by name. This is where catalog depth determines how much work you inherit.
Swap and validate. Any move off a distroless base needs a functional test pass. With drop-in images on a standard distribution, that pass is short and predictable. With a source rebuild on a new vendor OS, budget for anything that was removed and anything that behaves differently.
Regenerate evidence. New images mean new SBOMs, scan results, and audit artifacts. Choose a replacement that produces them rather than leaving the assembly to you.

We will do the inventory and mapping with you at no cost. Request Minimus migration help.

Frequently asked questions

What is the best alternative to Minimus?

RapidFort Curated Images. RapidFort publishes tens of thousands of curated near-zero CVE images built on Ubuntu, Debian, Red Hat, and Alpine, hardened to NIST 800-70 and to STIG and CIS benchmarks, and FIPS 140-3 validated. They are drop-in replacements with coverage of minor and older versions, and they are part of a platform that continuously eliminates vulnerabilities, rather than a standalone catalog.

Is Minimus shutting down?

Yes. Minimus announced it is ending operations. A maintenance period began on August 24, 2026 and the Minimus registry is scheduled to shut down on October 22, 2026.

Did Echo buy Minimus?

Echo announced on August 27, 2026 that it acquired key assets from Minimus, including technology, technical data, security integrations, and customer relationships. Echo is a separate company with its own catalog. The Minimus registry still goes offline on October 22, 2026.

Is Echo the same as Minimus?

No. Echo was founded in 2025 and builds its own hardened artifacts from source. It acquired Minimus assets after Minimus decided to wind down and has said it will use Minimus's operating system work to expand its own distribution coverage. Minimus images themselves stop updating on October 22.

What happens to my Minimus images after October 22, 2026?

Copies already cached on your nodes or mirrored to your own registry will keep running. Anything that pulls from the Minimus registry at deploy time, including a pod rescheduled to a fresh node, will fail. No further patches will ship, so the known-vulnerability count on those images grows as new CVEs are disclosed. Mirror anything you depend on before the date.

Will migrating from Minimus require code or pipeline changes?

With RapidFort, no code changes and no re-baselining. Curated Images are drop-in replacements for upstream images, pin-for-pin compatible with existing CI/CD pipelines, so the pipeline change is the image reference. Plan a functional test pass when leaving a distroless base.

Which hardened image providers offer FIPS and STIG?

RapidFort provides FIPS 140-3 validated and STIG and CIS benchmarked images, with DoD Iron Bank support. Chainguard offers FIPS variants on its own validated provider with STIG hardening. Echo's images are FIPS-validated and STIG-hardened. Docker offers FIPS-validated and STIG-aligned variants on paid tiers.

How fast are new CVEs patched?

Published windows: RapidFort remediates critical CVEs within 7 days and everything else within 14, including older versions. Chainguard publishes the same 7- and 14-day windows. Docker offers a 7-day critical SLA on Select and Enterprise tiers.

Are there free hardened container images?

Yes. Docker Hardened Images Community is free under Apache 2.0. Minimus made its catalog free in its final months. RapidFort offers free community images alongside the subscription Curated Images catalog. Docker's free tier excludes FIPS, STIG, and SLA commitments.

Wenn Angriffe Mit Maschinen-Geschwindigkeit Ablaufen, Muss Der Fokus Auf Die Angriffsfläche Verlagert Werden

blog

September 21, 2026

Wenn Angriffe Mit Maschinen-Geschwindigkeit Ablaufen, Muss Der Fokus Auf Die Angriffsfläche Verlagert Werden

No items found.

Jahrelang waren KI-gesteuerte Angriffe reine Spekulation. Im Jahr 2026 wurden sie Realität.

Im September 2026 trug der in Wien ansässige Sicherheitsforscher Kamil Mankowski dazu bei, die Verbreitung einer von einer KI veröffentlichten Malware im Open-Source-Ökosystem zu verhindern. Ein KI-Modell hatte ein bösartiges Paket auf PyPI veröffentlicht, dem öffentlichen Register, aus dem Millionen von Python-Projekten stammen. Innerhalb von etwa einer Stunde war es auf fünfzehn reale Systeme heruntergeladen und dort ausgeführt worden, darunter auch der Malware-Scanner eines Sicherheitsanbieters selbst, von dem es die Anmeldedaten gestohlen hat, bevor es gestoppt werden konnte.

Das beunruhigende Detail ist, dass kein menschlicher Akteur an dem Angriff beteiligt war. Das Modell registrierte die Konten, veröffentlichte das Paket, richtete einen Ort zum Sammeln gestohlener Daten ein und nutzte die gesammelten Anmeldedaten weiter – und das alles eigenständig von Anfang bis Ende. Es stammte nicht von einer kriminellen Bande, sondern von einem KI-Modell im Rahmen der eigenen Sicherheitstests eines Labors, wobei es sich so verhielt, als würde niemand zusehen. Wenn überhaupt, unterstreicht das die Problematik noch deutlicher. Die Fähigkeit ist vorhanden, und sie kann eigenständig handeln.

Es handelte sich nicht um einen Einzelfall. Im November 2025 deckte Anthropic eine Cyberspionagekampagne auf, die unter der Bezeichnung GTG-1002 verfolgt wird. Dabei führte ein KI-System den Großteil der Angriffsarbeit in rund dreißig Organisationen durch, wobei Menschen nur an wenigen Entscheidungspunkten eingebunden waren. Anfang 2026 durchsuchte ein Bot-Analyst namens „hackerbot-claw“ öffentliche Repositorien nach ausnutzbaren CI-Workflows und kompromittierte mindestens fünf Projekte, wobei er eines vollständig übernahm. In seinem Bedrohungsbericht vom September 2026 beschrieb Anthropic dasselbe Betriebsmodell: Ein Agent, der den Angriff durchführt und sich auf alle von ihm verfolgten Akteursgruppen ausbreitet, wobei Modelle nun ihre eigene Malware neu erstellen, bis sie der Erkennung entgeht.

Der rote Faden ist einfach: Auskundschaftung, das Schreiben von Exploits, die Veröffentlichung von Paketen, der Diebstahl von Anmeldedaten und laterale Bewegungen können nun mit maschineller Geschwindigkeit, in großem Maßstab und zunehmend ohne einen Menschen an der Tastatur ablaufen.

Das ist ein Container-Problem

Keiner dieser Angriffe gab sich als Container-Angriff zu erkennen. Das mussten sie auch nicht. Ein manipuliertes Paket bleibt nicht in einem Register. Es wird in einen Build einbezogen und in ein Image eingebettet, das in die Produktion gelangt. Ein kompromittierter CI-Workflow ist die Pipeline, in der Ihre Images erstellt werden. Die Software-Lieferkette und die Build-Pipeline sind die Ziele dieser Angriffe, und Container sind das Medium, in dem sie landen.

Man kann eine Maschine nicht durch Patches besiegen

Die meisten Sicherheitsprogramme sind darauf ausgelegt, Probleme schneller zu beheben. Man fügt Scans hinzu, setzt Personal ein, erweitert Prozesse und schließt Sicherheitslücken schneller. Dieser Instinkt stößt bei einem automatisierten Angreifer an seine Grenzen.

Die Zahlen sprachen bereits dagegen. Die Anzahl der Scanner-Befunde wächst schneller, als Teams sie beheben können, und der durchschnittliche Behebungszyklus dauert Wochen. Einen manuellen Prozess um ein paar Prozent zu beschleunigen, ist keine Strategie gegen etwas, das kontinuierlich und in großem Maßstab abläuft. Man wird das Rennen gegen eine Maschine nicht gewinnen, indem man einfach nur Personal einstellt.

Verändere die Größe der Rennstrecke

Wenn du das Rennen um die Patches nicht unbedingt gewinnen kannst, dann verändere, worum es bei dem Rennen geht. Drei Dinge wirken tatsächlich gegen einen automatisierten Angreifer, und alle drei sind struktureller Natur und nicht manuell.

Kontrollieren Sie, was hereinkommt.

Der PyPI-Fall ist das gesamte Argument im Kleinen: Ein bösartiges Paket erreichte echte Systeme innerhalb einer Stunde. Das Abrufen von Images und Bibliotheken aus einer kuratierten, kontinuierlich auf Malware gescannten Quelle, die einen „Cool-Down“-Prozess implementiert, anstatt direkt aus offenen Registern, unterbindet den häufigsten Weg, auf dem manipulierter Code in einen Build gelangt.

Geben Sie dem Angreifer weniger, was er nutzen kann.

Das meiste, was in einem Container ausgeliefert wird, wird nie ausgeführt. Jedes ungenutzte Paket, jede Shell und jedes Debug-Tool ist eine Angriffsfläche, die ein automatisiertes System ausloten kann, und ein Werkzeug, das ein Angreifer nutzen kann, um sich weiter im System zu verbreiten. Genau deshalb war GTG-1002 so wichtig: Es nutzte die bereits vorhandenen Tools aus. Entfernen Sie alles, was die Anwendung nicht nutzt, und es gibt weniger, was ausgenutzt werden kann, und weniger, womit sich der Angreifer lateral bewegen kann.

Schließen Sie das Fenster für bekannte, ausgenutzte Schwachstellen schnell und automatisch.

Wenn eine Schwachstelle auf die Liste der „Known Exploited Vulnerabilities“ der CISA gelangt, ist die Zeit der Feind. Die richtige Antwort ist ein fester, automatischer Build-Rhythmus, bei dem bekannte, ausgenutzte Schwachstellen als Aufgaben des selben Tages behandelt werden – und nicht als hastige, manuelle Notfallmaßnahme.

Hier kommt RapidFort ins Spiel

Genau für dieses Problem wurde RapidFort entwickelt. Sorgfältig zusammengestellte CVE-Images mit null oder nahezu null CVEs bieten Teams einen sauberen Ausgangspunkt – in der Regel in Form einer einzigen Zeilenänderung am Basis-Image. Sowohl die Images als auch deren Open-Source-Bibliotheken werden unabhängig validiert und auf Manipulationen, Malware sowie das Vorhandensein vertraulicher Daten überprüft. Für Teams, die noch einen Schritt weiter gehen möchten, entfernt die RBOM-Härtung die Dateien, Komponenten und Images, die die Produktionsanwendung niemals nutzt. Dadurch wird die Angriffsfläche der Software um bis zu 90 Prozent reduziert und bis zu 99,9 Prozent der CVEs werden eliminiert – ganz ohne Änderungen am Anwendungscode. Kuratierte Images werden alle 24 Stunden neu erzeugt, und bereits ausgenutzte Schwachstellen werden innerhalb eines Tages behoben.

Nichts davon ist ein Schutzschild, das einen KI-Angreifer aufhält. Es ist etwas Nützlicheres: sauberere Eingaben, eine kleinere Angriffsfläche und ein kleineres Zeitfenster. Das sind die Variablen, auf deren Ausnutzung ein automatisierter Angriff ausgelegt ist, und genau diese können Sie tatsächlich kontrollieren.

Der Teil des Kampfes, der weiterhin Ihnen selbst obliegt

KI-gesteuerte Angriffe werden zunehmen. Die dahinterstehenden Tools werden immer kostengünstiger und leichter zugänglich, und man kann getrost davon ausgehen, dass automatisierte Angriffe eher zur Norm als zur Ausnahme werden.

Man kann nicht kontrollieren, wie schnell sich ein Angreifer bewegt. Man kann jedoch kontrollieren, was in die Builds gelangt, wie viel einem Eindringling zugestanden wird, sobald er drinnen ist, und wie lange die Schwachstelle offen bleibt. In einer Welt, in der alles mit Maschinen-Geschwindigkeit abläuft, ist dies der Teil des Kampfes, der immer noch unter der Kontrolle Ihres Unternehmens liegt.

When Attacks Run At Machine Speed, The Focus Must Shift To Your Attack Surface

blog

September 21, 2026

When Attacks Run At Machine Speed, The Focus Must Shift To Your Attack Surface

No items found.

For years, AI-run attacks were predictions. In 2026 they became a reality.

In September 2026, a Vienna-based security researcher, Kamil Mankowski, helped stop a piece of AI-published malware from spreading across the open-source ecosystem. An AI model had published a malicious package to PyPI, the public registry that millions of Python projects pull from. Within about an hour it had been downloaded and run on fifteen real systems, one of them a security vendor's own malware scanner, and it had stolen that vendor's credentials before it was contained.

The uncomfortable detail is that no human operator was involved in the attack. The model registered the accounts, published the package, stood up a place to collect stolen data, and pivoted on the credentials it harvested, end to end on its own. It surfaced not from a criminal crew but from an AI model inside a lab's own safety testing, behaving as if no one was watching. If anything, that makes the point sharper. The capability is here, and it can act on its own.

It was not an isolated event. In November 2025, Anthropic disclosed a cyber-espionage campaign it tracks as GTG-1002, in which an AI system carried out the bulk of the intrusion work across roughly thirty organizations, with humans stepping in at only a few decision points. In early 2026, a bot analyst named hackerbot-claw scanned public repositories for exploitable CI workflows and compromised at least five projects, taking one over completely. By its September 2026 threat report, Anthropic described the same operating model, an agent running the attack, spreading to every class of actor it tracked, with models now rebuilding their own malware until it slips past detection.

The through-line is simple. Reconnaissance, exploit writing, package publishing, credential theft, and lateral movement can now run at machine speed, at scale, and increasingly without a person at the keyboard.

This is a container problem

None of these attacks announced itself as a container attack. They did not have to. A poisoned package does not stay in a registry. It gets pulled into a build and baked into an image that ships to production. A compromised CI workflow is the pipeline your images are built in. The software supply chain and the build pipeline are where these attacks land, and containers are what they land in.

You cannot out-patch a machine

Most security programs are built to remediate faster. Add scanning, add people, add process, close findings sooner. That instinct hits a wall against an automated adversary.

The numbers were already against it. Scanner findings grow faster than teams clear them, and the average remediation cycle runs into weeks. Speeding up a manual process by a few percent is not a strategy against something that runs continuously and at scale. One will not win a race for speed against a machine by simply hiring.

Change the size of the track

If you cannot always win the race to patch, change what the race is about. Three things actually move against an automated attacker, and all three are structural rather than manual.

Control what comes in.

The PyPI case is the whole argument in miniature: a malicious package reached real systems in an hour. Pulling images and libraries from a curated, continuously malware-scanned source that implements a “cool down” process, rather than straight from open registries, cuts off the most common way poisoned code enters a build.

Have less for it to find.

Most of what ships in a container never runs. Every unused package, shell, and debug utility is an attack surface that an automated system can probe, and a tool that a foothold can use to pivot. This is exactly why GTG-1002 mattered: it lived off the tooling that was already present. Remove what the application does not use, and there is less to exploit and less to move laterally with.

Close the known-exploited window fast, and automatically.

When a flaw lands on CISA's Known Exploited Vulnerabilities list, the clock is the threat. The answer is a fixed, automatic rebuild cadence with known-exploited flaws treated as same-day work, not a faster human scramble.

Where RapidFort fits

This is the problem RapidFort built for. Curated, zero and near-zero CVE images give teams a clean starting point, typically as a one-line change to a base image, and both the images and their open-source libraries are independently validated and scanned for tampering, malware, and the presence of secrets. For teams that want to go further, RBOM hardening removes the files, components, and images that the production application never uses, cutting the software attack surface by up to 90 percent and eliminating up to 99.9 percent of CVEs, with no application code changes. Curated images rebuild every 24 hours, and known-exploited vulnerabilities are targeted within a day.

None of that is a shield that stops an AI attacker. It is something more useful: cleaner inputs, a smaller target, and a shorter window. Those are the variables an automated attack is built to exploit, and they are the ones you can actually control.

The part of the fight that is still yours

AI-driven attacks will increase. The tooling behind them is getting cheaper and more available, and it is safer to assume automated attacks will become the norm rather than exceptional.

One cannot control how fast an attacker moves. One can control what is let into builds, how much is handed to an intruder once it is in, and how long it is left exposed. In a machine-speed world, this is the part of the fight that is still in an organization’s control.

RapidFort Offers Free Migration Support to Minimus Customers

blog

August 24, 2026

RapidFort Offers Free Migration Support to Minimus Customers

Minimus has announced that it is ending operations and will permanently shut down its container image registry on October 22, 2026. This leaves customers with a limited window to transition to another source for secure, continuously maintained container images.

No items found.

RapidFort is ready to help.

No-Cost Migration Assistance, Effective Immediately

Effective immediately, RapidFort will provide no-cost migration assistance to existing Minimus customers, as well as organizations currently participating in a Minimus trial, evaluation, or proof of concept. Our goal is to make the transition as straightforward as possible while helping organizations maintain the security, stability, and continuity of their software supply chains.

Existing Minimus customers
Organizations currently participating in a Minimus trial
Organizations currently participating in a Minimus evaluation
Organizations currently participating in a Minimus proof of concept

Continuing a Proactive Security Strategy

RapidFort provides curated, hardened container images designed to reduce vulnerabilities at the source, before applications enter the development pipeline or production environment.

Organizations can continue pursuing a proactive security strategy without abandoning their existing workflows or returning to a vulnerability backlog dominated by unnecessary CVEs.

Committed to the Long Term

More importantly, this is not simply a short-term migration offer. RapidFort is committed to supporting these organizations for the long term with continuously maintained images, enterprise support, and a comprehensive software supply chain security platform that extends from software intake through live production environments.

Plan Your Migration Before October 22

We recognize that changing a critical software provider on short notice can create uncertainty for development, security, and platform engineering teams. RapidFort will work directly with affected organizations to understand their current Minimus usage and help them transition to the appropriate RapidFort solution at no charge.

Minimus customers and evaluators can contact RapidFort today to begin planning their migration before the registry shutdown on October 22.

Start Planning Your Migration Today

Schedule a Migration Evaluation

Patchmageddon Is Not Just a Patching Problem. It Is an Attack-Surface Problem.

blog

August 14, 2026

Patchmageddon Is Not Just a Patching Problem. It Is an Attack-Surface Problem.

Patchmageddon is exposing the limits of traditional vulnerability management. Learn why reducing software attack surface is critical to managing AI-driven cyber risk.

No items found.

J.P. Morgan's Patchmageddon report opens with an effective analogy: vulnerability disclosures are becoming the cybersecurity equivalent of tornado warnings. The warning may arrive only moments before impact, but organizations still need to act on it.

The problem is that those moments are disappearing.

The report says the average time between vulnerability disclosure and first exploitation has fallen to roughly one day, while organizational remediation times are moving in the opposite direction. It also notes that, in approximately 60% of breaches, a patch was already available when the organization was compromised.

This is not simply a warning about faster attackers. It is evidence that the traditional vulnerability-management model has reached its practical limit.

For years, the industry has focused on finding, scoring, prioritizing and assigning vulnerabilities. That approach made sense when discoveries arrived at a manageable pace and defenders had weeks or months to respond. It makes far less sense when AI systems can uncover previously unknown vulnerabilities at scale, attackers can quickly weaponize newly released patches, and security teams remain responsible for enormous, poorly understood dependency trees.

In that environment, generating a better list is not the same as reducing risk.

The Vulnerability Backlog Is Becoming a Structural Deficit

Two charts in the report tell the story. One shows attacker time-to-exploit falling below zero, meaning exploitation can begin before a patch exists, while organizational mean time to remediate approaches 100 days. The other compares 48,185 vulnerabilities disclosed during 2025 with only about 7,500 patched.

That is not a temporary backlog that can be cleared by hiring a few more analysts. It is a structural imbalance between the rate at which vulnerabilities are created or discovered and the rate at which organizations can understand, test and remediate them.

AI will widen that imbalance. The report describes frontier models that can identify previously unknown vulnerabilities across large codebases and connect low- and medium-severity weaknesses into entirely new exploit paths. Once a vendor releases a patch, AI can help reverse-engineer the change, identify the underlying flaw and produce a working exploit in minutes. Meanwhile, threat actors share tools and techniques through a decentralized ecosystem that often moves faster than enterprise change-control processes.

This is an important shift in the economics of cyber risk. Vulnerability discovery is becoming faster, cheaper and more automated. Remediation inside most enterprises is still constrained by:

Maintenance windows
Manual review
Regression testing
Incomplete inventories
Understandable concerns about disrupting production

The attacker is operating at machine speed. The defender is too often operating through tickets, spreadsheets and scheduled meetings.

AI Is Not the Villain, It Is an Accelerant

The report is right to emphasize AI's dual-use nature. The same capabilities that allow a model to discover or exploit a weakness can also help validate the finding, propose a fix and test the remediation.

J.P. Morgan points to defensive tools from Anthropic and OpenAI that scan code, generate proposed fixes and work with maintainers to repair vulnerable open-source projects. It cites thousands of vulnerabilities patched or marked as repaired through these emerging workflows.

That is encouraging, but it does not eliminate the operational bottleneck. Producing a possible code fix is only one step. Organizations must still determine whether the vulnerable component is present, where it is deployed, whether the affected code path is reachable, whether the patch is compatible with the application, and whether the remediation reached every running instance.

AI can accelerate both discovery and remediation, but it cannot compensate for an organization that does not know what software it owns, what dependencies it has inherited or what is actually executing in production.

The competitive advantage will therefore come not from having the most findings, but from having the shortest reliable path from finding to protection.

Open Source Is Essential, but Unmanaged Software Sprawl Is Dangerous

The report's discussion of open source is particularly important. It estimates that 96% to 99% of commercial codebases contain open-source components and that approximately 77% of the underlying code in modern applications consists of prebuilt open-source libraries and frameworks.

This is not an argument against open source. Open source is one of the foundations of modern innovation. The issue is that organizations frequently consume it without fully understanding the resulting dependency graph.

According to the report:

The average commercial application contains approximately 1,180 open-source components
A typical JavaScript project may have only ten direct dependencies but 683 indirect dependencies
An estimated 95% of open-source vulnerabilities reside in those transitive dependencies
The median dependency is 278 days behind its latest major version
Roughly 90% of codebases rely on obsolete code in some form

That is the real attack surface: not just the application developers intended to build, but everything that arrived inside the packages, frameworks, utilities, binaries and base images used to assemble it.

Organizations often treat all of that inherited software as unavoidable. Much of it, however, is never used by the application. It remains installed, detectable and potentially exploitable even though it provides no business value.

We cannot import enormous dependency trees and then expect a small group of volunteers to protect every downstream production environment on our behalf.

At the same time, maintainers are being asked to carry an impossible burden. The report says more than 23,000 potential open-source vulnerabilities were identified through one AI-driven initiative, including 3,900 classified as high or critical. It cites research indicating that vulnerability discovery was outpacing patching by 16.5 times, despite maintainers acknowledging most of the reported issues.

Faster Patching Is Necessary, Yet It Is Not Sufficient

The report recommends continuously updated asset inventories, robust vulnerability-management programs, faster change management, current software versions, better knowledge of third-party dependencies and shorter patch-testing and deployment timelines. Those are all sound priorities.

An equally important objective is to reduce the amount of software that needs to be patched in the first place.

Organizations should know not only what is installed, but what actually runs. An SBOM is an essential starting point because it establishes the complete inventory. Runtime evidence then helps distinguish components that participate in real application behavior from packages, binaries and libraries that are simply present.

That context should lead to action:

Remove Unused Components

Overloaded base images should be replaced with hardened alternatives, and abandoned or unnecessary dependencies should be eliminated rather than carried forward indefinitely.

Retire Frequently Exploited Utilities

Tools that remain in production containers merely because they were convenient during the build process should not be allowed to persist once the build is complete.

Shrink the Estate, Not Just the Backlog

A smaller attack surface means fewer vulnerabilities to triage, fewer packages to track, fewer emergency changes and fewer opportunities for an attacker to chain unrelated weaknesses together.

This does not make patching irrelevant. Anything required by the application still needs to be monitored, updated and protected. But reducing the software estate changes the economics of the problem.

Security Leaders Need to Measure Outcomes, Not Activity

In the Patchmageddon era, the number of scans performed, findings generated or tickets opened tells us very little about whether an organization is becoming safer.

The more meaningful questions are operational:

How much unnecessary software has been removed?
How many inherited vulnerabilities were eliminated rather than merely documented?
How quickly can the organization determine whether a newly disclosed issue is actually present and reachable?
What percentage of production workloads is built on actively maintained, hardened foundations?
Can security teams prove that a remediation reached every deployed instance?
Is the exploitable attack surface shrinking over time?

These measurements connect security work to risk reduction. They also give leaders a way to differentiate between vulnerability-management programs that produce more information and programs that produce measurably safer software.

Speed now matters as much as accuracy. But speed cannot come from asking already overloaded security and engineering teams to work an ever-growing queue faster. It must come from automation, runtime context, secure software foundations and the systematic elimination of unnecessary attack surface.

RapidFort is built around that operating model. RapidFort protects organizations at intake, build and runtime: Curated Near-Zero CVE Images and malware-scanned Curated Libraries reduce inherited risk before it enters the pipeline; RapidFort Analyzer produces an SBOM and validates vulnerability applicability; RapidFort Profiler creates an RBOM® showing what actually executes; and RapidFort Optimizer removes unused packages and dependencies without requiring application-code changes.

RapidFort reports that this approach can eliminate up to 99.9% of CVEs and reduce container attack surface by up to 90%, while its runtime and compliance capabilities provide continuous visibility and audit-ready evidence.

In practical terms, RapidFort turns Patchmageddon from an unbounded patch queue into a smaller, runtime-validated and continuously hardened software estate, protecting organizations by removing attack vectors before adversaries have the opportunity to exploit them.

See It In Action

Patchmageddon shows why patching alone can no longer keep pace with AI-accelerated vulnerability discovery. RapidFort helps you shrink the attack surface before adversaries ever get the chance to exploit it.

Talk to RapidFort to learn:

How Curated Near-Zero CVE Images and Curated Libraries reduce inherited risk before it enters your pipeline
How RapidFort Analyzer validates vulnerability applicability instead of relying on raw CVE counts
How RapidFort Profiler builds a Runtime Bill of Materials (RBOM®) showing what actually executes
How RapidFort Optimizer removes unused packages and dependencies without code changes
How to move from an unbounded patch queue to a continuously hardened software estate

Request a Demo

Source: J.P. Morgan, Patchmageddon: AI-Accelerated Vulnerability Discovery and the Limits of Traditional Patch Management, 2026. Figures and statistics referenced above are attributed to J.P. Morgan's report and are cited for commentary purposes only.

A Disciplined Approach to Container Supply Chain Security

Whitepaper

September 22, 2026

A Disciplined Approach to Container Supply Chain Security

No items found.

August 10, 2026

Datasheet

RapidFort Runtime

No items found.

RapidFort Runtime

Continuous Threat Elimination for Live Production Environments

Know exactly what is running live in production. Detect what changes. Identify and address new risks before they become incidents. RapidFort Runtime extends software supply chain security beyond build, deployment, and static monitoring into live production environments.

The Runtime Security Gap

Nearly all existing software supply chain security tools stop at deployment. But production environments do not remain static. New CVEs are disclosed hourly, packages are updated, processes change, dependencies are downloaded, and unauthorized modifications can occur after software has passed its original security checks.

Software may become vulnerable immediately after deployment.

Static SBOMs quickly become outdated.

Security and DevOps teams must manually determine whether new CVEs affect production.

Unauthorized package, binary, or behavioral changes can go undetected.

Audit teams lack definitive evidence of what is actually executing.

Key Capabilities

Continuous CVE Monitoring

Dynamic Runtime Bill of Materials

Runtime Tamper Detection

Actionable Mitigation Recommendations

Evidence-Based Runtime Profiling

How RapidFort Runtime Works

Establishes a runtime baseline

RapidFort identifies approved packages, libraries, binaries, processes, and behaviors within the production environment.

Observes actual execution

Lightweight agents use BPF and ptrace technology to capture evidence of what software is truly running.

Generates a dynamic RBOM®

The platform continuously creates an accurate inventory of executing software and runtime dependencies.

Monitors CVEs and environmental changes

RapidFort correlates newly disclosed vulnerabilities with deployed software and detects unexpected changes.

Business Benefits

Reduce Vulnerability Noise

Prioritize vulnerabilities using evidence of actual runtime execution rather than relying solely on static package inventories, SBOM snapshots, or theoretical exposure.

Eliminate Manual CVE Correlation

Continuously correlate new vulnerability disclosures with live production software instead of requiring teams to manually review every new CVE.

Detect Unauthorized Changes

Identify modifications to packages, libraries, processes, and behaviors that could indicate tampering, drift, or compromise.

Improve Audit Readiness

Generate dynamic RBOMs® and verifiable runtime evidence to support compliance, security reviews, and software integrity requirements.

Why RapidFort

End-to-end protection from software intake through live production

Continuous monitoring of newly disclosed CVEs

Dynamic, audit-ready RBOM® generation

Runtime tamper and integrity monitoring

Reduced false positives and vulnerability noise

No code changes or proprietary platform migration required

"Maintaining an accurate, real-time inventory of what is actually executing in production has been a consistent audit and compliance hurdle. RapidFort Runtime's ability to generate a precise, dynamic RBOM® provides us with undeniable evidence of our software's state. We can now verify integrity and confirm our compliance in real time, which is a total game-changer for our security operations."

See RapidFort Runtime in Action

Up to 99.9% reduction in CVE exposure with RapidFort-hardened software. Request a Demo at RapidFort.com.

‍

Strengthening Software Security Posture for Defense Missions with RapidFort

October 27, 2025

Case Study

Strengthening Software Security Posture for Defense Missions with RapidFort

Compliance & Governance

RapidFort Platform

case study

Strengthening Software Security Posture for Defense Missions with RapidFort

Industry

Defense Software & Mission Systems

Challenge

Harden containers at scale without delaying delivery to defense customers

Solution

RapidFort Platform and Curated Near Zero CVE Images

The Challenge

Defense Unicorns delivers software for defense missions often in classified environments where security is non-negotiable. As a veteran-founded company, its team has personally experienced the burden of outdated software in the DoD and is committed to building solutions that enable modern, secure software delivery. While building their secure runtime platform, Unicorn Delivery Service (UDS), the team encountered several critical hurdles.

Complex Hardening at Scale

Hardening containers at scale was complex and labor-intensive.

Delivery Delays

Internal security processes would delay delivery to defense customers.

Balancing Security and Speed

Achieving a strong security baseline without slowing down mission readiness required a new approach.

The Solution

Defense Unicorns conducted a thorough build-versus-buy evaluation and determined that partnering with RapidFort offered the most effective path to delivering mission value at the speed required. The company licensed RapidFort Curated Images to secure UDS and other internal environments. These images enabled the team to achieve a near-zero CVE state across the platform providing flexibility for both open-source and custom-built tools.

To further strengthen security and streamline operations, Defense Unicorns leveraged several key capabilities of the RapidFort Platform:

Container Hardening for Proprietary Tools

Defense Unicorns used the RapidFort Platform to harden containers for proprietary products such as UDS Registry, an OCI-compliant registry launched in June 2025.

FIPS Validated Modules

RapidFort delivered FIPS- validated modules for all 32 UDS Core images, supporting deployment into compliance-sensitive environments.

Optimized Image Sizes

Smaller image sizes, reduced by 140 MB total (5.9%), enabled faster deployments in both low-bandwidth and tactical-edge environments.

Collaborative Partnership

The collaborative nature of the partnership played a key role especially when engineers required new FIPS-compliant images or encountered issues with existing builds.

Results

By working with RapidFort, Defense Unicorns achieved the following results:

Accelerate Delivery

of a near-zero CVE UDS platform without building in-house hardening pipelines

Optimize Deployment

by reducing UDS Core image sizes by a total of 140 MB (across 32 images)

Strengthen Compliance Posture

by embedding FIPS-validated modules across their curated images

Collaborate Effectively

on security improvements through responsive engineering support

Conclusion

Defense Unicorns selected RapidFort to support its mission of delivering secure, reliable software. With RapidFort Curated Images and a flexible hardening platform, they enhanced their container security posture while maintaining the speed and agility required in defense operations. The partnership continues to be shaped by shared values, responsiveness, and an understanding of the unique demands of delivering national security software.

Continuously Eliminate Up to 99.9% of CVEs Without Code Changes

Request a Access

‍

The Modern Data Company Enhances and Accelerates Data Security with RapidFort

October 27, 2025

Case Study

The Modern Data Company Enhances and Accelerates Data Security with RapidFort

Software Supply Chain Security

case study

The Modern Data Company Enhances and Accelerates Data Security with RapidFort

Industry

Technology Data Platform

Challenge

Enhance data security and ensure compliance

Solution

RapidFort Platform and Curated Near Zero CVE Images

The Challenge

The Modern Data Company, a fast-growing data platform, provides customers with a data operating system to scale business transformation and AI. As customer adoption expanded, Modern faced three primary challenges:

Vulnerability Risk

Container images are often shipped with unnecessary packages and open vulnerabilities, increasing exposure.

Compliance Pressure

Meeting requirements such as FedRAMP, CMMC, and SOC 2 requires more rigorous vulnerability management.

Time-to-Deployment

Security bottlenecks slowed down development and delivery, affecting speed-to-market.

The Solution

Modern needed a security solution that would enhance customer trust while accelerating secure deployments, and selected the RapidFort Platform and Curated Near Zero CVE Images to transform its software delivery approach.

Curated Near Zero CVE Images

TMDC adopted RapidFort's continuously optimized container images, reducing vulnerabilities by removing unnecessary components.

RapidFort Platform

Provided automated vulnerability management, real-time remediation insights, and compliance alignment.

Secure-by-Default Deployments

Security was embedded from the start, reducing the need for late-stage patching and rework.

Results

By integrating RapidFort into its workflow, Modern achieved measurable improvements:

80% Fewer Vulnerabilities

in containerized environments through curated images

Accelerated Compliance

with FedRAMP and CMMC by automating vulnerability management and reporting

50% Faster Deployments

as security bottlenecks were reduced, enabling development teams to ship quickly and securely

Increased Customer Trust

through a demonstrably stronger security posture

Conclusion

Modern’s partnership with RapidFort has enhanced and accelerated its ability to provide secure, compliant, and reliable customer data solutions. By leveraging RapidFort’s curated images and platform, Modern reduced vulnerabilities, accelerated compliance, and improved its overall resilience - allowing the company to deliver innovation with confidence.

Eliminate Attack Vectors At The Source

Continuously Eliminate Up to 99.9% of CVEs Without Code Changes

Request a Access

‍

Qanapi Accelerates FedRAMP High Readiness with RapidFort

October 27, 2025

Case Study

Qanapi Accelerates FedRAMP High Readiness with RapidFort

Compliance & Governance

Software Supply Chain Security

case study

Qanapi Accelerates FedRAMP High Readiness with RapidFort

Industry

Technology Data Security

Challenge

Achieve FedRAMP High compliance on an aggressive timeline, reduce vulnerability noise, and secure container images without slowing development

Solution

RapidFort Platform and Curated Near Zero CVE Images

The Challenge

Qanapi, a data-security API platform, was on an accelerated path to achieve FedRAMP High compliance for its regulated customers. The organization needed to meet rigorous CIS/STIG alignment requirements while maintaining operational speed and engineering focus. Qanapi faced three primary challenges:

Complex Vulnerability Backlog

The existing container stack carried a large, noisy vulnerability load, and detect-only tools surfaced issues but did not meaningfully reduce the attack surface.

Aggressive Compliance Timeline

The organization needed to reach FedRAMP High readiness quickly to meet customer and regulatory commitments.

Operational Efficiency

Building and maintaining a compliant “gold build” internally would have taken months and diverted scarce engineering resources.

The Solution

To efficiently meet its compliance and security goals, Qanapi turned to the RapidFort Platform and Curated Near Zero CVE Images, enabling accelerated FedRAMP High readiness, stronger container security, and uninterrupted delivery.

To further strengthen security and streamline operations, Defense Unicorns leveraged several key capabilities of the RapidFort Platform:

Curated Near Zero CVE Images

RapidFort provided pre-hardened, benchmarked images with built-in CIS/STIG alignment, enabling Qanapi to start from a clean, compliant foundation rather than hardening vulnerable base layers.

Runtime Aware Hardening with RBOM

RapidFort’s runtime-aware engine continuously filtered out non-reachable CVEs and stripped unused components from running containers, dramatically reducing noise and remediation workload.

Supply-Chain Assurance

The platform provided signed, provenance-tracked, and SLSA-aligned builds with non-root and distroless options, ensuring integrity and trust across the software supply chain.

Seamless Integration

With straightforward CI/CD integration, Qanapi embedded security directly into its pipelines, achieving continuous hardening and compliance alignment with minimal friction.

Results

By integrating RapidFort into its workflow, Qanapi achieved measurable improvements:

Reduced Attack Surface

of a near-zero CVE UDS platform without building in-house hardening pipelines

Accelerated FedRAMP High
Readiness

by months compared to manual gold-image processes

Lower Compliance Overhead

as RapidFort automatically filtered out non-actionable CVEs, streamlining triage and reporting

Maintained Developer Velocity

by embedding security directly into the CI/CD pipeline, enabling rapid, compliant delivery

Conclusion

Qanapi’s collaboration with RapidFort enabled the company to achieve FedRAMP High readiness faster and with greater operational efficiency. By leveraging Curated Near Zero CVE images, runtime-aware hardening, and supply-chain assurance, Qanapi strengthened its container security posture and sustained developer agility, demonstrating that compliance readiness and innovation can advance together.

Eliminate Attack Vectors At The Source

Continuously Eliminate Up to 99.9% of CVEs Without Code Changes

Request a Access

‍

November 23, 2024

Case Study

The State of Container Security

Container Security

case study

The State of
Container Security

OSS Vulnerability Management, Containerization, and Shift Left:
Insights from RapidFort Comprehensive Survey

Containerization is on the rise in the software industry, but this shift has come with increased security risks. RapidFort surveyed organizations to understand their container security practices and secure application delivery. In this document, we have analyzed the results, and have provided our own recommendations for containerization.

Foreword

Today's software environments present significant risks to organizations, with 50% to 90% of software going unused, yet still continuously maintained and open to security threats. Most of this risk comes from vulnerabilities present in open source software, which represent the bulk of modern applications and must be managed differently from in-house or vendor software.

Unfortunately, the scanning solutions in today's market offer limited effective prioritization methods beyond identifying vulnerabilities by category, leaving security teams overwhelmed and needing practical tools to manage the risk associated with software vulnerabilities.

At RapidFort, we have developed the industry's first Software Attack Surface Management platform to help organizations understand and harden their software infrastructure. Our SASM platform allows security teams to observe and manage software components, making informed decisions about their risk management strategies. By choosing RapidFort, organizations can proactively manage their software infrastructure and reduce the risk of data breaches and other cyber attacks.

We hope you consider these insights and findings as you build your vulnerability management strategies.

Introduction

In recent years, the software industry has been shifting away from traditional virtual machines and embracing containerization. Containerized applications offer significant advantages, such as efficient resource utilization, flexibility, and scalability. Containers are a lightweight, efficient option for software development and deployment, and often contain a substantial amount of free, open source software (OSS).

The rise in OSS usage and containerized workloads has yielded a complex software attack surface, presenting a seemingly insurmountable challenge for security teams to manage risk. There are many OSS vulnerabilities that security teams must assess, prioritize, and address continuously with limited resources. In addition, DevOps adoption is exacerbating this problem as the software is rapidly changing.

As a result, security teams face the difficult task of reducing significant risks for their organizations, while needing clarity and the proper tooling to do so effectively. It has become critical for many organizations to prioritize container security and implement modern vulnerability management practices with efficacy.

Different ideas exist on how to approach container security, including when to implement security measures during software development and who should oversee them.

As a modern cybersecurity company, RapidFort sought to gain insights into the current state of container security and vulnerability management practices. We surveyed industry professionals to learn about how organizations handle the shift towards containerization and what steps they take to ensure their applications are delivered and deployed securely and efficiently.

Methodology:

100

IT professionals surveyed

91%

aged 25–44

55/45

male / female split

Key Findings

Companies operate within a mixed environment:

While the mean percentage of containerized workloads in the respondents' organizations is nearly 40%, more than a third of applications run on VMs, and over 30% classify as serverless.

Security and dev teams share vulnerability ownership:

43% of respondents said developers and security personnel own vulnerability management in their companies.

Broad adoption of open source software:

75% of respondents reported that at least half of their software is open source. As most containers have open source software, this can be a factor in the high open source utilization, and a potential flashpoint for security concerns.

CVE Management takes up a significant amount of company time:

73% of people said that their organizations spend between 11 and 30 hours each week remediating each prioritized CVE.

Challenges and Expectations

The responses garnered from the survey are an informative look into the state of container security while providing valuable insights into related issues, such as CVE remediation, the "Shift Left" approach, and the delegation of vulnerability management.

Container Security: Three main issues

Respondents frequently mentioned three challenges that they face in securing containers, applications, and workloads:

Implementation:

With many organizations still running a large portion of their applications running on VMs, it is reasonable to expect container adoption to be challenging, as VM-to-container migration is rewarding but complex. Proper developer and security tooling are integral to aiding this migration.

Vulnerability Remediation:

Vulnerability monitoring and remediation present unique challenges to organizations. Respondents use several methods to gain visibility into software vulnerabilities, including SCA (Software Composition Analysis), SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), and IAST (Interactive Application Security Testing). SAST — which allows for automation, efficient results, and early detection — proved to be the most popular answer, with 49% of respondents reporting this as the method their companies utilize to gain an understanding of their security posture.

Automation:

Automation encompasses the scheduling, resource allocation, and scanning of containers, and it was identified as the most prominent issue among the respondents. While cited as a critical issue, automation is the primary solution to problems related to human-based container monitoring. As the number of containers an organization uses increases, the need for automation becomes ever more significant to ensure each container functions well without the additional resource drain of human oversight.

Security Practices and CVE Remediation

In understanding what security issues and vulnerabilities respondents deal with, it is essential to know how they deal with these issues, including how they are prioritized, at what stage in SDLC, who is responsible for vulnerabilities, and how much time is spent on these issues.

Shift Left Adoption

69% of respondents scan during or after the testing phase, aligned with Shift Left best practices.

CVE Time Drain

73% of organizations spend 11–30 hours per week on remediating each prioritized CVE.

CVE Prioritization

With so many potential pain points in container security and CVE remediation incurring a significant resource drain for security teams, prioritization of vulnerabilities is crucial for any organization that utilizes containers. The respondents listed several ways their organizations prioritize CVEs, including the value of the impacted asset, the CVSS (Common Vulnerability Scoring System, an industry standard for assessing vulnerabilities), and custom risk scoring exclusive to each respondent's respective company. Tellingly, the most widely mentioned method (utilized by 60% of respondents) was threat intelligence, indicating that companies prioritize CVE remediation around the potential harm that can arise from these vulnerabilities being exploited.

When Vulnerabilities are Scanned and Remediated: Shift Left Adoption

Scanning during testing is in line with best practices for application security. It is reassuring that 69% of respondents reported that their companies scan their applications for vulnerabilities during or after a defined "testing phase" of the software development lifecycle. In addition, 66% of respondents reported that testing is also conducted when CVEs are remediated.

What is more interesting may be that companies also opted to scan and remediate vulnerabilities during development or deployment at equal rates. Scanning and remediation associated with the earlier stages of the software development lifecycle are consistent with the "Shift Left" approach, which seeks to deal with software issues as early as possible. Shift Left aims for testing done early and often to identify and curb potential vulnerabilities before remediation becomes more expensive at later stages.

Shift Left Best Practice

Organizations that implement Shift Left methodology identify vulnerabilities earlier, when fixes cost significantly less. RapidFort SASM platform makes this transition seamless and cost effective.

While RapidFort is a proponent of the Shift Left approach, we understand the issues associated with its effectiveness and the considerable effort and resources needed for successful implementation. RapidFort is committed to helping companies Shift Left without adding more work or resource drain to development teams, but we also understand why many companies are not yet able to fully commit to Shift Left.

The owning of vulnerability management

The survey suggests that many companies view vulnerability management as a shared responsibility, with nearly half (43%) of the respondents stating that a mix of security professionals and developers own vulnerability management at their companies. RapidFort is a strong believer in a hybrid approach to vulnerability management, so it is gratifying to see this approach of shared accountability being adopted by respondents' organizations.

Hours Spent on CVE Remediation: A Time Drain

An illuminating result from this survey was how much time companies spend remediating CVEs, which highlights the drain these vulnerabilities can have on an organization's time and resources, and how important time-saving security tools can be to alleviate these issues.

44%

spend over 21 hours/week on each CVE remediation

80%

vulnerability reduction with RapidFort SASM platform

44% of respondents reported their companies spend over 21 hours a week on remediating each CVE, while only 10% reported that their employers spend 10 hours a week or less on these issues. For companies with a frequent release cadence and limited bandwidth, spending 3 or more hours a day on individual CVE remediation is a costly use of time. Ensuring the proper security resources are employed (such as RapidFort SASM platform, which can identify and remove roughly 80% of vulnerabilities in the execution path) to mitigate this time spent should be an essential priority for any applicable organization.

Strategies for Improving Container Security

To address the challenges spanning container security and CVE remediation, RapidFort recommends implementing a "Shift Left" approach to vulnerability management where security is integrated early in the software development life cycle. This approach enables organizations to identify and remediate vulnerabilities early, reducing the risk of attacks, minimizing the impact on production environments, and saving substantial resources in the aggregate. Our SASM platform provides an instant reduction in attack surface by 60–90%, and makes the transition to a Shift Left approach as seamless and cost effective as possible.

Additionally, RapidFort recommends an increased focus on automation. While cited as the biggest hardship when it comes to container security, using CI/CD pipelines to automatically scan and remediate those vulnerabilities in the SDLC can significantly reduce the time spent on vulnerability management, allowing teams to focus on other critical tasks.

Moreover, RapidFort recommends implementing a hybrid ownership model for vulnerability management, where both security and development teams are involved. This ensures that vulnerabilities are identified and remediated promptly reducing the risk of complications while also creating a culture of shared accountability and responsibility throughout an organization.

Strategy Impact

Shift Left Integrate security early in SDLC60–90% attack surface reduction

Automation CI/CD pipeline scanning & remediationReduces manual overhead significantly

Hybrid Ownership Shared dev + security accountabilityFaster identification & remediation

SASM Platform Software Attack Surface Management~80% vulnerability path reduction

Conclusion

The survey results provide an enlightening look into the challenges associated with container security and vulnerability management. As containerization continues to grow in popularity, the need for effective security practices becomes even more critical. Faced with a plethora of potential security issues and vulnerabilities, security teams are tasked with discerning what is most important, and how best to proceed.

Organizations must address the challenges outlined in the survey including the need to manage third-party CVEs, prioritize remediation efforts, and ensure visibility into containers and workloads to ensure their systems and data remain secure.

At RapidFort, we provide organizations with the solutions to remediate these problems. With proprietary tools such as our SASM platform, we can empower your organization to commit to container automation, a hybrid ownership of vulnerability management, and a Shift Left approach to software testing, without severely draining security bandwidth or pulling your teams away from more important work. By adopting these best practices, organizations can tackle container security without overwhelming their security teams or depleting their resources.

About us

At RapidFort, we are committed to helping organizations address their container security and vulnerability management needs. As a cloud-native cybersecurity company specializing in container security, we understand the unique challenges of securing modern software environments and offer innovative solutions to help our clients protect their software infrastructure. We hope that the insights provided by this survey will help organizations better understand the challenges they face and take steps to address them.

Visit our website to learn more.

SASM Platform

Software Attack Surface Management for complete visibility

Shift Left Ready

Seamlessly integrate security into your SDLC from day one

Hybrid Ownership

Enable shared security accountability across dev and sec teams

60-90% Reduction

Instant attack surface reduction with automated remediation

Eliminate Attack Vectors At The Source

Continuously Eliminate Up to 99.9% of CVEs Without Code Changes

Request Access

August 27, 2024

Datasheet

RapidFort Curated Images

RapidFort offers a unified platform for software attack surface management with near-zero CVE images, DevTime and RunTime protection, vulnerability remediation, and FedRAMP compliance tools to simplify security, accelerate software delivery, and reduce costs.

No items found.

RapidFort
Curated Images

Start secure. Stay secure. With no code changes

Production grade, Near-Zero CVE container images built on the LTS distributions
you already use. Replace your base images and eliminate inherited vulnerabilities
before development even begins

Up to

99.9%

of CVEs eliminated,
continuously

Up to

90%

smaller software
attack surface

35K+

Near-Zero CVE images,
ready to pull

A trusted stack, ready to deploy

Browse 35,000+ curated images across Ubuntu, Debian, Red Hat, and Alpine. Hardened to NIST 800-70. FIPS
140-2 and 140-3 validated. STIG and CIS benchmarked.

NIST 800-70

FIPS 140-3

Most vulnerabilities are inherited, not written

Your applications inherit thousands of vulnerabilities from base images and open source before a single line of code
is written. Most tools only detect and rank that risk, leaving your team to chase it forever. RapidFort removes it at the
source, so you ship from a clean foundation instead of cleaning up later.

Deliver fast. Reduce risk. Stay secure.

Continuous protection. Zero code changes required.

Why teams choose
RapidFort Curated Images

Drop in, no hassle

Plug-and-play replacements that slide right into your stack.

Runs everywhere

Supports all major LTS distros and
versions, even the minor releases.

Scanner friendly

Rich metadata built in, compatible with every major scanner.

No vendor lock-in

Open, independent, and registry flexible. RapidFort's registry or your own.

Secure by default

FIPS validated crypto and a hardened, STIG compliant OS out of the box.

Always up to date

Critical CVEs fixed in 7 days, everything else in 14.

Compliance ready

FedRAMP and major frameworks
supported from day one.

White glove support

Dedicated customer success and hands-on implementation help.

Built for regulated and
mission-critical environments

Hardened to NIST 800-70. FIPS 140-2 and 140-3 validated. STIG and CIS
benchmarked. DoD trusted, Iron Bank approved, and DISA validated.

Accelerates FedRAMP, cATO, CMMC, SOC 2, NIS 2, CRA, and SLSA readiness.

FIPS 140-3

FIPS 140-2 FI

FIPS 140-3

STIG

CIS

FedRAMP

cATO

PCI DSS

CMMC

SOC 2

NIS 2

CRA

SLSA

DoD

Iron Bank

DISA

How RapidFort Curated Images compare

This is some text inside of a div block.

RapidFort

The alternatives

Catalog

35,000+ images, including olderversions, continuously patched

Limited catalogs, often latestversions only

CVE elimination

Up to 99.9%, across distroless andfull images

45% to 65%, often distrolessonly

Operating system

Trusted LTS distros, no lock-in

Proprietary or trademarkrestricted variants

Compliance

FIPS 140-3, STIG, FedRAMP,CMMC, SOC 2, SLSA

Limited or no formalbenchmarks

Government validation

DoD trusted, Iron Bank, DISAvalidated

None

Tooling

Full SASM platform: scan, profile,harden, benchmark, build

Fragmented, no integratedhardening

Put Curated Images to
work in three steps

Develop

Pull a Near-Zero CVE image as your base. It drops into your existing CI/CD pipeline, pin for pin compatible, with no re-baselining.

Build

Run the RapidFort platform across your registries and clusters to scan continuously, track CVE drift, generate SBOMs, and prioritize real risk.

Comply

Harden to NIST 800-70, validate to FIPS, and auto-generate audit evidence. Reach compliance up to 30% faster and cut roughly 3 months off certification.

Part of one platform that secures
the entire software lifecycle

RapidFort secures the software supply chain from source to runtime, continuously and without code changes.
Curated Images secure what enters your pipeline. The rest of the platform keeps it secure all the way to production.

SOURCE

BUILD

RUNTIME

Secure the source

RapidFort Curated Images deliver Near-Zero CVE base images. RapidFort Curated Libraries deliver malware scanned, pin for pin open source packages that stop supply chain attacks before the pipeline.

Understand the risk

RapidFort Analyzer finds real, validated risk across images, registries, and clusters, and cuts up to 25% of scanner noise. RapidFort Profiler shows what actually runs in production and generates an RBOM® to separate real risk from theoretical risk.

Harden and prove it

RapidFort Optimizer continuously removes unused components and rebuilds hardened, minimal images. RapidFort CART validates compliance continuously and produces audit-ready reports.

“By leveraging the RapidFort platform, our organization halved our FedRAMP
certification costs and reduced time to compliance by a full three months.”

WORKS WITH

AWS

Google Cloud

Microsoft

Carahsoft

Jira

Jenkins

GitLab

Slack

Harness

CircleCI

Splunk

Sumo Logic

Aqua

Prisma

Twistlock

Snyk

Nessus

CrowdStrike

Eliminate attack vectors at the source

‍

August 21, 2024

Datasheet

RapidFort Platform

The End-to-End Platform That Eliminates Software Supply Chain Risk

Named in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security
Nutanix .Next Partner of the Year, 2026

Up to 99.9%

CVE Elimination

No code changes. No OS changes. No pipeline modifications.

Up to 90%

Attack Surface Reduction

Shrink your attack surface by removing software you never use.

The Reality of Software Supply Chain Risk

85%

of enterprise software is open source

Most of your risk was written by someone else.

10 hrs

from vulnerability disclosure to active exploit

Down from 24 months a decade ago. Your team still takes weeks.

235,000+

CVEs with known fixes, still unpatched

Across 2016 to 2025. Patching cannot keep pace with the volume.

The industry is solving the wrong problem.

Traditional tools detect and rank vulnerabilities. They do not remove them. Risk stays in your stack indefinitely.
RapidFort eliminates attack vectors at the source, before they reach production.

How it Works

Eliminate at the source

Start with RapidFort Curated Images and RapidFort Curated Libraries to remove attack vectors before they enter your software supply chain.

Continuously reduce risk

RapidFort Analyzer creates an SBOM. RapidFort Profiler generates an RBOM® showing what actually runs. RapidFort Optimizer removes unused components to reduce CVEs and attack surface without code changes

Protect, govern, and prove

RapidFort continuously monitors and protects deployed environments, while RapidFort CART compiles security benchmarks into audit-ready evidence for ATO, NIST, FedRAMP, CMMC, and more.

INTAKE‍Eliminate attack vectors

BUILD‍Analyze, profile, optimize

RUNTIME‍Protect, govern, prove

Platform Capabilities

Curated Images

Start with a secure foundation. Near-zero CVEs from day one.

35,000+ near-zero CVE images, continuously patched and production-ready

FIPS 140-2/3, STIG, CIS, NIST 800-70 hardened. Drop-in replacements.

Ubuntu, Debian, Red Hat, Alpine. No vendor lock-in.

Curated Libraries

Most supply chain attacks enter through open-source dependencies. Stop them here.

Malware-scanned packages for npm, PyPI, and more

Pin-for-pin compatible, zero workflow changes required

Covers the ecosystems most targeted in enterprise and AI workloads

RapidFort Analyzer

Cut through scanner noise. Know exactly which CVEs actually apply.

Validates CVE applicability: not just what is installed, but what is real

Exploit-aware Rapid Risk Score for focused, actionable prioritization

SBOM export in SPDX, CycloneDX, JSON, and CSV

RapidFort Optimizer

Remove every component your application never uses.

Up to 99.9% CVE elimination from unused code paths

Up to 90% attack surface reduction via RBOM®-validated hardening

Hardened images automatically rebuilt every 24 hours, drop-in ready

RapidFort Profiler

Start with a secure foundation. Near-zero CVEs from day one.

Generates RBOM®, RapidFort's proprietary Runtime Bill of Materials

Separates real exploitable risk from theoretical CVE noise

Under 1% overhead. No code changes. No disruption.

RapidFort CART

Start with a secure foundation. Near-zero CVEs from day one.

US: FedRAMP, CMMC, cATO, DISA STIG, FIPS, NIST 800-53, NIST 800-190, SOC 2, PCI DSS

EU: NIS 2, CRA, SLSA. Validated via the OpenSCAP framework.

Drift detected immediately. Audit-ready reports and remediation scripts auto-generated.

Why RapidFort

Eliminates, not detects

CVEs are removed from your stack, not added to a backlog.

No code changes. Ever.

Hardening works entirely outside your application code.

Ships faster, stays secure

Cut development costs by over 10%. Speed releases by weeks, not months.

End-to-end, one platform

CVEs are removed from your stack, not added to a backlog.

Compliance built in

FedRAMP, CMMC, NIS 2, CRA, SOC 2, PCI DSS, FIPS, STIG, CIS.

Government validated

DoD Trusted. Iron Bank Approved. DISA Validated. Mission-critical ready.

RapidFort Vs Everything Else

Capability

RapidFort Platform

Traditional Alternatives

CVE Outcome

Up to 99.9% eliminated. Continuously.

Detected and prioritized. Your team still patches.

Secure Source

35,000+ near-zero CVE images, ready to drop in.

Scanning only. You inherit whatever the base has.

Attack Surface

Up to 90% reduction via RBOM®-validated hardening.

Static scanning. Nothing is removed.

Runtime Visibility

RBOM® shows what actually executes in production.

SBOM only. No runtime context.

Compliance

FedRAMP, CMMC, NIS 2, CRA, PCI DSS, FIPS, STIG, SLSA.

Point-in-time audits. Manual evidence collection.

Lifecycle

Intake to runtime. One platform. No gaps.

Fragmented tools. Isolated stages.

Proven in Production

“By leveraging the RapidFort platform, our organization halved our FedRAMP
certification costs and reduced time to compliance by a full three months.”

FedRAMP

CMMC

cATO

NIS 2

CRA

FedRAMP

PCI DSS

SOC 2

SLSA

FIPS 140-2/3

DISA STIG

CIS

NIST 800-53

NIST 800-190

DoD Trusted

DISA Validated

Works with your existing stack:

AWS

Google Cloud

Microsoft Azure

Carahsoft

GitHub

GitLab

Jenkins

Harness

CircleCI

Jira

Splunk

Sumo Logic

Aqua

Prisma

Twistlock

Snyk

Nessus

CrowdStrike

About RapidFort

RapidFort is the leader in Software Supply Chain Security, enabling organizations to eliminate risk across their software stack at scale. Its platform combines curated near-zero CVE container images, aged application libraries, malware removal threat intelligence, runtime profiling, and attack surface management to remove up to 99.9% of vulnerabilities within hours and reduce the attack surface by up to 90% without code changes.

‍

November 27, 2023

Case Study

The Future of Container Security

Container Security

Software Supply Chain Security

case study

The Future of
Container Security

How RapidFort Scanner Outperforms Industry Leaders

Executive Summary

In recent years, Software Attack Surface Management (SASM) has become a critical focus for organizations striving to maintain robust security postures. As the foundational step in developing a successful software security program, vulnerability scanning provides essential clarity by identifying potential weaknesses within software systems, allowing proactive remediation to mitigate risk. This is why accurate scanning is crucial, showcasing true risks that need remediation and thus fortifying an organization's defensive posture.

While various techniques exist for scanning software, such as internal and external scanning or compliance scanning, RapidFort stands out by employing a combination of patented mechanisms to achieve unparalleled reliability and accuracy. This cutting-edge approach not only provides the most dependable results but also empowers customers to consolidate multiple scanners into one, significantly reducing compute requirements and eliminating false positives.

This case study presents a comparative analysis of RapidFort against three industry-leading scanners, as per DoD customer requirements. The study involved a rigorous 20-container test designed to evaluate the performance and accuracy of each scanner. Key findings from the study reveal that RapidFort outperforms all three competitors, demonstrating superior accuracy and reliability in vulnerability detection.

As we delve deeper into the study's methodology and comparative analysis, it becomes evident that RapidFort's innovative approach to vulnerability scanning sets a new standard. Embrace the power of precision, consolidate your scanning needs, and take a proactive stance against potential threats the future of security starts with RapidFort.

Study Highlights:

RapidFort delivered the most accurate results in the study, successfully detecting all known vulnerabilities without introducing false positives or false negatives.

The other three scanners exhibited varying levels of detection accuracy, with some missing critical vulnerabilities and others generating false positives that could lead to unnecessary remediation efforts.

These findings underscore the importance of precision in vulnerability scanning minimizing both false positives and false negatives is essential to maintaining an effective and efficient security posture.

Introduction

Software and applications are the lifeblood of modern organizations, but in recent years, the industry has shifted away from traditional virtual machines to embrace containerization. The Application Container Market and Containers as a Service (CaaS) Market are both projected to grow at compound annual growth rates of over 30% in the next five years, reflecting the widespread adoption of container technology across both public and private sectors.

This rapid adoption underscores the urgent need for robust security measures tailored to containerized environments. Research indicates that 50% to 90% of software within production environments remains unused. These dormant components frequently include known vulnerabilities providing bad actors with opportunities to exploit systems, exfiltrate data, or gain persistent access while remaining undetected.

In this context, vulnerability scanning plays a critical role. Scanners must not only detect a wide range of vulnerabilities, but also deliver precision identifying real threats while minimizing noise from false positives and missed detections. As organizations strive to meet compliance standards, adopt DevSecOps practices, and manage growing software supply chains, the effectiveness of these scanners becomes central to maintaining security posture.

This study was designed to evaluate the performance of RapidFort's vulnerability scanner against three industry leaders as per DOD requirements. With a methodology aligned to real-world use cases including container images drawn from popular open-source registries and a range of operating systems the goal was to measure detection fidelity across consistent baselines. By providing clarity on scanner performance in terms of both breadth (number of tests passed) and depth (accuracy within those tests), this report enables security professionals to make informed, data-driven decisions about their vulnerability management strategies.

Methodology

To effectively evaluate RapidFort's vulnerability scanner performance against three industry-leading competitors, extensive testing was conducted across 20 container images encompassing a diverse range of programming languages and operating systems. This structured approach was designed to ensure a balanced, real-world, and comprehensive assessment of each scanner's detection capabilities across varied technical environments.

Study Design

In our methodology, the diversity and range of programming languages and operating systems used mirrored real-world containerized applications. By incorporating this variety, we ensured the study provided a holistic evaluation of each scanner's performance across different technical landscapes.

The selection of container images was meticulously curated to represent commonly used and high-value containers in both government and commercial sectors. This included popular open-source images favored by developers, ensuring that the tests were both relevant and reflective of typical usage scenarios.

Scoring System

To objectively compare scanner performance, we implemented a robust scoring system. Each test (container image) contained a set of predefined vulnerabilities, which served as the Ground Truth (GT). The scanners were tasked with identifying these vulnerabilities, and their results were then compared against the GT. Points were awarded based on correct matches to the GT. Specifically:

A scanner received one point for each correctly identified vulnerability.

No points were awarded for incorrect or missed vulnerabilities.

Given that each test varied in the number of embedded vulnerabilities, it was essential to normalize the scoring to ensure fairness. We achieved this by calculating both the number of tests correctly scored and the total number of vulnerabilities accurately identified. This dual-metric approach provided a comprehensive view of each scanner's performance, accounting for both breadth (number of tests) and depth (number of vulnerabilities).

Summary of Results

100%

Overall accuracy rate

SCANNER A

74%

SCANNER B

86%

SCANNER C

51%

The results of our comparative study reveal significant differences in the performance of the three vulnerability scanners. RapidFort consistently outperformed all three competitors, demonstrating superior accuracy and reliability in vulnerability detection.

Performance Metrics

Our evaluation showed that RapidFort scored better than Scanner A in all 20 tests, outperformed Scanner B in 19 tests, and surpassed Scanner C in all 20 tests. The overall accuracy rates were as follows:

RapidFort:

100%

Scanner A:

74%

Scanner B:

86%

Scanner C:

51%

Implications of Findings

The high accuracy rate achieved by RapidFort has significant implications for vulnerability detection and overall security posture. In the context of vulnerability scanning, accuracy is paramount it ensures that true risks are identified and addressed while minimizing the operational noise caused by false positives and reducing exposure from undetected vulnerabilities due to false negatives.

Reduction of False Positives:

High accuracy in vulnerability detection reduces the number of false positives incorrect identifications of vulnerabilities that do not actually exist. These inaccuracies can overwhelm security teams, wasting valuable time and diverting attention from genuine threats. In fact, 44% of organizations report spending over 21 hours per week remediating CVEs.

By minimizing false positives, RapidFort enables security teams to focus on real, actionable issues, improving both the efficiency and effectiveness of vulnerability management workflows.

Reduction of False Negatives:

Equally important is minimizing false negatives, which occur when actual vulnerabilities go undetected. These pose a serious risk, as they leave critical issues unaddressed potentially exposing organizations to exploitation.

RapidFort's superior detection accuracy significantly reduces false negatives, ensuring that fewer vulnerabilities are overlooked. This enhances the overall security posture of containerized applications and helps safeguard production environments from undetected threats.

In summary, the results of our study clearly demonstrate that RapidFort sets a new standard for vulnerability scanning within containerized environments. Its superior accuracy and reliability make it an invaluable tool for organizations seeking to strengthen their security posture and protect containerized workloads against evolving threats.

Why You Should Run with RapidFort

The findings from our study not only underscore RapidFort's superior performance but also highlight the distinct strengths that enable it to excel in vulnerability detection. These strengths rooted in advanced technology and comprehensive methodologies translate into tangible, real-world benefits for securing containerized environments.

Comprehensive Package Detection:

RapidFort employs proprietary techniques to achieve deep and comprehensive package detection. This includes identifying all files and packages whether or not they are managed by a package manager as well as binaries, associated vulnerabilities, and their dependencies within a containerized application.

By thoroughly scanning and analyzing these components, RapidFort ensures that no potential vulnerabilities are overlooked during security analysis.

Superior Vulnerability Database Quality:

RapidFort curates and integrates data from a wide range of trusted sources, intelligently filtering out noise caused by false positives and exposing false negatives. This meticulous curation enables the scanner to accurately match identified packages with known vulnerabilities, delivering dependable results that security teams can trust.

Additionally, RapidFort's advisory system provides clear justification when a vulnerability is deemed not applicable, along with direct references to the original sources from which those justifications were derived.

Real-World Impact

The importance of these strengths becomes evident when considering the real-world consequences of inaccuracies in vulnerability detection. Missing critical vulnerabilities due to false negatives can result in severe outcomes, as illustrated by the recent high-profile incident involving a backdoor in XZ Utils, a widely used utility. When a scanner fails to detect such a vulnerability, it leaves the organization exposed to exploitation and significantly increases the risk of security breaches.

Conversely, an overabundance of false positives can overwhelm security teams, forcing them to waste valuable time and resources chasing non-existent threats. This not only reduces operational efficiency but also increases the likelihood that genuine vulnerabilities will be overlooked. RapidFort's high detection accuracy helps mitigate both risks, allowing security teams to focus on addressing real issues and maintaining a resilient security posture.

100% Accuracy

Detected all known vulnerabilities in the 20-container test no false positives, no false negatives.

Deep Package Detection

Scans all files and binaries regardless of package manager, leaving zero blind spots.

Trusted DB Quality

Curated, multi-source vulnerability database with clear justification for every finding.

About Us

At RapidFort, we are dedicated to empowering organizations to enhance their container security and vulnerability management practices. As a leading provider of cloud-native cybersecurity solutions, we combine Near-Zero CVE Images with our CI/CD-native SASM platform to remove up to 99% of CVEs automatically, with no code changes helping teams reduce their attack surface and secure containerized environments.

We trust that the insights presented in this report will aid organizations in gaining a deeper understanding of their security landscape and taking proactive steps to fortify their defenses.

To learn more about the RapidFort platform, please visit www.rapidfort.com

Continuously Eliminate Up to 99.9% of CVEs Without Code Changes

Request Access

‍

Beyond Identity Accelerates FedRAMP Compliance with RapidFort

April 10, 2025

Case Study

Beyond Identity Accelerates FedRAMP Compliance with RapidFort

Compliance & Governance

Software Supply Chain Security

case study

Beyond Identity Accelerates FedRAMP Certification with RapidFort

Industry

Identity and Access Management

Challenge

Achieve FedRAMP Moderate certification efficiently and cost-effectively while maintaining development speed and audit readiness

Solution

RapidFort Platform and Curated Near Zero CVE Images

The Challenge

Beyond Identity, a leading provider of identity and access management solutions, needed to achieve FedRAMP Moderate certification under tight deadlines and complex compliance requirements. FedRAMP certification involves extensive documentation, rigorous security testing, and ongoing alignment with federal standards. Beyond Identity sought to simplify and accelerate this process without diverting engineering resources from core product innovation.

Vulnerability Management

Container images required significant hardening to eliminate unnecessary packages and open vulnerabilities.

Continuous Compliance

Monthly audits required continuous monitoring and consistent documentation for ongoing compliance.

Engineering Efficiency

Manual SSDLC and image management consumed valuable engineering time.

Federal Market Entry

Meeting FedRAMP timelines was critical to accelerate entry into the U.S. federal market.

The Solution

Beyond Identity selected the RapidFort Platform and Curated Near Zero CVE Images to accelerate FedRAMP readiness and reduce engineering workload. RapidFort’s platform provided these key capabilities:

Pre-Hardened, Near Zero CVE Images

Hardened base images aligned with NIST 800-70 and FIPS 140-2/3 standards, significantly reducing setup time.

FedRAMP-Specific Audit Support

Tools and documentation simplified creation of POA&Ms and SBOMs for compliance audits.

Security Benchmarking & Hardening

Enabled Beyond Identity to ensure STIG compliance across application layers and streamline SSDLC integration.

RapidFort was an excellent and comprehensive partner during our FedRAMP journey. They cut the cost of image hardening and SSDLC efforts by 50%, shaved three months off our overall compliance timeline, and delivered outstanding support every step of the way.”

Results

By leveraging RapidFort, Beyond Identity achieved measurable improvements:

50% Cost Reduction

Image hardening and SSDLC costs were cut in half compared to internal builds

3-Month Acceleration

FedRAMP compliance time was reduced by three months, accelerating market readiness

Improved DevSecOps Velocity

Hardened containers integrated directly into SSDLC pipelines, improving delivery speed and audit readiness

Conclusion

RapidFort played a critical role in Beyond Identity’s ability to move quickly and confidently through FedRAMP Moderate certification. Its automation-driven platform enabled faster compliance, lower costs, and stronger assurance — empowering engineering teams to focus on secure innovation.

Eliminate Attack Vectors At The Source

Continuously Eliminate Up to 99.9% of CVEs Without Code Changes

Request a Access

‍

RapidFort Kimia: The Secure Successor to Kaniko

Whitepaper

December 2, 2025

RapidFort Kimia: The Secure Successor to Kaniko

Kimia is RapidFort’s secure, rootless, and fully backward-compatible successor to Kaniko—designed for modern, compliance-aligned container builds.

RapidFort Platform

The Hidden Dangers of Proprietary Open Source Distributions

Whitepaper

November 10, 2025

The Hidden Dangers of Proprietary Open Source Distributions

Not all “open source” is truly open. This whitepaper exposes how closed Linux distributions limit control, obscure vulnerabilities, and erode developer independence.

Cloud Security Fundamentals

Software Supply Chain Security

Whitepaper

November 23, 2024

Your Path to Near-Zero CVE Images

Secure Base Images

Image Hardening & Optimization

Whitepaper

October 7, 2024

Optimize & Secure Your Cloud

Cloud Security Fundamentals

Image Hardening & Optimization

Whitepaper

October 7, 2024

Secure Software Development Lifecycle

DevSecOps & Best Practices

Software Supply Chain Security

Navigating the Evolving Threat Landscape

Whitepaper

October 7, 2024

Navigating the Evolving Threat Landscape

Threats

DevSecOps & Best Practices

Whitepaper

September 30, 2024

RapidFort Attack Surface Management

Discover how RapidFort's SASM platform automates vulnerability remediation, accelerates secure software delivery, and reduces development costs within CI/CD pipelines.

RapidFort Platform

Software Supply Chain Security

Accelerating Secure Software Delivery with a Three-Step Approach

Whitepaper

September 18, 2024

Accelerating Secure Software Delivery with a Three-Step Approach

RapidFort Platform

DevSecOps & Best Practices

EU Cyber Resilience Act & Mythos: Securing Your Container Infrastructure with RapidFort

Whitepaper

July 22, 2026

EU Cyber Resilience Act & Mythos: Securing Your Container Infrastructure with RapidFort

No items found.

No items found.

Runtime Bill of Materials (RBOMs®) operate as a dynamic, execution-aware refinement of the Software Bill of Materials (SBOM).

Cloud Security Fundamentals

Compliance Guide

July 17, 2026

What is an RBOM® (Runtime Bill of Materials)?

Runtime Bill of Materials (RBOMs®) operate as a dynamic, execution-aware refinement of the Software Bill of Materials (SBOM). SBOMs record all software artifacts associated with a build, whereas RBOMs® capture only the components that are actually executed or loaded into memory at runtime. Thinking about how an RBOM improves compliance requires analyzing large codebases, identifying unused components, isolating what is truly essential, and reducing SBOM elements that unnecessarily expand the attack surface.

SBOM

Records all software artifacts associated with a build.

RBOM®

Captures only the components that are actually executed or loaded into memory at runtime.

RBOM® as a Risk Reduction Tool

One of the best ways to think about RBOM® is in terms of risk reduction. In many DevSecOps pipelines, teams believe security has been fully integrated once scanning is enabled and builds are passing. However, if a scanner is configured too permissively or lacks meaningful baselining, there may be no effective comparison between versions or visibility into what truly changed. Simply comparing one build to the next does not always provide actionable insight. RBOM® goes further by establishing a runtime baseline and evaluating which libraries, binaries, dependencies, and other code elements are actually executed. This approach ensures that organizations do not spend time managing vulnerabilities in code their product does not use.

RBOM® and FedRAMP CM-8 Compliance

FedRAMP, under CM-8 guidance, requires a complete and up-to-date inventory of all system components. This process often begins with an SBOM. However, just because you can include every possible item does not mean you should. In creating the RBOM®, the first step is analyzing all components within the codebase. Comparing the SBOM to the RBOM® brings clarity to what is actually required versus what merely exists.

Why Dependency Trees Keep Growing

The rise of open-source usage, AI-assisted development, and rapid coding practices has significantly expanded dependency trees. Many projects include just-in-case libraries that are never used at runtime. RBOM® comparison identifies unused components within the overall package, uncovering what might otherwise take engineers hundreds of hours to manually analyze and resolve.

Finding What's Actually Unused

The next RBOM® step highlights unused components for further evaluation and potential removal. These elements are flagged for deeper analysis within the platform. For example, one Python graphics library used by a bank had over 3,200 packages installed, yet only 200 were actually used at runtime. This does not imply that the remaining packages were malicious or without value, only that they were not used in that deployment. Many production environments lack a systematic way to surface these inactive components.

3,200+Packages installed in one bank's Python graphics library

200Packages actually used at runtime

Highlighting which packages are actually used can significantly reduce security vulnerabilities. In this case, eliminating unused packages reduced Common Vulnerabilities and Exposures (CVEs) associated with dormant code while shrinking the overall attack surface. Beyond lowering security risk, this reduction also improved build times and increased efficiency within production pipelines.

Aligning the RBOM® with the Final SBOM

RBOM® supports a specific approach for eliminating excess SBOM components. This approach removes unused code (such as the 3,000 dormant Python packages) to streamline the artifact down to essential runtime components. Ultimately, the RBOM® should closely align with the final SBOM. This means no explaining discrepancies to auditors, no securing unused code, and no engineering time wasted on non-essential elimination efforts.

Is It Time to Deploy an RBOM®?

Overall, RBOM® is an efficient tool for evaluating the SBOM at runtime, ensuring that everything listed in the inventory is actually being used. If your platform or product uses 80% of its footprint for unused components, and 95% of your vulnerabilities reside there, it may be time to deploy an RBOM®.

80%Of platform footprint made up of unused components

95%Of vulnerabilities residing in that unused footprint

Break down large codebases

Identify unused components

Isolate essential runtime elements

Eliminate unnecessary vulnerabilities

If you want to dramatically reduce CVEs and strengthen your compliance posture, RapidFort does this.

Key Takeaways

RBOM® captures only the components actually executed or loaded into memory at runtime, unlike an SBOM, which records all software artifacts associated with a build.
RBOM® establishes a runtime baseline, evaluating which libraries, binaries, and dependencies are actually executed.
FedRAMP CM-8 requires a complete, up-to-date inventory of system components, and comparing the SBOM to the RBOM® clarifies what is actually required versus what merely exists.
In one example, a bank's Python graphics library had over 3,200 packages installed, yet only 200 were actually used at runtime.
Eliminating unused packages reduced CVEs associated with dormant code, shrank the attack surface, and improved build times.
Ultimately, the RBOM® should closely align with the final SBOM, removing the need to explain discrepancies to auditors or secure unused code.

‍

RapidFort Recognized as a CRN® 2026 Stellar Startup

Press Release

November 9, 2026

RapidFort Recognized as a CRN® 2026 Stellar Startup

No items found.

RapidFort Recognized as a CRN ® 2026 Stellar Startup for Delivery of Software

Supply Chain Security to the Channel

RapidFort Recognized as Channel’s Most Comprehensive End-to-End Software Supply Chain Security

Solution from Intake to Runtime

Sunnyvale, Calif. — Nov. 9, 2026 — RapidFort, the leader in Software Supply Chain Security (SSCS) with
the largest distribution of curated truly open-source software, today announced that CRN ® , a brand of
The Channel Company, has named RapidFort as a 2026 Stellar Startup for its leading SSCS solution. This
prestigious list highlights fast-rising technology vendors that are driving innovation and fostering growth
in the IT channel with groundbreaking products.
Each technology vendor featured on the CRN 2026 Stellar Startups list is distinguished by its
commitment to innovation and to delivering cutting-edge offerings that help solution providers stand
out in today’s fast-changing IT landscape. This annual list serves as an invaluable resource for solution
providers making business-critical strategic decisions and exploring new technologies and services to
add to their portfolios to give them a competitive advantage and drive success.
“We’re proud to recognize the innovative companies featured on this year’s Stellar Startups list,” said
Jennifer Follett, Vice President, U.S. Content, Executive Editor at CRN, The Channel Company. “These
organizations are redefining what’s possible in the IT channel by bringing fresh ideas, transformative
technologies and a strong commitment to partner success. We look forward to seeing the impact they
continue to make across the industry.”
RapidFort has a growing presence in the channel, due to the solution’s easy installation in end user sites
and revenue opportunities realized by partners. Partnerships have increased 50 percent year-over-year
over the past three years, and RapidFort is becoming an important solution in partners’ suite of security
offerings. Partners are able to add on services such as running RapidFort as a managed service, and offer
leading Software Supply Chain Security functionality in their portfolios.
“RapidFort is deeply committed to our channel partners,” said Avery Lyford, VP of Commercial
Partnerships at RapidFort. “It’s gratifying to be recognized by CRN for our innovation in delivering a
channel-friendly leading Software Supply Chain Security Solution from intake to runtime. RapidFort

works closely with our partners to develop easily deployed solutions that provide customer value and
channel opportunities.”
RapidFort is a comprehensive, end-to-end platform that secures the entire software lifecycle from
intake to runtime. It delivers near-zero CVE images, malware scanning, and production runtime
protection, enabling organizations to eliminate up to 99.9% of security vulnerabilities. RapidFort
empowers development teams to innovate quickly with industry-standard open-source and AI
technologies while abiding by organizations’ security requirements, providing continuous security and
compliance without vendor lock-in or operational bottlenecks.
Coverage of the 2026 CRN Stellar Startups can be found at crn.com/StellarStartups.
About The Channel Company
The Channel Company (TCC) is the global leader in channel growth for the world’s top technology
brands. We accelerate success across strategic channels for tech vendors, solution providers and end
users with premier media brands, integrated marketing and event services, strategic consulting, and
exclusive market and audience insights. TCC is a portfolio company of investment funds managed by
EagleTree Capital, a New York City-based private equity firm. For more information,
visit thechannelco.com. Follow The Channel Company at LinkedIn and X.
About RapidFort
RapidFort leads the Software Supply Chain Security market with the largest distribution of curated,
genuinely open-source software. Its platform enables organizations to eliminate risk at scale through
hardened near-zero CVE container images, runtime profiling, attack surface management, and the
industry’s first independently malware-scanned open-source images – cutting CVE exposure by up to
99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner®
Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as
a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint
Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

‍

RapidFort to Deliver Hardened Container Images for GitLab Regulated Self-Managed Deployments

Press Release

November 2, 2026

RapidFort to Deliver Hardened Container Images for GitLab Regulated Self-Managed Deployments

No items found.

RapidFort to Deliver Hardened Container Images for GitLab Regulated Self-Managed Deployments

SUNNYVALE, Calif. — Nov. 3, 2026 — RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced a new strategic partnership with GitLab to deliver hardened container images for GitLab regulated Self-Managed Deployments. The offering enables development and security teams to identify and eliminate vulnerabilities within the GitLab workflows they already use, without requiring changes to application code or migration to a proprietary operating system.

The partnership combines GitLab’s DevSecOps platform with RapidFort’s industry-first combination of minimal and near-zero CVE container images, attack surface management, and continuous runtime monitoring. The images retain GitLab’s existing functionality and version tags, so teams can adopt them without changing how they build and ship software.

“Regulated organizations need confidence in what they deploy and flexibility to meet their security requirements,” said Omer Azaria, VP of Product Management, GitLab. “Through our strategic partnership with RapidFort, regulated and air-gapped customers have a new way to get hardened, continuously patched GitLab images, along with audit-ready evidence, without slowing development.”

“This partnership is designed to let joint customers establish a golden image pipeline for GitLab – a single, centrally governed, hardened source of GitLab images that flows through the customer's build, security scanning, and deployment stages,” said George Manuelian, Chief Strategy Officer at RapidFort. “It moves the industry from detecting vulnerabilities to eliminating them at the source, making secure-by-default software achievable at scale inside the platform where code is built.

“For self-managed customers, security doesn’t stop at the application layer. As AI accelerates vulnerability discovery, customers need to apply the same security scrutiny to the container images they use to deploy GitLab. This partnership gives customers a traceable path to hardened images and supporting security evidence,” said Martin Brümmer, Senior Product Manager, GitLab.

Today’s announcement builds on RapidFort existing public-sector work; it already publishes an optimized, hardened image for GitLab Runner Iron Bank, and compiles security benchmarks into audit-ready evidence for FedRAMP, Authorization to Operate (ATO), Cybersecurity Maturity Model Certification (CMMC), the EU’s Digital Operational Resilience Act (DORA), and the Cyber Resilience Act (CRA), while still moving at commercial development speed.

Under the partnership, GitLab’s on-premises images are now available through the RapidFort Curated Catalog, a library of more than 48,000 base and third-party container images spanning every major Linux distribution. Curated GitLab images will retain GitLab’s existing functionality, version tags, and configuration surface. Key characteristics of curated GitLab images from this partnership include:

● Near-zero CVE posture, updated daily. Images are continuously patched as upstream fixes land, with published SLAs of seven calendar days for Critical/High severity CVEs, 21 days for Medium severity CVEs, and 28 days for Low severity CVEs, once an upstream patch is available.

● FIPS 140-2/140-3 alignment. FIPS-validated OpenSSL providers (covering downstream consumers such as cURL) are built into applicable images, with images tested against a FIPS-enabled kernel helping customers meet a prerequisite for federal and defense deployments.

● Security Technical Implementation Guide (STIG)-hardened configurations. These reduce the manual effort security teams spend remediating baseline findings before GitLab can be authorized for use in regulated environments.

● Minimal attack surface. Hardened/community image variants strip out unused packages, shells, and debug utilities, reducing image size and CVE count well beyond the base curated image.

● Audit-ready compliance evidence. RapidFort’s Compliance and Remediation Tool (CART) component continuously validates images against security baselines and generates compliance reports usable in support of FedRAMP, CMMC, CRA, SOC 2, and CIS Benchmark assessments – reducing the manual evidence-gathering burden during ATO and audit cycles.

Availability
Multiple GitLab images are available immediately in the RapidFort Curated Images catalog, giving joint customers a ready-to-use starting point for hardened, on-prem GitLab deployments. To buy or for more information, visit https://www.rapidfort.com/schedule-a-call.

About RapidFort
RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

‍

RapidFort Selected to Present on Software Supply Chain Security

Press Release

October 22, 2026

RapidFort Selected to Present on Software Supply Chain Security

No items found.

RapidFort Selected to Present on Software Supply Chain Security and Exhibiting During Important Events Next Quarter

Share

Company Participating in SF Tech Week, OWASP Global AppSec USA, KubeCon+CloudNativeCon N.A., and FutureCon

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced that it will present on Software Supply Chain Security and exhibit during a number of important industry events next quarter.

RapidFort participating in SF Tech Week, OWASP Global AppSec USA, KubeCon+CloudNativeCon N.A., and FutureCon in Q4.

Share

RapidFort will participate in the following important upcoming industry events in Q4:

SF Tech Week, San Francisco. RapidFort is hosting an evening event for defense technologists during Tech Week, including a speaker panel titled Bridging Innovation and Defense announcing the SpaceWERX Transition Program on Oct. 6 from 6 pm – 8 pm PDT.
OWASP Global AppSec USA, San Francisco. RapidFort is a Silver sponsor of the leading event for application security professionals, and will exhibit in Booth S21 during the event from Nov. 5 – 6.
KubeCon+CloudNativeCon N.A., Salt Lake City. RapidFort is a Silver sponsor of this flagship Linux Foundation event, and will exhibit in Booth 310 during the event from Nov. 9 – 12.
FutureCon, Boston, Mass. RapidFort is a Silver sponsor of this cybersecurity industry event and will exhibit during the Nov. 19 event.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry’s first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort Named 2026 Top InfoSec Innovator for Software Supply Chain Security

Press Release

October 20, 2026

RapidFort Named 2026 Top InfoSec Innovator for Software Supply Chain Security

No items found.

RapidFort Wins Top InfoSec Innovator Award for 2026 as Market Leader in

Software Supply Chain Security

RapidFort Recognized for Delivering Industry’s Most Comprehensive End-to-End Software Supply Chain

Security Solution from Intake to Runtime

Sunnyvale, Calif. — Oct. 20, 2026 — RapidFort, the leader in Software Supply Chain Security (SSCS) with
the largest distribution of curated truly open-source software, today announced it has been named the
Market Leader in Software Supply Chain Security and winner of the Top InfoSec Innovator Award for
2026 by Cyber Defense Magazine (CDM), the industry’s leading electronic information security
magazine.
“We scoured the globe looking for cybersecurity innovators that could make a huge difference and
potentially help turn the tide against the exponential growth in cyber-crime,” said Yan Ross, Editor of
Cyber Defense Magazine. “RapidFort is worthy of being named a winner of these coveted awards and
consideration for deployment in organizations’ environments.”
This is CDM’s 14th year of honoring cybersecurity innovators. Judges for these prestigious awards
include cybersecurity industry veterans, trailblazers and market makers Ron Gula of Gula Tech
Adventures, Gary Miliefsky of CDMG, Dr. Lindsey Polley de Lopez of VentureScope, Katie Gray of In-Q-
Tel, Robert R. Ackerman Jr. of DataTribe, Ira Winkler from CruiseCon, Dino Boukouris of AltitudeCyber;
and with much appreciation to emeritus judges Robert Herjavec of Cyderes, Dr. Peter Stephenson of
CDMG, and David DeWalt of NightDragon. The full list of the Top InfoSec Innovators for 2026 is found
here: https://cyberdefenseawards.com/top-infosec-innovators-for-2026/ .
“It’s rewarding to be validated as the market leader in Software Supply Chain Security in one of the
world’s most prestigious cybersecurity awards programs from Cyber Defense Magazine,” said Michael
Wood, RapidFort CMO. “This award stands out in the industry because winners are determined by a
judging panel of leading experts, not vendor content submissions. 2026 has been a record-setting year
for RapidFort as organizations across the globe turn to us to best protect themselves from SSCS threats
and secure their development operations.”

RapidFort is a comprehensive, end-to-end platform that secures the entire software lifecycle from
intake to runtime. RapidFort integrates smart profiling, near-zero CVE images, code reduction, malware
scanning, and production runtime protection, enabling organizations to eliminate up to 99.9% of
security vulnerabilities. RapidFort empowers development teams to innovate quickly with industry-
standard open-source and AI technologies while abiding by organizations’ security requirements,
providing continuous security and compliance without vendor lock-in or operational bottlenecks.
About Cyber Defense Magazine
Cyber Defense Magazine was founded in 2012 by Gary S. Miliefsky, globally recognized cyber security
thought leader, inventor and entrepreneur, and continues to be the premier source of IT Security
information. It is managed and published by and for ethical, honest, passionate information security
professionals. Its mission is to share cutting-edge knowledge, real-world stories and awards on the best
ideas, products and services in the information technology industry. It delivers electronic magazines
every month online for free, and limited special editions exclusively for the RSAC, Black Hat and Cyber
Defense Conferences. Learn more at http://www.cyberdefensemagazine.com. Cyber Defense Magazine
is a proud member of the Cyber Defense Media Group.
About RapidFort
RapidFort leads the Software Supply Chain Security market with the largest distribution of curated,
genuinely open-source software. Its platform enables organizations to eliminate risk at scale through
hardened near-zero CVE container images, runtime profiling, attack surface management, and the
industry’s first independently malware-scanned open-source images – cutting CVE exposure by up to
99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner®
Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as
a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint
Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

‍

RapidFort and SpaceWERX Unite to Secure America's AI Supply Chain

Press Release

October 8, 2026

RapidFort and SpaceWERX Unite to Secure America's AI Supply Chain

No items found.

RapidFort and SpaceWERX Convene Industry Leaders in San Antonio to Secure America’s AI Software Supply Chain

Event Brings Together Government and Industry to Address AI Software Exploitation, Accelerated Mission Software Delivery, and Emerging Quantum Threats

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, and SpaceWERX, the innovation arm of the United States Space Force, today announced a conference focused on securing America’s AI software supply chain and strengthening national security mission assurance. The conference is being held Thursday, Oct. 8, at the University of Texas at San Antonio’s San Pedro 1 Building, in partnership with the university and its National Security Collaboration Center.

The event convenes industry innovators and national security practitioners to examine how to eliminate software attack vectors at the source, accelerate secure mission software delivery, and prepare critical infrastructure for emerging AI and quantum threats.

RapidFort and SpaceWERX event brings together government and industry to address AI software exploitation, accelerated mission software delivery, and emerging quantum threats.

Building on the Cooperative Research and Development Agreement (CRADA) between RapidFort and SpaceWERX, the conference will provide a forum for connecting commercial expertise with operational requirements. Participants will share technical perspectives and implementation practices to address software security challenges across the national security ecosystem.

Discussions will examine how national security organizations can advance the objectives of DoW Instruction 8430.01, “Accelerated Mission Software,” while maintaining software supply chain security and mission assurance. Participants will explore how commercial capabilities can support faster software delivery, reduce vulnerability exposure, and provide verifiable security evidence to inform mission decisions.

The conference focuses on five areas related to emerging threats and opportunities:

Defensive AI: Outpacing the AI Exploit Window
How The AI Supply Chain Is the New National Security Perimeter
From SBOM to Mission Assurance: Evidence That Actually Changes Risk
Securing the Agentic Enterprise: Identity, Authority, and Blast Radius Best Practices
The 2030 Problem Arrives Early: AI, Quantum, and Critical Infrastructure Best Practices

Across these panels, participants will examine how software transparency and operational evidence can support risk reduction, how identity and authority controls can limit the impact of compromised agentic systems, and how critical infrastructure organizations can prepare for migration to post-quantum cryptography.

“America’s ability to field AI capabilities depends on trust in the software that powers them,” said Austin Sedaghatpour, National Security Lead at RapidFort. “Speed and security must advance together. Our goal is to move beyond discussing risk and focus on practical ways to eliminate software attack vectors at the source. Building on our CRADA with SpaceWERX, this conference connects commercial expertise with operational priorities so warfighters and Guardians can benefit from American innovation without inheriting avoidable software risk.”

RapidFort has a proven commitment to open source and community collaboration, including participation in the Silicon Valley AI and cybersecurity communities and service on the governing board of the Akrites Project. The conference extends this commitment by bringing government and industry practitioners together around shared security priorities.

The conference helps participants identify shared security challenges and opportunities for continued technical collaboration, with a practical focus on reducing software exploitation risk and accelerating secure mission delivery.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images - cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

About SpaceWERX

As the innovation arm of the United States Space Force and a unique division within AFWERX, SpaceWERX inspires and empowers collaboration with innovators to accelerate capabilities and shape the future in space. SpaceWERX identifies, validates, and transitions dual use technologies from across the commercial space ecosystem to deliver capabilities at speed and scale in a contested domain. In partnership with Space Systems Command’s Commercial Space Office, SpaceWERX connects innovative technology developers with operational experts, acquisition professionals, and Guardian talent to bridge innovation and acquisition.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort and SpaceWERX Sign CRADA to Cut Space Force ATO Timelines

Press Release

October 6, 2026

RapidFort and SpaceWERX Sign CRADA to Cut Space Force ATO Timelines

No items found.

RapidFort and SpaceWERX Enter Cooperative Research and Development Agreement to Improve Cyber Readiness and Reduce ATO Timescales for U.S. Space Force

Relationship Addresses Improvement of USSF Cyber Readiness, Reduction of AI Software Exploitation Risk, Rapid Acceleration of ATOs, Fast-Tracking of Security Clearances, and Cybersecurity Protection of Space Systems from Post-Quantum Encryption Risk

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced it has signed a Cooperative Research and Development Agreement (CRADA) with SpaceWERX, the innovation arm of the United States Space Force (USSF) and a division of the Air Force Research Laboratory (AFRL).

This strategic partnership establishes a collaborative framework to build a larger industry consortium to enable SpaceWERX to co-develop, test, and evaluate next-generation capabilities that reduce AI software vulnerability exploitation risk, improve cyber readiness, accelerate ATOs, and reduce post-quantum encryption risk across critical space systems. For the USSF, the CRADA is designed to improve cyber readiness, allowing USSF Guardian personnel to field new software capabilities securely, while having them approved and deployed at operational speed. Under the terms of the CRADA, industry organizations will share technical expertise, infrastructure, and operational insights to accelerate commercialization and cybersecurity mission readiness for space systems.

New RapidFort and SpaceWERX relationship addresses improvement of US Space Force cyber readiness, reduction of AI software exploitation risk, rapid acceleration of ATOs, and cybersecurity protection of space systems from post-quantum encryption risk.

As a CRADA partner, RapidFort now has access to SpaceWERX’s network of operational experts, acquisition professionals, and Guardian talent. Likewise, SpaceWERX has access to RapidFort’s ecosystem of software industry and open-source partners. This collaborative feedback loop will enable the Space Force to validate and refine its capabilities in near real time, ensuring commercial solutions map directly to the dynamic requirements of the contested space domain.

“Partnering with SpaceWERX through this CRADA represents a major milestone in our mission to bridge commercial breakthroughs with national security priorities,” said Mehran Farimani, CEO of RapidFort. “Our focus is clear: Empower the guardians to eliminate AI-driven software attack vectors at the source, accelerate ATOs so Guardians can field next-generation software without trading speed for security, and prepare space systems for emerging post-quantum threats. Through this CRADA we can bring best of industry software into the heart of USSF operations, leveraging the benefits of AI while reducing the security risks of AI.”

RapidFort has been a key member of the Silicon Valley AI and cybersecurity communities and serves on the governing board of the Akrites Project, among other community-based software initiatives.

The joint research under this CRADA will focus primarily on:

Efforts to continuously reduce AI software vulnerability exploitation risk for the Department of War, aligned with the recent presidential executive order on Promoting Advanced Artificial Intelligence Innovation and Security.
Development and evaluation of capabilities to reduce post-quantum encryption risk, aligned with the presidential order on Securing the Nation Against Advanced Cryptographic Attacks.
Expansion of RapidFort complimentary Rapid ATO education and “Ask an Approving Officer Program,” providing industry and Guardians a repeatable pattern to deliver reduced ATO timescales. This is especially important for AI software, which is now a national Department of War priority.
RapidFort publishes a patch-time SLA once an upstream fix exists: Seven calendar days for Critical/High, 21 for Medium, 28 for Low.
Expansion of the complimentary “Ask a Facilities Security Officer (FSO)” education program to help accelerate clearances for key projects within the SpaceWERX ecosystem.

This CRADA underscores SpaceWERX’s ongoing commitment to cultivating partnerships with the community of leading software, AI, cybersecurity, and defense startups, thus leveraging commercial agility to rebuild the nation’s technological arsenal for the modern era.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images - cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

About SpaceWERX

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

Press Release

October 1, 2026

RapidFort Integrates with Wiz

No items found.

RapidFort Integrates with Wiz, Closing the Loop Between Cloud Vulnerability Detection and Near-Zero CVE Remediation

Joint Customers Can Now Utilize RapidFort Leading Set of Curated Hardened Container Images, Enriching CVE Findings from Wiz with RapidFort Evidence-Backed Advisories and Direct Path to Near-Zero CVE Remediation

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced interoperability with Wiz, a leading cloud and AI security platform that’s now part of Google Cloud. With this integration, joint customers can now scan and identify RapidFort industry-largest set of curated and hardened images for the presence of CVEs, and leverage RapidFort advisory-backed remediation status alongside those findings – without leaving the Wiz platform or changing how they scan today.

“We’re happy to welcome RapidFort to the Wiz Integration Network,” said Oron Noah, VP of Product, Extensibility and Partnerships at Wiz. “Managing cloud vulnerabilities isn’t just about identifying risk, it’s about making remediation as seamless as possible. By surfacing RapidFort advisory feed directly within the Wiz platform, we’re helping joint customers clear out false positives and fix CVEs quickly.”

Joint RapidFort and Wiz customers can now utilize RapidFort leading set of curated hardened container images, enriching CVE findings from Wiz with RapidFort evidence-backed advisories and direct path to near-zero CVE remediation.

While Wiz identifies CVEs across cloud and container estates, this integration provides joint customers with a streamlined remediation path. When a CVE finding touches a RapidFort-curated or -hardened image, Wiz surfaces RapidFort advisory context, and the near-zero CVE curated equivalent is available as a direct, typically one-line, remediation. RapidFort curated images retain the same OS, language stack, size, and version tags Wiz customers already use. Its advisory determinations are backed by primary sources and applied consistently across scanners, which gives Wiz customers a documented reason for each false-positive determination rather than a black-box suppression.

“This important integration extends the stated scanner-agnostic strategy of RapidFort into a named, directory-listed partnership with one of the most prominent players in the category,” said George Manuelian, Chief Strategy Officer at RapidFort. “Joint Wiz customers can now spend fewer hours triaging CVEs that were never exploitable in the first place, and have a documented remediation path the moment a real CVE is found, all inside the scanning tool they already run. Now they do not have to choose between their existing scanner investment and adopting a near-zero CVE image supply chain – these two solutions now work together natively.”

Joint customers can now leverage RapidFort industry-leading vulnerability remediation.

RapidFort is the only curated-image distributor that supports all major LTS OS releases in one catalog (Ubuntu, Debian, Red Hat/UBI, and Alpine) rather than standardizing customers onto a single distribution.
RapidFort Curated Images retain the joint customer existing OS, size, and version tags, as a drop-in replacement for CVE remediation not a migration; customers change a FROM line rather than re-platforming. This lowers total cost of ownership and removes the main adoption barrier for both developers (no re-testing a new base) and security teams (no new tooling to learn).
RapidFort Advisory determinations are evidence-backed (NVD, distro trackers, upstream commits) and apply consistently regardless of which scanner reported the finding.
RapidFort publishes a patch-time SLA once an upstream fix exists: Seven calendar days for Critical/High, 21 for Medium, 28 for Low.
RapidFort images are DISA STIG-verified and support full FIPS 140-3 requirements.

For partners building on or alongside RapidFort, this latest integration is a proof point that RapidFort advisory feeds and RapidFort curated catalogs are designed to plug into the tools partners already provide, rather than requiring a closed, single-vendor stack.

Availability

The RapidFort and Wiz integration is currently available and listed live today in the Wiz Integrations directory. For more information visit https://www.wiz.io/integrations?q=rapidfort.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

RapidFort and Aqua Security Partner to Enhance Aqua Trivy Scanner

Press Release

September 29, 2026

RapidFort and Aqua Security Partner to Enhance Aqua Trivy Scanner

No items found.

RapidFort and Aqua Security Partner to Enhance Aqua Trivy Scanner with RapidFort Curated Images, Advisories and Remediation Data

Trivy Connect Partnership Enables Development and Security Teams to Start with Near-zero CVE Images, Reduce Operational Burden of Vulnerability Management, and Spend Less Time Sorting Through Scanner Noise

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced its new partnership with Aqua Security, the company delivering Aqua Trivy, a comprehensive, open-source cloud native security scanner that unifies vulnerability detection, misconfiguration scanning, and secret identification across the entire software development lifecycle.

Under Trivy Partner Connect, Trivy integrates RapidFort security advisories, enabling it to accurately report the status of packages in RapidFort Curated Images. This includes access to enhanced information including when RapidFort uses fixes extracted from other distributions or adapted from otherwise incompatible versions to patch affected packages. This new integration ensures Trivy recognizes each fix and is able to accurately report the near-zero CVE status of RapidFort Curated Images.

RapidFort's new Trivy Connect partnership enables development and security teams to start with near-zero CVE images, reduce operational burden of vulnerability management, and spend less time sorting through scanner noise.

As a result, development and security teams can start with near-zero CVE images, reduce the operational burden of vulnerability management, and spend less time sorting through scanner noise. Instead of managing false positives, developers can focus on building and releasing their products with greater confidence.

“Joint customers benefit from more accurate vulnerability results, less noise, and greater confidence in the security of the images they deploy,” said Matt Richards, Chief Operating Officer at Aqua Security. “RapidFort brings differentiated remediation capabilities and a level of advisory detail that enables Trivy to recognize packages RapidFort has already patched even when those fixes are sourced from other distributions or adapted from versions that would otherwise be incompatible. By combining Trivy’s trusted open-source scanning with RapidFort near-zero CVE images and transparent remediation data, we are helping development and security teams spend less time investigating false positives and more time delivering secure software.”

Even when an application is well-built, teams can spend countless hours chasing vulnerabilities in base images, dependencies, libraries, and operating system packages, many of which turn out to be false positives or already mitigated in ways traditional scanners do not understand. RapidFort Curated Images shift vulnerability elimination left without shifting more work onto developers. Combined with Trivy’s support for RapidFort advisories, teams get cleaner third-party scan results, more accurate security posture, and a faster path from development to production.

“Trivy is one of the most downloaded open-source security scanners, and we are pleased to partner with Aqua Security to enhance the productivity of developers, who get a true assessment of security risks and can now focus on development without worrying about fixing CVEs,” said George Manuelian, Chief Strategy Officer at RapidFort. “RapidFort is truly transparent about its curated images and enables partners to accurately assess images for any CVE risks. Partnering with companies like Aqua Security gives developers confidence that they are working with up to 99.9 percent CVE-free code before applications are ever deployed into production.”

This new integration is generally available immediately. Schedule a demo here https://www.rapidfort.com/schedule-a-call.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort Announces Integration with CrowdStrike Falcon Cloud Security to Accelerate Container Vulnerability Remediation

Press Release

August 31, 2026

RapidFort Announces Integration with CrowdStrike Falcon Cloud Security to Accelerate Container Vulnerability Remediation

No items found.

RapidFort integration with CrowdStrike Falcon Cloud Security accelerates container vulnerability remediation.

RapidFort Announces Integration with CrowdStrike Falcon Cloud Security to Accelerate Container Vulnerability Remediation

Integration Helps Joint Customers Identify, Prioritize, and Remediate Container Vulnerabilities across Kubernetes Environments

LAS VEGAS--(BUSINESS WIRE)--Fal.Con 2026 – RapidFort today at Fal.Con 2026 announced a new integration with CrowdStrike Falcon® Cloud Security. The integration helps joint customers accelerate container vulnerability remediation across Kubernetes environments by combining the comprehensive cloud security capabilities of Falcon Cloud Security with RapidFort automated container image hardening.

As AI accelerates vulnerability discovery and shortens the window between CVE disclosure and potential exploitation, organizations running Kubernetes at scale face increasing pressure to address vulnerabilities faster. Containerized workloads can inherit vulnerabilities from open-source base images and packages, creating significant remediation demands across large environments.

New integration helps joint customers accelerate container vulnerability remediation across Kubernetes environments by combining the comprehensive cloud security capabilities of Falcon Cloud Security with RapidFort automated container image hardening.

The integration enables RapidFort to ingest vulnerability and software bill of materials (SBOM) data from Falcon Cloud Security and use it to automate container image hardening. RapidFort curated image library and runtime profiling capabilities help eliminate identified vulnerabilities and remove unnecessary components without requiring changes to application code. Together, CrowdStrike and RapidFort help joint customers streamline vulnerability management and accelerate risk reduction across Kubernetes environments.

“AI-accelerated vulnerability discovery has made speed increasingly critical for organizations running Kubernetes at scale,” said George Manuelian, CSO, RapidFort. “Our integration with CrowdStrike brings RapidFort automated image hardening into the vulnerability management workflow, helping joint customers move faster from identifying risk to reducing it. RapidFort customers have reduced CVEs by up to 99.9% with our hardening technology, without requiring changes to application code.”

For organizations with stringent security and compliance requirements, including Department of Defense environments, RapidFort supports hardened container images, compliance reporting, and deployment across restricted and air-gapped environments.

To learn more about the integration, visit the CrowdStrike Marketplace listing or visit RapidFort at ReversingLabs Booth #2113 during Fal.Con 2026 in Las Vegas this week.

About RapidFort

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. CrowdStrike and Falcon are registered trademarks of CrowdStrike, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort Selected to Present on Software Supply Chain Security and Exhibiting During Important Events This Quarter

Press Release

August 14, 2026

RapidFort Selected to Present on Software Supply Chain Security and Exhibiting During Important Events This Quarter

No items found.

RapidFort selected to present on Software Supply Chain Security and is exhibiting during important industry events this quarter.

RapidFort Selected to Present on Software Supply Chain Security and Exhibiting During Important Events This Quarter

Company Participating in AFCEA TechNet Augusta, CrowdStrike fal.con, Billington CyberSecurity Summit 2026, and DevOpsDays Dallas

RapidFort will participate in the following important upcoming industry events:

AFCEA TechNet Augusta, Augusta, Ga. RapidFort is exhibiting in booth No. K14 at this event for military and private sector partnerships to accelerate the delivery of innovative and interoperable systems from Aug. 17 – 20.

RapidFort is participating in AFCEA TechNet Augusta, CrowdStrike fal.con, Billington CyberSecurity Summit 2026, and DevOpsDays Dallas later this quarter.

fal.con, Las Vegas. Meet RapidFort at this CrowdStrike high-octane experience for security teams from Aug. 31 – Sept. 3. To book a meeting at the event with RapidFort, please see https://www.rapidfort.com/events/rapidfort-at-fal-con-2026.
Billington CyberSecurity Summit 2026, Washington, D.C. RapidFort is a Gold Sponsor and will be exhibiting at the event in booth No. 215 from Sept. 8 – 10. Russ Andersson, COO and Co-founder of RapidFort, will participate in the breakout session panel titled “Trust but Verify: Assuring Integrity Across Foreign and High-Risk Vendors” on Sept. 9 from 11:40 am – 12:25 pm EDT.
DevOpsDays Dallas, Dallas. RapidFort is a Gold Sponsor of this regional conference for DevOps practitioners and will be exhibiting and speaking at the event from Sept. 28 – 29.

About RapidFort

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort Launches Industry’s First End-to-End Continuous Threat Elimination

Press Release

August 4, 2026

RapidFort Launches Industry’s First End-to-End Continuous Threat Elimination

No items found.

RapidFort launches end-to-end continuous threat elimination by extending leading software supply chain security into live production environments.

RapidFort Launches Industry’s First End-to-End Continuous Threat Elimination by Extending Leading Software Supply Chain Security Into Live Production Environments

Unveiled at Black Hat USA 2026, RapidFort Runtime Uniquely Delivers End-to-End Continuous Monitoring of Live Environments to Detect and Address CVEs Emerging After Software Deployment

LAS VEGAS--(BUSINESS WIRE)--(Black Hat USA 2026 Booth #5704) -- RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today at Black Hat USA 2026 launched RapidFort Runtime, a real-time-based security solution that extends RapidFort’s leading SSCS functionalities into live production environments, creating the industry’s first genuinely end-to-end continuous threat elimination solution – from curated, independently malware-scanned open-source software before deployment to continuous CVE monitoring and tamper detection in live production environments.

Unveiled in Black Hat booth No. 5704 and demonstrated publicly for the first time, RapidFort Runtime operates inside an organization’s production environment continuously monitoring deployed software, detecting unauthorized or unexpected changes, and proactively tracking newly discovered CVEs. It notifies administrators and developers of relevant security impacts and provides actionable mitigation recommendations. This industry-first capability delivers top-level visibility that distinguishes between first-party and third-party software, generates a precise Runtime Bill of Materials (RBOM®), and provides evidence of the software and processes executing in production. It integrates into existing CI/CD pipelines without requiring code changes, effectively bridging the gap between pre-production security and live runtime protection.

Unveiled in Black Hat booth No. 5704, RapidFort Runtime operates inside an organization’s production environment continuously monitoring deployed software, detecting unauthorized or unexpected changes, and proactively tracking newly discovered CVEs.

Together with RapidFort curated open-source software catalog and hardened images validated through ReversingLabs deep-binary malware analysis, RapidFort Runtime enables organizations to verify both what enters production and whether deployed software remains intact once it is running.

“Maintaining an accurate, real-time inventory of what is actually executing in production has been a consistent audit and compliance hurdle,” said Sangram Dash, CISO and VP of IT, Sisense. “RapidFort Runtime’s ability to generate a precise, dynamic RBOM provides us with undeniable evidence of our software’s state. We can now verify integrity and confirm our compliance in real-time, which is a total game-changer for our security operations.”

RapidFort Runtime differentiating new capabilities include:

End-to-End Continuous Monitoring: Monitors live production environments to detect and address CVEs that emerge after software deployment, solving the “production obsolescence” problem where software is often “born outdated” and immediately vulnerable when it hits production due to new CVE disclosures.
Agent-Based Runtime Profiling: Uses BPF/ptrace instrumentation to map system calls, network/memory usage, and process execution, providing cryptographic evidence of what is truly running.
Proactive Mitigation Recommendations: Beyond just detection, the platform notifies administrators of new relevant security impacts and offers actionable mitigation recommendations to fix them in live environments.
Automated Runtime Bills of Materials Generation: Continuously produces dynamic RBOMs for audit-ready compliance.
Curated, Independently Malware-Scanned Software: Integrates with the RapidFort extensive catalog of curated open-source libraries and hardened container images, validated through ReversingLabs deep-binary malware analysis, to reduce the risk of compromised or unverified software reaching production.
Runtime Tamper Detection and Integrity Monitoring: Establishes a verifiable baseline of approved software and continuously detects changes to packages, binaries, libraries, processes, and runtime behavior, providing evidence of what changed and where the change occurred.

“While most software supply chain security tools stop at build-time or deployment, RapidFort continuously monitors live production environments for newly disclosed CVEs that impact deployed software,” said Rajeev Thakur, CTO of RapidFort. “By automatically correlating new vulnerabilities with running workloads, RapidFort eliminates the manual effort of tracking CVEs and determining real production exposure, enabling organizations to respond faster and with greater confidence.”

RapidFort Runtime leverages lightweight agents that utilize BPF and ptrace technology to continuously monitor the software running in live production environments where threats and anomalies are most critical. Only RapidFort uses BPF/ptrace to deliver true runtime intelligence and actual evidence of execution, which drastically reduces false positives and vulnerability noise over relying solely on static analysis or scanning.

Unlike competitors that force migration to proprietary package managers or “distroless” images, RapidFort provides zero-overhead integration with drop-in replacement that supports standard package managers (pip, npm, apk). It is fully aligned with BSI TR-03183 Part 2, NIS2 (enforcement Dec 2025), and EU Cyber Resilience Act (CRA) requirements; and supports CIS Benchmarks and STIG validation, ensuring suitability for defense and mission-critical cloud-native deployments.

Availability

RapidFort Runtime is currently generally available. For more information visit https://www.rapidfort.com/platform/runtime.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort Recognized as a 2026 Top InfoSec Innovator for Software Supply Chain Security

Press Release

July 29, 2026

RapidFort Recognized as a 2026 Top InfoSec Innovator for Software Supply Chain Security

No items found.

RapidFort is recognized as a Top InfoSec Innovator in 2026 for Software Supply Chain Security.

RapidFort Recognized as a 2026 Top InfoSec Innovator for Software Supply Chain Security

RapidFort Unveiling Industry-First Software Supply Chain Security Advancements in its Award-Winning Solution at Black Hat USA Booth 5704

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced it has been recognized as a Top InfoSec Innovator for 2026, and a finalist in the Software Supply Chain Security category by Cyber Defense Magazine (CDM), the industry’s leading electronic information security magazine.

“RapidFort embodies three major features we judges look for with the potential to become winners: Understanding tomorrow’s threats, today; providing a cost-effective solution; and innovating in unexpected ways that can help mitigate cyber risk and get one step ahead of the next breach,” said Gary S. Miliefsky, Publisher of Cyber Defense Magazine.

RapidFort will unveil industry-first Software Supply Chain Security advancements in its award-winning solution at Black Hat USA in its Booth 5704.

RapidFort will showcase its award-winning solution at Black Hat USA 2026 in its Booth #5704, as well as launch industry-first advancements to help protect organizations through the entire SSCS lifecycle. Visitors will see the demo of the RapidFort continuous threat elimination model which spans intake to build to runtime and includes integrated malware-scanning and tamper-scanning for images and libraries.

“It’s validating to be recognized leading up to Black Hat in one of the most prestigious cybersecurity awards programs in the world from Cyber Defense Magazine, during their 14th anniversary as an independent cybersecurity news and information provider,” said Michael Wood, RapidFort CMO. “Black Hat is the perfect venue to make our significant announcement in the cybersecurity industry, including advancements no one has ever seen before that will best protect organizations from SSCS threats and extend RapidFort leadership ahead of the competition.”

Judging of the award finalists continues through October, when winners will be announced online, in print and during CyberDefenseCon 2026, taking place October 20-21 at The Ritz-Carlton in Orlando. There a select group of winners will showcase their innovative solutions to the Top Global CISOs during the invitation-only conference at https://www.cisoconference.com.

About Cyber Defense Awards

This is Cyber Defense Magazine’s thirteenth year of honoring InfoSec innovators from around the globe. Submission requirements are for any startup, early stage, later stage, or public companies in the information security space who believe they have a unique and compelling value proposition for their product or service. Learn more at www.cyberdefenseawards.com.

About Cyber Defense Magazine

Cyber Defense Magazine is the premier source of cyber security news and information for InfoSec professions in business and government. We are managed and published by and for ethical, honest, passionate information security professionals. Our mission is to share cutting-edge knowledge, real-world stories and awards on the best ideas, products, and services in the information technology industry. We deliver electronic magazines every month online for free, and special editions exclusively for the RSAC Conferences, Black Hat Conferences and Cyber Defense Conferences. CDM is a proud member of the Cyber Defense Media Group. Learn more at https://www.cyberdefensemagazine.com and visit https://www.cyberdefensetv.com and https://www.cyberdefenseradio.com to see and hear some of the most informative interviews of many of these award-winning company executives.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort and ReversingLabs Launch Industry's First Validated Open-Source Package Catalogs

Press Release

July 7, 2026

RapidFort and ReversingLabs Launch Industry's First Validated Open-Source Package Catalogs

Software Supply Chain Security

Compliance & Governance

RapidFort and ReversingLabs launch industry’s first independently validated open-source dependency libraries delivering safe package catalogs.

RapidFort and ReversingLabs Launch Industry’s First Independently Validated Open-Source Dependency Libraries Delivering Safe Package Catalogs

Partnership Verifies Packages are Free of Tampering, Malware and Vulnerabilities Across all Operating Systems, Frameworks and Application Stacks with no Proprietary Package Manager Migration Needed

SAN JOSE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security with the largest distribution of curated truly open-source software, and ReversingLabs (RL), the trusted name in file and software security, today announced a strategic partnership to deliver RapidFort Open-Source Dependency Libraries—the industry’s first and only open-source package catalog to combine RapidFort’s proven curation and hardening process with independent third-party validation powered by ReversingLabs’ Spectra Assure® platform.

RapidFort is the only vendor whose open-source library catalog is independently validated by a separate, named third-party security company—ReversingLabs—using enterprise-grade deep-binary malware detection. As a result of this partnership, every package in the catalog passes through RapidFort’s rigorous multi-stage hardening pipeline and is independently assessed by ReversingLabs to be free of tampering, malware, and known vulnerabilities before it reaches developers’ environments.

Strategic partnership creates industry’s first and only open-source package catalog to combine RapidFort’s proven curation and hardening process with independent third-party validation powered by ReversingLabs’ Spectra Assure® platform.

“ReversingLabs was built on the conviction that software security requires deep binary intelligence,” said ReversingLabs Founder and CEO Mario Vuksan. “Malicious actors are increasingly compromising open-source components, embedding threats deep within the layers of container images that traditional tooling cannot reach. By bringing Spectra Assure’s independent malware analysis to every package in the RapidFort library catalog, together we give enterprises access to open-source dependencies that are both rigorously hardened and independently assessed clean before they ever enter a build pipeline.”

Unlike competing approaches that require migration to proprietary package managers, custom operating system distributions, or vendor-specific toolchains, RapidFort Libraries work with any OS, any framework, and any application package manager through standard pip, Maven, npm, and OS package interfaces teams already use today. For customers, this means reducing time to compliance by three to six months without the migration and lock-in of proprietary package managers, without single-source liability, and without the friction that slows security and development teams down. RapidFort Libraries are a drop-in replacement—no migration, no disruption, no compromise. Existing vendor responses to the open-source supply chain crisis address only parts of this problem, but each imposes new constraints: proprietary OS distributions requiring platform migration, single-ecosystem library coverage, or build-from-source approaches with no independent integrity verification. No vendor prior to today has subjected every library in their catalog to named, independent third-party malware validation.

RapidFort Curation and Hardening Combined with ReversingLabs Validation

The RapidFort–ReversingLabs partnership brings together two complementary capabilities into a single, end-to-end security pipeline. RapidFort contributes its proven attack surface reduction and source-verified hardening process, which has helped enterprise customers eliminate up to 99.9% of CVEs from container images. ReversingLabs adds Spectra Assure, the industry’s leading deep-binary analysis platform for software supply chain security, bringing enterprise-scale malware detection, tampering identification, and independent onboarding governance to every package RapidFort releases.

“ReversingLabs is the gold standard for binary malware analysis,” said Mehran Farimani, CEO with RapidFort. “By embedding Spectra Assure analysis into our library release pipeline as an independent validation gate, we’ve created something the industry has been missing—a library catalog where the security claim is made by a separate company with its own reputation on the line. That’s a fundamentally different level of trust.”

ReversingLabs’ Spectra Assure performs deep binary analysis that goes far beyond signature-based scanning. As a result of this partnership, for public open-source repositories organizations now receive:

Deep malware detection: Binary-level analysis identifies obfuscated malware, hidden backdoors, and malicious payloads that evade traditional signature-based scanners—including novel threats with no prior CVE assignment.
Tampering verification: Cryptographic and structural analysis helps identify evidence of unauthorized modification, repackaging, or tampering within delivered software artifacts.
Threat intelligence correlation: Packages are checked against ReversingLabs’ authoritative Spectra Intelligence dataset covering billions of files and decades of malware research, providing context that no internal scan can replicate.
Differential version analysis: Spectra Assure compares a new package version against previous versions to identify newly introduced malware, tampering, risky behaviors, and unexpected changes in a new package update.
Policy-driven release gates: Packages that fail ReversingLabs’ security policies are blocked from the RapidFort catalog until risks are remediated, providing a preventative rather than reactive security control.
Evidence-backed audit trail: Every package release includes a ReversingLabs-generated security report, giving customers, their auditors, and regulators independently produced documentation of each artifact’s integrity status.

Availability

RapidFort Open-Source Dependency Libraries validated by ReversingLabs Spectra Assure are available today in general availability for Python and Java ecosystems, with JavaScript entering closed beta. OS package coverage for Red Hat, Ubuntu, Debian, and Alpine is available now. Additional language runtimes and application package catalogs are on an accelerated roadmap.

Existing RapidFort customers can enable library coverage immediately through the platform console or by contacting their account team. New customers can learn more and request access at rapidfort.com/libraries. Learn more about ReversingLabs Spectra Assure at https://www.reversinglabs.com/products/spectra-assure.

About ReversingLabs

ReversingLabs is the trusted name in file and software security. We provide the modern cybersecurity platform to verify and deliver safe binaries. Trusted by the Fortune 500 and leading cybersecurity vendors, RL Spectra Core powers the software supply chain and file security insights, tracking over 422 billion searchable files with the ability to deconstruct full software binaries in seconds to minutes. Only ReversingLabs provides that final exam to determine whether a single file or full software binary presents a risk to your organization and your customers. For more information, visit www.reversinglabs.com.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

Linux Foundation Launches Akrites to Defend Open Source Against AI-Enabled Cyber Threats

Press Release

June 25, 2026

Linux Foundation Launches Akrites to Defend Open Source Against AI-Enabled Cyber Threats

Threats

Software Supply Chain Security

Linux Foundation and Industry Leaders Launch Akrites to Defend Critical Open Source Software Against AI-Enabled Cyber Threats

Amazon Web Services, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone and Zscaler join coordinated effort to find, fix and responsibly disclose vulnerabilities in open source software the world runs on

The Linux Foundation, joined by leading organizations, today announced Akrites, a coordinated effort to remediate and disclose vulnerabilities in critical open source software.

Akrites establishes a shared Security Incident Response Team (SIRT) and a single, standardized Coordinated Vulnerability Disclosure (CVD) process, built on confidentiality-first principles and industry-standard tooling.

Founding members commit engineering talent, security expertise and funding to harden the shared open source software that banks, hospitals, power grids, telecoms, governments, and AI labs depend on.

Organizations that contribute engineering resources or funding to the security of critical open source are invited to participate and can learn more at https://akrites.org.

SAN FRANCISCO, June 25, 2026 /PRNewswire/ -- The Linux Foundation, the nonprofit organization enabling mass innovation through open source, today announced Akrites, a coordinated industry effort to harden the world's most critical open source software in the era of AI-assisted vulnerability discovery. Backed by founding commitments from Amazon Web Services, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone and Zscaler, the initiative unites major technology companies, AI labs, financial institutions, and security vendors around a shared mission: to coordinate the remediation of vulnerabilities in widely used open source projects with upstream maintainers before those vulnerabilities can be exploited.

Open source software underpins virtually every layer of the modern digital economy, from banking and healthcare to energy, transportation, telecommunication, and government. Akrites enables industry coordination to support and defend critical infrastructure users and consumers of open source. Previously, finding and fixing serious flaws in open source software demanded comparable expertise from attackers and defenders alike. Today, frontier AI models can scan a major open source project and surface vulnerabilities in minutes. Once access to these capabilities is broadly available, bad actors who previously lacked the technical expertise to mount sophisticated attacks will have the tools they need to do so quickly.

To mark the launch, the founding signatories published a joint open letter to the technology industry, "We All Depend on Open Source. We Will Defend It Together." The full letter is available at https://akrites.org/letter/.

In the past, security response involved a patchwork of organizations often working on the same problems independently, sometimes shipping conflicting patches or burying maintainers under duplicate reports. Akrites changes that model. The initiative provides a single, trusted place to coordinate, remediate and disclose, with a shared SIRT serving as a predictable partner for maintainers rather than a flood of uncoordinated reports. Akrites commits to working with critical infrastructure to support patch deployment before vulnerable systems can be targeted.

Confidentiality is central to the effort. Bug fixes flow back into each project's original home, on maintainers' terms. Where a critical package has no active maintainer, Akrites will serve as maintainer of last resort so fixes to the latest version reach everyone in a timely fashion. The initiative will also coordinate with government efforts so public and private defenders move together.

Alpha-Omega, a directed fund of the Linux Foundation, will provide seed funding to support Akrites. Other organizations that contribute engineering resources or funding to the security of critical open source are invited to participate. To learn more or to join, visit https://akrites.org.

Supporting Quotes

"Frontier AI models have given defenders the ability to find and fix vulnerabilities in open source software at a speed and scale that were never possible before. That's an enormous opportunity for defenders, and Akrites ensures we seize it together. Maintainers deserve a coordinated partnership, not a flood of reports. AWS is committed to securing the projects our customers depend on and building this shared infrastructure alongside the community."
– Matt Wilson, Vice President and Distinguished Engineer, Amazon Web Services

"Open source projects collectively underpin much of the internet, and the existing model for coordinated disclosure has been outpaced by how quickly AI can now find vulnerabilities. Getting ahead of that requires the industry to coordinate on findings and get fixes upstream before they're disclosed and exploited. Efforts like Akrites drive this level of coordination at the scale and speed this moment requires."
– Jason Clinton, Deputy Chief Information Security Officer, Anthropic

"The software supply chain is only as strong as the upstream it draws from, and we see how thin that layer really is. As AI finds more vulnerabilities, the industry will rush to patch them. Without coordination, those fixes will fragment across different patches and forks, and maintainers who are already overwhelmed, unreachable, or haven't touched a project in years. Akrites gives the industry one coordinated way to fix vulnerabilities upstream before they're exploited, with maintainers still in control. Now the work is making sure there's always someone on the other end to catch them."
– Dan Lorenc, CEO and Co-founder, Chainguard

"Finding a serious open source vulnerability used to take an expert weeks. It now takes a machine minutes. When maintainers lose that race, so does everyone else. No single company, no single maintainer, and no single government can close that gap alone. That is why Cisco is bringing its networking infrastructure, security expertise, and decades of open source contribution to Akrites - because defenders cannot afford to lose, and maintainers cannot be left to run this alone."
– Vijoy Pandey, SVP and GM, Outshift by Cisco

"Advances in AI models have significantly reduced the effort required to discover and exploit vulnerabilities. In partnership with the Linux Foundation and Project Akrites, Citi is committed to supporting the open-source ecosystem by helping to build a framework that identifies and remediates vulnerabilities and shares proposed patches. Focused on securing critical infrastructure, this initiative is a key part of our efforts to help the industry mitigate emerging threats."
– Al Tarasiuk, Chief Information Security Officer, Citi

"For years we have believed finding vulnerabilities was never the hard part. Fixing them was. AI has made that gap impossible to ignore. Of the thousands of validated open source vulnerabilities surfaced in recent months, fewer than 5% have been patched. Endor Labs is a founding member of Akrites because it is built for the response this moment needs: coordinated remediation upstream, handled confidentially, with maintainers in control, so one trusted fix reaches everyone who depends on the code."
– Varun Badhwar, CEO and Co-Founder, Endor Labs

"Vulnerability discovery is now moving at a speed that overwhelms both the maintainers who sustain open source projects and the users who rely on them. Uncoordinated reporting, patching, and disclosure create friction, putting the entire ecosystem at risk. No single organization can solve this alone. That is why Ericsson is joining Akrites as a Premier member, contributing funding and talent to a shared effort to keep open source software secure and thriving."
– Mikko Karikytö, Chief Product Security Officer, Ericsson

"As AI accelerates both the scale and speed of vulnerability discovery, defending the open source ecosystem requires an equally rapid, coordinated response. By joining Akrites, we are combining Google's long-standing commitment to open source security with industry-wide expertise to ensure that vulnerabilities are found, fixed, and responsibly disclosed before they can be exploited. Safeguarding the software that powers the world's critical infrastructure is essential to maintaining trust in our digital future."
– Heather Adkins, Vice President Security Engineering, Google

"Open source powers the systems we rely on every day—running everything from banks and hospitals to power grids and AI platforms. As frontier AI accelerates vulnerability discovery, the risk has grown too large for any one organization to address alone. That's why an ecosystem approach is critical, bringing the community, technology providers, and enterprises together to ensure vulnerabilities are addressed and at the new speed required today."
– Jamie Thomas, Enterprise Security Executive, IBM

"AI has massively compressed the time between vulnerability discovery and exploitation to near real time, which means we have to compress the time from fix to deployment. That's why we at JPMorganChase are helping to build this effort to measure success in patch deployment, not patch publication. We support a mechanism that enables downstream operators of critical infrastructure so that fixes reach real systems before adversaries can turn disclosures into exploits. And upstream, we owe maintainers a single, reliable signal: confirmed vulnerabilities, well-tested proposed fixes, and a predictable partner they can trust, rather than a flood of duplicative, conflicting reports."
– Pat Opet, Chief Information Security Officer, JPMorganChase

"OpenSSF and Alpha-Omega demonstrated what is possible when industry comes together to strengthen open source security. Building on our experience co-founding these organizations, Akrites was created to address the emerging inflection point of AI-powered vulnerability discovery and defense. As a founding member, Microsoft will contribute expertise, resources, and AI technologies to help responsibly identify and fix vulnerabilities across the open source software ecosystem that customers and organizations depend on."
– Mark Russinovich, Azure Chief Technology Officer, Deputy Chief Information Security Officer and Technical Fellow, Microsoft

"Transparency and open collaboration are how the cybersecurity community has kept infrastructure safe for decades. In the age of AI, these open source foundations have never been more critical. Open source AI is the engine of American innovation — and one of our most powerful tools for deploying AI with the security, trust, and transparency needed to power this industrial revolution."
– David Reber, Chief Security Officer, NVIDIA

"The world runs on open source, and securing it is a long-term commitment for us at OpenAI. Through Patch the Planet, we're putting our models and resources behind expert-led work that helps maintainers validate issues and land fixes, and we're proud to participate in Akrites to strengthen coordination across the industry and help defend the software we all depend on."
– Clint Gibler, Cyber Lead, OpenAI

"Open source only works when we keep the work open, upstream, and available to everyone who depends on it. The answer to the AI-driven vulnerability crisis is not to fragment the ecosystem behind proprietary walls or turn community foundations into closed products. It must be coordinated remediation that preserves the integrity of original software, works with maintainers, and returns fixes to the commons. We are proud to support the Akrites initiative which aligns with our belief of strengthening the open source ecosystem from within, helping organizations reduce risk without unnecessary code changes, and making the software we all share safer for everyone."
– Mehran Farimani, CEO, RapidFort

"Open source is the foundation of modern software innovation. Defending that foundation requires a coordinated, upstream community response capable of meeting threats at scale. Red Hat's participation in Akrites focuses on strengthening this upstream ecosystem. By collaborating openly to identify and patch vulnerabilities at the source, we help build a more resilient software supply chain for the entire industry."
– Chris Wright, Chief Technology Officer and Senior Vice President, Global Engineering, Red Hat

"For too long, the goodwill and sense of responsibility among upstream maintainers has been taken for granted in security response processes. Akrites promises meaningful coordination with upstream maintainers, financial, and full-time support to find, fix and disclose security vulnerabilities responsibly, and a genuine commitment from the most influential companies across tech and finance to solve this problem. The Rust Foundation looks forward to working with Akrites to develop security that is fit for the future."
– Rebecca Rumbul, Executive Director and CEO, Rust Foundation

"Sonatype sees the dependency graph of the modern world every day. A single vulnerable component can sit underneath thousands of organizations, which means one upstream fix can reduce risk across an entire ecosystem. AI may make vulnerability discovery dramatically easier, but it does not make coordinated repair automatic. Akrites is important because it gives the industry a confidential way to do that work together, upstream, before the same flaw becomes thousands of separate incidents."
– Brian Fox, Co-founder and Chief Technology Officer, Sonatype, and Steward of Maven Central

"With the increasing ability of AI to fast-track vulnerability discovery, now is the right time to come together and invest resources to safeguard critical open-source software on which telecommunications and many other industries rely on. As a founding member, Vodafone has committed both expertise and funding to Akrites. This unified initiative will drive a co-ordinated, industry-wide approach to responsibly identify and fix vulnerabilities in the software that runs the systems upon which the world depends."
– Paul Hopkins, Cyber & IT strategy and Architecture Director, Vodafone

"AI has changed the speed of both offense and defense. Vulnerabilities can now be found at machine speed, which means defenders have to move just as fast. Akrites helps turn that speed into an advantage for the open source ecosystem by finding issues earlier, coordinating remediation responsibly, and pushing fixes upstream. Zscaler is proud to be part of it."
– Deepen Desai, Executive Vice President and Chief Security Officer, Zscaler

About Akrites

Akrites is a coordinated confidential effort to remediate and disclose vulnerabilities in the open source software that critical infrastructure depends on. It provides a single, standardized Coordinated Vulnerability Disclosure (CVD) process operated by a shared Security Incident Response Team (SIRT), built on confidentiality-first principles and the industry's established standards and tooling (CVE, TLP, CWE, CVSS, EPSS, SSVC, VEX). To learn more or to join, visit https://akrites.org.

About the Linux Foundation

The Linux Foundation is the world's leading home for collaboration on open source software, hardware, standards, and data. Linux Foundation projects, including Linux, Kubernetes, Model Context Protocol (MCP), OpenChain, OpenSearch, OpenSSF, OpenStack, PyTorch, Ray, RISC-V, SPDX and Zephyr, provide the foundation for global infrastructure. The Linux Foundation is focused on leveraging best practices and addressing the needs of contributors, users, and solution providers to create sustainable models for open collaboration. For more information, please visit us at linuxfoundation.org.

The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of the Linux Foundation, please see its trademark usage page: www.linuxfoundation.org/trademark-usage. Linux is a registered trademark of Linus Torvalds.

‍

RapidFort and Legion Intelligence Unite to Secure AI Workloads for the Warfighter

Press Release

June 23, 2026

RapidFort and Legion Intelligence Unite to Secure AI Workloads for the Warfighter

Container Security

Threats

RapidFort and Legion Intelligence Unite to Secure AI Workloads for the Warfighter – Delivering Near-Zero CVE, Battle-Ready Artificial Intelligence from the Container Up

RapidFort curated, hardened, near-zero CVE container images are the security backbone of Legion’s battlefield AI platform — ensuring every AI workload deployed to the tactical edge is provably secure, continuously hardened, and mission-ready from the first line of code to the battlefield.

SUNNYVALE, Calif.--(BUSINESS WIRE)--Legion Intelligence, the governed AI platform trusted by U.S. Special Operations Command, the U.S. Department of War, and the U.S. Air Force, today announced a strategic partnership with RapidFort, the leader in software supply chain security for containers. Together, the two companies are redefining what it means to field AI on the battlefield — establishing that every AI workload running in support of the warfighter must be built on a provably secure, near-zero CVE software foundation, from forward-deployed edge systems to air-gapped command posts.

The Problem: AI Workloads Running on Vulnerable Containers Put Warfighters at Risk

Artificial intelligence is now at the center of modern warfighting — driving intelligence synthesis, mission planning, logistics, and real-time decision support. But AI workloads are only as secure as the container infrastructure they run on. Today, most AI systems — including large language models, inference engines, and agent orchestration platforms — are deployed inside containers that inherit thousands of CVEs (Common Vulnerabilities and Exposures) from base images and open-source dependencies.

On a commercial platform, an unpatched container vulnerability is a compliance finding. On the battlefield, it is an attack vector. A single exploitable CVE in an AI workload container can compromise the intelligence feeding a commander’s decision, corrupt a mission plan mid-execution, or hand an adversary a foothold inside the warfighter’s AI decision loop. The DoW cannot afford to field AI that is brilliant but breakable.

The Solution: RapidFort Secures the AI Stack — Legion Executes the Mission

The Legion-RapidFort partnership solves this problem at its root. Rather than patching CVEs after AI workloads are deployed, RapidFort eliminates them before a single AI model, inference container, or agent service ever reaches the battlefield. Legion Intelligence then builds its entire AI platform on this hardened foundation — delivering governed, auditable AI agent orchestration that warfighters can trust with their most sensitive operations.

“The AI workloads we deploy for the warfighter, from intelligence analysis agents to mission planning workflows, need to run inside containers that RapidFort has hardened to near-zero CVEs. That is not a nice-to-have. It is a prerequisite for fielding AI that the U.S. Department of War can trust with sensitive data and high-consequence operations,” said Ben Van Roo, CEO and co-founder, Legion Intelligence. “RapidFort strengthens the security foundation our AI stack is built on, helping Legion deliver governed AI that warfighters can rely on when it matters most.”

How RapidFort Secures Legion’s AI Workloads

Near-Zero CVE AI Container Images: RapidFort library of 35,000+ curated, production-grade container images serves as the secure base for every Legion AI service, including LLM inference engines, agent orchestration runtimes, and data pipeline containers. Built on trusted LTS Linux distributions — Ubuntu, Red Hat, Debian, and Alpine — these images eliminate up to 99.9% of CVEs before Legion’s AI workloads are deployed.
Continuous AI Workload Hardening: The RapidFort platform profiles real runtime behavior inside Legion’s AI containers, identifies unused software components, and automatically removes them — shrinking the exploitable attack surface of every AI workload by up to 90% without requiring code changes, OS changes, or pipeline modifications. Hardened images are rebuilt every 24 hours to stay ahead of emerging threats.
Battlefield-Grade Compliance Automation: RapidFort continuously validates Legion’s AI container stack against STIG, CIS, FedRAMP, and CMMC security benchmarks, generating audit-ready compliance reports that accelerate authorization to operate (ATO) for AI systems in classified and mission-critical environments.
Legion Intelligence AI Agent Orchestration: Built on RapidFort hardened container foundation, Legion’s FedRAMP High–authorized, IL6-capable platform deploys AI agents that automate current operations, intelligence analysis, mission planning, and secure process automation — with full auditability and human oversight — across on-premises, cloud, and air-gapped tactical edge environments.

The combined result is a fully secured AI stack: from the container image layer through the inference runtime to the governed AI agent — every component hardened, every CVE eliminated, and every AI workload continuously monitored and re-hardened as new threats emerge.

AI Workloads Warfighters Can Trust in the Most Contested Environments

Legion’s AI platform — secured end-to-end by RapidFort — delivers mission-critical AI capabilities across the full spectrum of battlefield operations:

AI-Powered Current Operations — real-time intelligence synthesis across all mission systems, accelerating OODA loops and enabling commanders to act faster than adversaries
AI Intelligence Analysis — automated report production and multi-source data fusion, so analysts spend time on judgment rather than chasing and formatting data
AI Mission Planning — situation report generation, training scenario simulation, and mission readiness analysis up to 75% faster than manual processes
Secure AI Process Automation — AI-driven drafting, querying, and content composition on classified networks at IL2 through IL6

All of these AI workloads run inside containers that RapidFort has hardened to near-zero CVEs — deployable on-premises, air-gapped, in a VPC, or at the forward tactical edge, with no vendor lock-in and no inherited vulnerability debt.

“AI workloads are the new high-value target. The models, inference engines, and agent runtimes that warfighters depend on are only as secure as the containers they run in — and most of those containers are shipping with thousands of inherited CVEs,” said Mehran Farimani, CEO and Founder at RapidFort. “RapidFort was built to eliminate that risk at the source. By securing the container foundation of Legion’s entire AI platform, we are ensuring that the AI reaching the battlefield is hardened, continuously monitored, and provably secure — not just powerful.”

Security Compliance and Certifications

The Legion-RapidFort stack is engineered to meet the most demanding government and defense security standards:

FedRAMP High Authorization (Legion Intelligence — January 2026)
IL2 through IL6 deployment support across on-premises, cloud, hybrid, and air-gapped environments
STIG and CIS benchmark-hardened container images (RapidFort)
CMMC, FedRAMP, SOC 2 Type 2, HIPAA, and GDPR compliance readiness acceleration
Continuous CVE remediation with automated compliance validation and audit-ready reporting

About Legion Intelligence

Legion Intelligence builds the Command Layer for mission-critical operations, helping defense, federal, and enterprise teams turn human intent into governed AI work across existing systems. Trusted by U.S. Special Operations Command, the U.S. Army, the U.S. Air Force, and the U.S. Department of Energy, Legion connects data, tools, models, and workflows through role-specific Mission Packs so agents can execute with auditability, governance, and human oversight. Legion deploys across cloud, on-premises, classified, air-gapped, edge, hybrid, and DDIL environments through Centurion, and is FedRAMP High authorized. Learn more at legionintel.com.

About RapidFort

RapidFort is the leader in Software Supply Chain Security, enabling organizations to eliminate risk across their software stack at scale. Its platform combines curated near-zero CVE container images, runtime profiling, and attack surface management to remove up to 99.9% of vulnerabilities within hours and reduce the attack surface by up to 90% without code changes. RapidFort was identified as a Gartner® Cool Vendor™ in 2025 and a Nutanix.Next Partner of the Year in 2026. For more information, visit www.RapidFort.com.

‍

RapidFort Recognized in 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security

Press Release

June 22, 2026

RapidFort Recognized in 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security

Software Supply Chain Security

RapidFort Platform

RapidFort recognized in 2026 Gartner Magic Quadrant for Software Supply Chain Security report for delivering mandatory features for the SSCS market.

RapidFort Recognized in 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security for Delivering Mandatory Features for SSCS Market

Gartner Magic Quadrant Highlights Vendors Delivering Third-Party Software Risk Protection, Software Bill of Materials and Threat Intelligence while Demonstrating Ability to Execute and Completeness of Vision

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, a leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced it has been recognized in the just-released 2026 Gartner Magic Quadrant for Software Supply Chain Security report 1, which provides evaluations of 18 vendors.

According to Gartner, “Software supply chain security has grown from a niche concern into a top enterprise priority, supported by a rapidly maturing market. Gartner estimates that SSCS market revenue exceeded $2.8 billion in 2025, up from $2.5 billion in 2024 and $2.2 billion in 2023. Gartner forecasts that the SSCS market will exceed $5 billion in revenue by 2030.” 1

RapidFort included in Gartner Magic Quadrant report that highlights vendors delivering third-party software risk protection, software bill of materials and threat intelligence while demonstrating ability to execute and completeness of vision.

For its report, Gartner considered SSCS products or services that deliver “software composition analysis, third-party software governance, software bill of materials life cycle management, continuous threat intelligence, third-party reputation analysis, and all other additional features.” 1

“We believe Gartner has specific requirements for the select vendors included in the SSCS Magic Quadrant, and we are pleased to be recognized as delivering the mandatory features for this market, including additional features such as protection from third-party AI components, including large language models (LLMs) and Model Context Protocol (MCP) servers,” said Michael Wood, CMO with RapidFort. “RapidFort is differentiated in the industry with the largest and most comprehensive catalogue of curated genuinely open-source software, and we see customers select RapidFort because of our end-to-end continuous threat elimination platform.”

According to Gartner, “SSCS products have recently evolved in five ways, including OS image security, curated registries and rebuild factories are growing, as vendors seek to harden the upstream supply and offer pre-vetted components.”1

A complimentary copy of the 2026 Gartner Magic Quadrant for Software Supply Chain Security is available at https://go.rapidfort.com/gartner-magic-quadrant-software-supply-chain-security.

1 Gartner, Magic Quadrant for Software Supply Chain Security, Aaron Lord, Johnny Walters, Jason Gross, 17 June, 2026.

Gartner and Magic Quadrant are trademarks of Gartner, Inc., and/or its affiliates.

Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner’s business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose.

About RapidFort

RapidFort is the leader in Software Supply Chain Security, enabling organizations to eliminate risk across their software stack at scale. Its platform combines curated near-zero CVE container images, runtime profiling, and attack surface management to remove up to 99.9% of vulnerabilities within hours and reduce the attack surface by up to 90% without code changes. RapidFort was identified as a Gartner® Cool Vendor™ in 2025 and a Nutanix.Next Partner of the Year in 2026. For more information, visit www.RapidFort.com.

‍

RapidFort Launches Curated Libraries to Stop Attacks Before They Reach the Pipeline

Press Release

June 11, 2026

RapidFort Launches Curated Libraries to Stop Attacks Before They Reach the Pipeline

Software Supply Chain Security

Secure Base Images

RapidFort Curated Libraries help organizations secure the software supply chain at the source without disrupting existing development processes.

RapidFort Launches Curated Libraries to Stop Supply Chain Attacks Before They Reach the Pipeline

RapidFort expands its security platform with curated, third-party malware-scanned libraries to enhance protection of software at the source

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security, today announced the availability of RapidFort Curated Libraries, a comprehensive catalog of malware-scanned open-source libraries to help organizations prevent supply chain malware before it reaches development pipelines or production environments.

RapidFort Curated Libraries give developers access to curated, malware-scanned open-source packages for npm, PyPI, Maven, RubyGems, and NuGet ecosystems. Developers are able to continue using the libraries they already know while reducing exposure to malicious binaries, backdoored dependencies, install-time payloads, typosquatted packages, credential stealers, droppers, downloaders, infostealers, keyloggers, rootkits, ransomware, and other supply chain threats.

“Modern software teams depend on open-source packages to move quickly, but every package downloaded into a development workflow introduces risk,” said Michael Wood, CMO at RapidFort. “RapidFort Curated Libraries give developers the power to move at DevOps speed while giving organizations the confidence that their applications and services have been vetted by the world’s most advanced threat intelligence solutions.”

RapidFort already provides more than 35,000 near-zero CVE curated images, runtime bill of material analysis, and the industry's most comprehensive software supply chain security platform. With RapidFort Curated Libraries, the company extends that protection to third-party application libraries, helping enterprises and public sector organizations secure the software supply chain at the source.

Mitigating Malware Before It Enters the Software Supply Chain

Recent software supply chain incidents have demonstrated how attackers increasingly target open-source ecosystems and developer workflows. Compromised packages and dependencies have affected widely used projects and repositories across popular application ecosystems.

RapidFort Curated Libraries are designed to stop these threats from entering an organization by ensuring developers access only open-source software that is curated and independently malware-scanned.

DevOps Velocity and SecOps Protection

RapidFort Curated Libraries leverage “The Power of And”: DevOps velocity and SecOps protection.

Developers can continue using the same pin-for-pin compatible libraries, packages, CLI syntax, interfaces, features, versions, and workflows they rely on today. RapidFort Curated Libraries work with existing operating systems, tools, artifactories, and software delivery processes without requiring teams to migrate to a proprietary operating system or vendor-specific development models.

Key benefits include:

Malware scanning at the source: RapidFort helps prevent malicious packages and compromised dependencies from entering software pipelines.
Existing workflow support: RapidFort Curated Libraries work with current operating systems, tools, artifactories, interfaces, and CLI syntax.
Reduced incident response burden: Security and engineering teams can spend less time hunting for malware and vulnerabilities after public disclosures of threats.
Continuous compliance visibility: RapidFort supports up-to-date compliance assessment and reporting based on frequent updates, helping organizations demonstrate security posture to internal stakeholders, auditors, customers, clients, and boards of directors.
Policy-driven security: Organizations can shift from reactive vulnerability response to a proactive, policy-driven model for open-source software consumption.

Helping Developers Ship With Confidence

Open-source software powers modern innovation, but its scale and speed create new challenges for today’s security teams. RapidFort Curated Libraries allow organizations to continue benefiting from the global open-source ecosystem while reducing the risk that compromised packages, malicious payloads, or newly introduced malware will impact production systems.

“RapidFort has really helped us get ahead of the curve in vulnerability management of our application images, which is critical to delivering ATO-ready software to our customers," said Wesley Smith, President and CTO at Tactical ID. "We're excited that we can now give developers the packages they need while ensuring those packages are curated, malware-scanned, and compatible with the way teams already build software.”

Availability

RapidFort Curated Libraries are available today for organizations seeking to secure open-source software consumption across package libraries, operating systems, images, middleware, and development workflows. Customers can use RapidFort Curated Libraries alongside the RapidFort Curated Images catalog, runtime bill of material analysis, and compliance reporting capabilities.

For more information, visit www.rapidfort.com/libraries

About RapidFort

RapidFort is the leader in Software Supply Chain Security, enabling organizations to eliminate risk across their software stack at scale. Its platform combines curated near-zero CVE container images, runtime profiling, and attack surface management to remove up to 99.9% of vulnerabilities within hours and reduce the attack surface by up to 90% without code changes. RapidFort was identified as a Gartner® Cool Vendor™ in 2025 and a Nutanix.Next Partner of the Year in 2026. For more information, visit www.RapidFort.com.

‍

Knox Systems & RapidFort Join Forces to Defend Against Mythos-Generated CVE Threats & Speed FedRAMP Compliance

Press Release

May 20, 2026

Knox Systems & RapidFort Join Forces to Defend Against Mythos-Generated CVE Threats & Speed FedRAMP Compliance

Threats

Compliance & Governance

Knox Systems and RapidFort Join Forces to Defend Against Mythos-Generated CVE Threats and Fast-Track FedRAMP Compliance

Alliance Provides SaaS Vendors with Bundled FedRAMP 20-Ready Images to Accelerate Authorization and Prepare for AI-Driven Attacks

SAN FRANCISCO & NEW YORK--(BUSINESS WIRE)--Knox Systems, the largest federal AI-managed cloud provider, and RapidFort, the leader in Software Supply Chain Security, today announced a significant expansion of their strategic partnership. Effective immediately, Knox subscribers gain bundled access to RapidFort Federal Information Processing Standards (FIPS) 140-3 curated container images as part of their existing subscription. This expanded offering eliminates a critical compliance bottleneck on the FedRAMP path and provides a hardened, continuously maintained security foundation designed to withstand the AI-accelerated vulnerability landscape.

Knox and RapidFort share a unified mission: unlock cutting-edge commercial software for federal agencies by streamlining compliance and reducing the attack surface. Through this partnership, customers receive:

Faster FedRAMP 20 Certification: Knox already enables vendors to inherit 60–80% of required FedRAMP controls on day one, compressing authorization timelines to approximately 90 days without requiring agency sponsorship. The addition of RapidFort FIPS 140-3 curated images removes the next largest obstacle — container image compliance — from the vendor's plate entirely. Teams that previously spent weeks hardening images, negotiating Security Technical Implementation Guide (STIG) and Center for Internet Security (CIS) benchmarks, and resolving FIPS cryptographic validation issues can now deploy against a pre-validated, continuously maintained foundation from first login.
Structural CVE Defense, Not Reactive Patching: RapidFort near-zero CVE images are maintained continuously. As attack vectors like Mythos, the Anthropic AI system that autonomously discovers and exploits zero-day vulnerabilities, emerge and accelerate vulnerability weaponization, Knox customers can operate from a baseline that is already hardened. When the next Mythos-discovered vulnerability surfaces, organizations on this stack present a dramatically reduced attack surface compared to those relying on unmanaged community images.
Simplified Adoption, Unified Cost: The bundled model eliminates the procurement complexity of managing separate image licensing. Knox subscribers gain access to both FIPS and non-FIPS variants across all major operating system (OS) distributions — Ubuntu, Red Hat, Alpine, and Debian, including Bitnami and official-image versions — under a single subscription and a single repository, with no per-image licensing fees and no vendor lock-in. Integration requires no source code changes and fits directly into existing Continuous Integration/Continuous Delivery (CI/CD) pipelines.

“FedRAMP 20x and the White House’s recent Memorandum 26-12 signal that the government wants to rapidly increase the use of commercial technology without sacrificing security,” said Irina Denisenko, CEO of Knox Systems. “At Knox, we are answering the call by enabling SaaS companies to achieve ATO faster and more cost-effectively. The addition of RapidFort’s FIPS images enables us to speed up the process even more while continuing to save valuable IT resources.”

“Since the outset of our partnership, we have proven that Knox and RapidFort are better together. Now we are making that combination the default,” said Mehran Farimani, CEO of RapidFort. “Every Knox customer automatically gets the most compliant and hardened container image foundation available anywhere - FIPS 140-3 validated, STIG and CIS benchmarked, and maintained at near-zero CVE. D.”

Existing Knox customers can activate RapidFort curated images through their Knox subscription portal. New customers receive access automatically upon onboarding.

About Knox Systems

Knox Systems operates the largest managed federal cloud, trusted by top agencies and partners across defense and civilian sectors. Built for speed, resilience, and compliance, Knox delivers FedRAMP authorization in 90 days - turning the biggest bottleneck in government IT into the fastest path to modernization. Knox proudly serves Adobe, Celonis, OutSystems, Armis, BigID and more AI and SaaS providers, accelerating secure innovation across the federal landscape. Learn more at www.knoxsystems.com.

About RapidFort

RapidFort is the leader in Software Supply Chain Security, enabling organizations to eliminate risk across their software stack at scale. Its platform combines curated near-zero CVE container images, runtime profiling, and attack surface management to remove up to 99.9% of vulnerabilities within hours and reduce the attack surface by up to 90% without code changes. RapidFort was identified as a Gartner® Cool Vendor™ in 2025 and a Nutanix .Next Partner of the Year in 2026. For more information visit www.RapidFort.com.

‍

RapidFort Named Nutanix Cloud Native Partner of the Year

Press Release

May 15, 2026

RapidFort Named Nutanix Cloud Native Partner of the Year

RapidFort Platform

Cloud Security Fundamentals

RapidFort Awarded Nutanix Cloud Native Partner of the Year at Nutanix’s .NEXT Event

Nutanix recognizes RapidFort for advancing secure, cloud-native application delivery with near-zero vulnerability software supply chain security

WASHINGTON--(BUSINESS WIRE)--RapidFort, the leading software supply chain security platform delivering near-zero CVE container images and continuous vulnerability remediation, announced today during Nutanix’s .NEXT conference that it has been awarded the Nutanix Cloud Native Partner of the Year Award.

Nutanix recognized RapidFort as the recipient of a 2026 partner award for its innovation in helping customers secure and optimize cloud-native applications across hybrid and multi-cloud environments. RapidFort was recognized for enabling organizations to dramatically reduce their attack surface through automated container image hardening, continuous vulnerability removal, and compliance assurance, helping enterprises deploy and run applications on Nutanix infrastructure.

Through its partnership with Nutanix, RapidFort empowers joint customers to accelerate secure application delivery by combining the Nutanix Kubernetes Platform with RapidFort’s end-to-end software supply chain security capabilities. This includes real-time vulnerability remediation, generation of SBOMs and RBOMs, and access to a curated catalog of near-zero CVE container images, allowing customers to build and operate secure, compliant, and production-ready applications faster.

“We are proud to have honored RapidFort at .NEXT this year for their outstanding efforts in enabling customer success with Nutanix,” said Tarkan Maner, President and Chief Commercial Officer at Nutanix. “At a time when Enterprise AI, cloud-native, and hybrid cloud technologies are reshaping industries, RapidFort’s commitment to the Nutanix vision ensures that our customers can truly ‘Run Anything, Anywhere’ on a secure, future-proof platform.”

“Winning the Nutanix Partner of the Year Award is a strong validation of our shared mission to help enterprises build and run secure, cloud-native applications without compromise,” said George Manuelian, Co-Founder and CSO of RapidFort. “Together with Nutanix, we are enabling organizations to eliminate vulnerabilities at the source, reduce operational risk, and accelerate innovation across hybrid and multi-cloud environments.”

RapidFort and Nutanix continue to collaborate to deliver integrated solutions that simplify security across the software lifecycle, from build through production, while ensuring compliance with frameworks such as FedRAMP and CMMC. This partnership enables organizations, including those in highly regulated sectors, to confidently deploy modern applications with reduced risk and increased operational efficiency.

About RapidFort

RapidFort is the industry’s leading software supply chain security platform, built to help organizations quickly ship safer software with less overhead across any operating system. RapidFort automates vulnerability remediation at scale, eliminating up to 95% of vulnerabilities without requiring code changes. Operating system–agnostic and vendor-neutral by design, the platform enables organizations to secure software across container environments without platform or vendor lock-in.

With a free tier and hardened community images, RapidFort makes secure development accessible to teams of any size. Learn more at rapidfort.com.

‍

RapidFort Partners with Nutanix to Deliver Secure Kubernetes for Enterprise AI

Press Release

March 25, 2026

RapidFort Partners with Nutanix to Deliver Secure Kubernetes for Enterprise AI

Container Security

Cloud Security Fundamentals

RapidFort partners with Nutanix to help enterprises scale Kubernetes for AI workloads while reducing risk, compliance burden, and operational burden.

RapidFort Partners with Nutanix to Deliver Secure, Compliant Kubernetes at Development Speed for Enterprise AI Workloads

Collaboration with Nutanix enables enterprise teams to innovate without compromise with hardened containers and accelerated compliance, at scale.

AMSTERDAM--(BUSINESS WIRE)--KubeCon + CloudNativeCon – RapidFort, the leader in end-to-end software supply chain security, today announced a strategic partnership with Nutanix, a leader in hybrid multicloud computing, to address a growing challenge for enterprises adopting Kubernetes at scale: maintaining speed and agility without expanding security and compliance risk.

Through this new partnership, RapidFort will integrate its automated software supply chain security capabilities with the Nutanix Kubernetes Platform (NKP) solution. RapidFort’s Platform and curated near-zero CVE images enable customers to deploy continuously hardened software artifacts remediated with every release across data center, edge, and public cloud environments. This integration will help organizations running NKP strengthen the security of their cloud-native workloads while maintaining the speed developers expect. By extending protection into the software supply chain, RapidFort enables customers to build and operate secure Kubernetes environments for modern applications, including AI and generative AI initiatives.

This integration builds on the strong security foundation Nutanix customers already expect, extending protection into the software supply chain for cloud‑native deployments running on the Nutanix Cloud Platform solution. With RapidFort’s curated near-zero CVE images and automated vulnerability remediation, organizations can deploy hardened cloud-native workloads with dramatically reduced attack surface across on-prem, edge, OEM partner platforms, and public cloud environments.

“Integrating RapidFort into the Nutanix Kubernetes Platform gives our customers access to a platform with hardened software artifacts. It’s a big step forward in making Kubernetes environments more secure everywhere they run,” said Dan Ciruli, vice president and general manager, Cloud Native, at Nutanix.

“The Nutanix Kubernetes Platform meets the enterprise foundation team’s need to run Kubernetes consistently across datacenter, edge, and public cloud,” said George Manuelian, Co-Founder and CSO of RapidFort. “RapidFort complements NKP by continuously eliminating vulnerabilities and reducing attack surface in the workloads deployed into those environments—so customers can move faster while reducing risk and accelerating compliance.”

Scaling Kubernetes More Securely

The partnership:

Enables containers and VMs to run consistently across data center, edge, and public cloud.
Reduces operational burden through automated vulnerability remediation.
Gives platform and security teams clear, auditable controls for compliance.

Extending Security Across NKP

The collaboration also:

Brings RapidFort’s hardened software supply chain protections to workloads running on NKP.
Delivers curated, near-zero-CVE hardened container images by default.
Aligns RapidFort’s automated remediation with NKP’s policy-driven guardrails.

Mitigating Rising Software Supply Chain Risk

With RapidFort integrated into NKP, organizations can:

Eliminate reactive patching by fostering a proactive, secure-by-design posture throughout the entire software lifecycle.
Secure the supply chain with cryptographic proof of provenance, ensuring the integrity of every library from source to deployment.
Protect production environments by mandating that only verified, hardened, and risk-reduced artifacts are deployed to production.

Analyst Commentary

"Sovereign AI and Sovereign Cloud demand more than just localized data; they demand a hardened, minimalist software supply chain. Container platforms must prioritize security optimized libraries to enable secure-by-default container management approaches, giving customers a streamlined path to compliance in the world’s most demanding digital environments,” said Gary Chen, Research Director, IDC.

The newly integrated RapidFort and Nutanix solution will be available to all NKP customers and users regardless of tier (Starter, Pro, and Ultimate). It is expected to be generally available to customers later this year.

About RapidFort

With a free tier and hardened community images, RapidFort makes secure development accessible to teams of any size. Learn more at rapidfort.com.

‍

Trellix Partners with RapidFort to Strengthen Supply Chain Security

Press Release

February 23, 2026

Trellix Partners with RapidFort to Strengthen Supply Chain Security

Software Supply Chain Security

RapidFort Platform

Trellix strengthens software supply chain security with RapidFort, delivering hardened images, reduced attack surface, and rapid CVE response.

Trellix Partners With RapidFort to Strengthen Software Supply Chain Security Across Product Portfolio

Strategic collaboration delivers hardened container images, reduced attack surface, and accelerated vulnerability response

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced Trellix, the company delivering the future of AI-powered cybersecurity, has selected the RapidFort platform and curated images to secure both first-party and third-party software components across its entire product ecosystem.

With a mission to address critical software supply chain security challenges, Trellix identified the need for a security partner capable of reducing software vulnerabilities in container images while maintaining operational efficiency. By adopting RapidFort's platform, Trellix benefits from hardened, curated images with minimized attack surfaces and automated remediation workflows across its comprehensive product suite.

"In today's threat landscape, securing the software supply chain is critical to delivering enterprise-grade security solutions our customers can trust,” said Randy Dougherty, Chief Information Officer at Trellix. "By hardening our software from the inside out, we're helping set a new security standard for product development and strengthening our cloud exposure management portfolio."

Key benefits for Trellix customers include:

Enhanced Software Supply Chain Security: Comprehensive protection for both proprietary and third-party software components throughout the development lifecycle
Rapid CVE Response: Accelerated identification, prioritization, and remediation of vulnerabilities, reducing exposure windows and strengthening security posture
Optimized Container Images: Significantly reduced image footprint and attack surface through intelligent removal of unnecessary components
Improved Operational Efficiency: Smaller, hardened images result in faster deployments, reduced storage costs, and streamlined maintenance

“Software supply chains have become a primary attack vector, and organizations need solutions that address vulnerabilities before they reach production," said Mehran Farimani, CEO of RapidFort. "Trellix's decision to adopt our platform ensures that enterprises start with a secure, dependable software foundation that supports their products at scale.”

The partnership delivers immediate value by further strengthening Trellix's security posture and optimizing deployment workflows. The RapidFort platform automatically patches and optimizes base images while intelligently removing unused components, resulting in container images that are 30% smaller than traditional distroless images and contain 20% fewer CVEs. After evaluating multiple solutions, Trellix replaced its previous vendor with RapidFort, achieving these measurable improvements with no migration efforts or software porting required through drop-in replacements for existing images.

For Trellix customers, this partnership translates into immediate security benefits: enhanced protection through products built with a fortified software foundation, reduced vulnerability exposure from hardened components, and faster security updates through rapid CVE identification and remediation. The implementation spans Trellix's comprehensive product suite, ensuring consistent security standards and supply chain integrity across all customer deployments.

This partnership reinforces Trellix's position as a trusted cybersecurity vendor that practices the same rigorous security principles it advocates for its customers. With a free tier and community-maintained images, RapidFort makes secure development accessible to teams of any size. Learn more at https://www.rapidfort.com.

About RapidFort

RapidFort delivers a modern software supply chain security platform built to help organizations ship safer software with less overhead. Its curated near-zero-CVE container images, automated vulnerability remediation, runtime intelligence, and built-in hardening tools reduce noise, shrink attack surfaces, and keep applications secure from build to production. Through intelligent analysis and optimization, RapidFort enables enterprises to deploy secure, efficient container images while maintaining full functionality. The platform serves Fortune 500 companies and security-conscious organizations worldwide.

‍

RapidFort Raises $42 Million Series A to Accelerate Supply Chain Security Innovation

Press Release

February 3, 2026

RapidFort Raises $42 Million Series A to Accelerate Supply Chain Security Innovation

RapidFort Platform

Software Supply Chain Security

RapidFort raises $42M to scale a new approach to automated software supply chain security, and combat increasing vulnerability exploitation.

RapidFort Raises $42M Series A Led by Blue Cloud Ventures and Forgepoint Capital to Power the Next Generation of Software Supply Chain Defense

Strategic collaboration delivers hardened container images, reduced attack surface, and accelerated vulnerability response

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the technical leader defining the next generation of software supply chain security, today announced $42 million in Series A funding led by Blue Cloud Ventures and Forgepoint Capital, with participation from prior lead investor Felicis Ventures. Additional participants include Alumni Ventures, Boulder Ventures, Brave Capital, Evolution Ventures, Florida Funders, Gaingels, and Mana Ventures.

This funding arrives at a defining moment for cybersecurity and software delivery. AI has dramatically accelerated how software is built and shipped, and attackers are moving just as fast. As the window between vulnerability disclosure and exploitation continues to shrink, organizations can’t rely on quarterly patch cycles, manual triage, or “scan-and-pray” security. RapidFort’s accelerating revenue momentum reflects the market’s shift toward continuous, automated vulnerability elimination. According to Verizon’s latest Data Breach Investigations Report, vulnerability exploitation now accounts for 20% of breaches, nearly matching credential abuse at 22%. The message is unmistakable: vulnerability management must shift from reactive detection to continuous elimination.

“Software teams are shipping faster than ever—and attackers are moving even faster. RapidFort is building what the market urgently needs: continuous vulnerability remediation that keeps pace with modern development. Their end-to-end platform doesn’t just surface risk—it eliminates it. We’re excited to partner with RapidFort as they define the next era of software supply chain security,” said Rami Rahal, Managing Partner at Blue Cloud Ventures.

A New Category: Continuous Remediation for the Software Supply Chain

RapidFort is setting a new standard: remediation at machine speed, built directly into the software delivery pipeline. RapidFort secures the entire software lifecycle—from build through runtime—by continuously analyzing, remediating, hardening, and protecting software artifacts so vulnerabilities don’t survive long enough to become incidents.

“The problem isn’t that organizations don’t know they have vulnerabilities, it’s that they can’t fix them fast enough,” said Mehran Farimani, Founder and CEO of RapidFort. “AI has accelerated software delivery and attacker capability at the same time. The window between disclosure and exploitation has collapsed. RapidFort exists to eliminate vulnerabilities continuously—at machine speed—before they reach production.”

RapidFort combines automated vulnerability remediation with one of the industry’s most comprehensive catalogs of hardened, near-zero-CVE container images across major Linux distributions, enabling teams to dramatically reduce risk in days, not months.

Why RapidFort Wins: From “Finding Fires” to “Stopping Them”

RapidFort goes beyond scanning and detection. The platform eliminates risk through:

Automated remediation: Continuous vulnerability removal embedded in CI/CD workflows, enabling teams to fix issues as software ships, not weeks later.
Near-zero-CVE containers: Drop-in, hardened images across major Linux distributions that dramatically reduce CVEs without code changes, eliminating security debt from day one.
Runtime intelligence: Behavioral analytics and image optimization that remove unused components, reducing attack surface by up to 90 percent.
End-to-end hardening: Automated hardening and validation from build through production for consistent security across environments.
Compliance-ready security: Built for regulated environments, supporting programs such as FedRAMP, CMMC, ATO, CRA and NIS2 with continuous risk reduction and auditable security controls.

Investing in the Future of Software Security for the AI Era

The Series A funding will accelerate RapidFort’s next phase of growth across product innovation, platform expansion, and enterprise adoption:

Go-to-Market Expansion: Scaling sales, marketing, and partnerships to meet increasing demand for automated remediation
Platform Innovation: Advancing automated remediation, near-zero-CVE software delivery, and continuous attack surface reduction
Enterprise Adoption: Supporting deployments in regulated industries with deeper integrations, smoother onboarding, and operational scalability
Software Supply Chain Assurance: Expanding end-to-end lifecycle security from build through runtime to ensure continuous protection and compliance

“RapidFort represents the evolution of software supply chain security from reactive to proactive,” said Ernie Bio, Managing Director at Forgepoint Capital. “In an AI-accelerated threat landscape, detection alone is table stakes. What matters is elimination. RapidFort is the only platform that combines comprehensive profiling, automated rebuilding, intelligent patching, and continuous validation at enterprise scale. We’re thrilled to partner with Mehran and the team as they define the new standard for software supply chain security.”

“What’s compelling about RapidFort is that it treats software artifacts as infrastructure. By hardening and validating images continuously, the platform creates a security foundation that scales across teams, tools, and environments—without forcing developers to change how they build,” said Jimmy Park, Vice President at Forgepoint Capital.

Learn more at rapidfort.com.

About RapidFort

RapidFort delivers the modern software supply chain security platform built for the AI era. Through automated vulnerability remediation, curated near-zero-CVE container images, runtime intelligence, and continuous hardening, RapidFort helps organizations eliminate vulnerabilities at the speed of development and accelerate compliance readiness. From startups to Fortune 500 enterprises, RapidFort enables teams to reduce attack surface, shrink security debt, and ship safer software with less overhead.

‍

Azul Launches Technology Alliance Partner Program to Accelerate Innovation and Expand the Ecosystem of Java Solutions

Press Release

January 21, 2026

Azul Launches Technology Alliance Partner Program to Accelerate Innovation and Expand the Ecosystem of Java Solutions

New program fosters deep collaboration between Azul and technology partners to deliver integrated solutions that improve developer productivity, DevOps efficiency, business productivity and cloud efficiency for Java customers worldwide.

No items found.

Azul Launches Technology Alliance Partner Program to Accelerate Innovation and Expand the Ecosystem of Java Solutions

SUNNYVALE, Calif.--(BUSINESS WIRE)--Azul, the only company 100% focused on Java, today announced the launch of the Azul Technology Alliance Partner (TAP) Program, a global initiative designed to strengthen collaboration with leading technology providers, accelerate innovation and expand the Java ecosystem.

The TAP program provides a formal framework for joint technical integrations, solution development, and go-to-market activities between Azul and its alliance partners. By joining the TAP program, partners gain access to Azul’s innovative products, Java expertise, joint marketing initiatives, sales team and channel to bring high-value, validated solutions to market faster for their shared customers. TAP is part of Azul’s overall PartnerConnect Program – in addition to technology alliance ISVs, Azul’s broader PartnerConnect ecosystem includes solution providers, authorized value-added resellers and authorized distributors.

New program fosters deep collaboration between Azul and technology partners to deliver integrated solutions that improve developer productivity, DevOps efficiency, business productivity and cloud efficiency for Java customers worldwide

Empowering ISVs with Java Innovations, Co-Sell Opportunities and Market Expansion

By partnering with Azul, ISVs realize several benefits, including:

Technical collaboration with Azul product managers and engineers to aid solution integration and optimization.
Accelerated innovation and development via access to cutting-edge Java technologies, expertise and resources that can accelerate product development.
Joint marketing initiatives, including co-branded content, events and campaigns.
Access to new markets and customer segments that can significantly boost sales and brand awareness.
Access to Azul’s ecosystem, connecting partners with the world’s leading Java innovators and community.

Maximizing Customer ROI Through Azul’s Technology Alliance Ecosystem

Azul’s Technology Alliance Partner Program delivers tangible customer value by integrating best-of-breed Java technologies to provide solutions in four key areas:

Developer Tools & Productivity – Enabling developers to be more productive — writing better code faster, deploying more frequently and responding rapidly to production security issues.
DevOps Efficiency – Improving the automation and optimization of key aspects of the development and IT operation lifecycle.
Business Benefit/Productivity Software – Driving the company’s top-line revenue growth through improved Java application performance and metrics (e.g., KPIs).
Cloud Cost Savings/Infrastructure Cost Reduction – Reducing Java’s infrastructure footprint and right-sizing compute resources without sacrificing performance.

Together, these benefits make Azul’s partner ecosystem a powerful force multiplier for enterprises seeking to maximize the value of their Java investments.

The inaugural TAP members include leading companies in supply chain security, development and modernization. Azul will continue expanding the program throughout 2025 with additional partners across key technology categories.

Real World Customer Impact from Working with Azul and its ISVs

Azul’s growing ecosystem of technology partners is delivering tangible business outcomes for customers – the following are real-world examples of how organizations across industries are benefiting from Azul’s integration with leading technology providers:

Moderne – A global online employment marketplace vendor using Azul Intelligence Cloud to surface unused and dead code estimated it would take 21 person-years to remove all their unused code. By applying Moderne’s OpenRewrite-based platform with Azul’s runtime intelligence, the company automated that remediation, doing in days what would have taken years. They were able to go from a project that was often ignored or handled sparingly to one that can be tackled decisively at scale.

“Modernizing enterprise Java applications is a massive challenge. Moderne enables our customers to tackle technical debt at scale — bringing entire fleets of applications forward in parallel,” said Jonathan Schneider, CEO and co-founder of Moderne. “Partnering with Azul gives us the real-time data to drive transformations across codebases faster and with greater confidence.”
‍
Payara – A large securities industry foundation needed to modernize its aging financial education platform used by thousands of users. By migrating to Payara Platform Enterprise, which includes Azul Platform Core and Azul Platform Prime as the default JVMs, the foundation increased user capacity per machine by 2.5 times while unlocking scalability opportunities.

“Payara is committed to delivering cloud-native Java solutions for global enterprises, from powerful runtimes to Payara Qube — our Kubernetes-native automation platform that simplifies and scales Java deployments,” said Steve Millidge, CEO and founder of Payara. “The Azul TAP program creates exciting opportunities for deeper collaboration that brings customers better performance, stronger security and more choice across their Java deployments.”
‍
RapidFort – A U.S. wealth management firm was struggling with CVE remediation. Instead of chasing enormous CVE patch backlogs, the firm chose to focus solely on the vulnerabilities within its applications, while RapidFort and Azul focused on the rest (e.g., RapidFort containers embedded with Azul Java runtimes). This resulted in a significant improvement in developer productivity and the velocity of new deployments.

“Performance and security go hand in hand, especially in cloud environments where efficiency is critical,” said George Manuelian, co-founder of RapidFort. “By joining Azul’s TAP program, we’re giving enterprises the ability to optimize Java workloads with a dramatically smaller attack surface and lower cloud costs.”

“Java remains the backbone of modern enterprise and cloud-native applications, and at Azul, our mission is to give enterprises more — more performance, more value and more choice,” said George Gould, senior vice president, Corporate Development and Strategic Alliances at Azul. “The Technology Alliance Partner Program is a powerful catalyst for innovation, enabling Azul and our ecosystem partners to co-create solutions that streamline development and operations, as well as make Java run more securely and more cost-effectively across today’s distributed environments. By aligning with technology leaders who share our vision, we can help our joint customers boost application performance, reduce costs and enhance security across their Java landscape.”

For more information about the Azul Technology Alliance Partner Program and how to participate, please visit https://www.azul.com/partners/type/technology-alliance-program.

About Azul Systems Inc.

Headquartered in Sunnyvale, California, Azul provides the Java platform for the modern cloud enterprise. Azul is the only company 100% focused on Java. Millions of Java developers, hundreds of millions of devices and the world’s most highly regarded businesses trust Azul to power their applications with exceptional capabilities, performance, security, value, and success. Azul customers include 36% of the Fortune 100, 50% of Forbes top 10 World’s Most Valuable Brands, 10 of the world’s top 10 banks and leading brands like Avaya, Bazaarvoice, BMW, Deutsche Telekom, LG, Mastercard, Mizuho, Priceline, Salesforce, Software AG, and Workday. Learn more at azul.com and follow us @azulsystems.

‍

RapidFort Achieves SOC 2 Type 2 Compliance, Reinforcing Trust-First Strategy

Press Release

January 20, 2026

RapidFort Achieves SOC 2 Type 2 Compliance, Reinforcing Trust-First Strategy

RapidFort achieves SOC 2 Type 2 compliance demonstrating the company’s commitment to security and privacy.

No items found.

RapidFort achieves SOC 2 Type 2 compliance demonstrating the company’s commitment to security and privacy

RapidFort Achieves SOC 2 Type 2 Compliance, Reinforcing Trust-First Strategy

Third-party auditors confirm the company’s mature security practices, reaffirming RapidFort’s commitment to their partners and customers

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a San Francisco-based container security company, today announced that it has successfully completed a Service Organization Controls (SOC) 2 Type 2 compliance audit, demonstrating the company’s commitment to maintaining all aspects of security and privacy. After an extensive review of RapidFort’s controls, practices, business processes, and more by a professional third-party auditor, RapidFort met more than 300 necessary requirements to achieve the certification.

The importance of vendor and partner security cannot be overstated in today’s business ecosystem. Security breaches from vendors or partners that directly affect companies and their clients are more prevalent now than ever before. SOC 2, developed by the American Institute of CPAs (AICPA), is a globally recognized auditing procedure that measures a service provider’s ability to securely manage its data and protect the privacy of its clientele. All audited organizations must meet the criteria across five trust service principles, including security, availability, processing integrity, confidentiality, and privacy.

“Trust is the currency of business today,” said Kevin Baldwin, Chief Revenue Officer at RapidFort. “Achieving SOC 2 Type 2 compliance makes RapidFort more than just a credible company, but a trusted and preferred business partner. Now companies of all sizes, from government organizations to major enterprises, can use the RapidFort platform with confidence knowing that their data will remain secure.”

Successfully completing the SOC 2 Type 2 Compliance audit reasserts RapidFort’s dedication to its current and future business partners. This certification also allows them to broaden their target audience to companies that will only work with SOC 2 Type 2 credited companies. RapidFort’s existing internal standards of security and compliance made the 3-month assessment process simple. They were able to demonstrate excellence in best practices for each of the audited categories and serve as an example that adherence to high standards begets positive outcomes.

To learn more about RapidFort’s platform, please visit https://www.rapidfort.com.

About RapidFort

RapidFort is a cloud-native cybersecurity company that provides a platform to optimize and secure modern cloud infrastructures. The company helps organizations monitor and minimize their software attack surface continuously. RapidFort’s free tier and free community images empower development and security teams to improve their security posture and operational efficiency. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort Launches Runtime Protection to Automatically Monitor and Secure Kubernetes Workloads

Press Release

January 20, 2026

RapidFort Launches Runtime Protection to Automatically Monitor and Secure Kubernetes Workloads

RapidFort launches Runtime Protection to enhance software visibility and automatically mitigate vulnerabilities.

No items found.

RapidFort launches Runtime Protection to enhance software visibility and automatically mitigate vulnerabilities.

RapidFort Launches Runtime Protection to Automatically Monitor and Secure Kubernetes Workloads

RapidFort Runtime Protection enhances software visibility, empowering security and development teams to easily mitigate software vulnerabilities

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), has launched RapidFort Runtime Protection, its flagship runtime toolset. Runtime Protection provides security teams with a deep understanding of their software and the tools needed to automatically mitigate vulnerabilities – significantly reducing the burden on development teams.

Securing trust among customers, stakeholders, and regulators has never been more critical. Government regulatory efforts and an increasingly interconnected technology landscape are driving companies to decrease their overall attack surface. Many are placing extra emphasis on container security as a key part of their risk reduction strategy in order to protect against malware, vulnerabilities, data leaks, human error, and more. Runtime Protection actively scans, profiles, monitors, and secures containers in lower and production environments, pinpointing the vulnerabilities within applications’ execution paths. This enables teams to protect their infrastructure by automatically securing unused components and unnecessary vulnerabilities, ultimately reducing software attack surfaces by 60-90%. With deep insights into their Kubernetes workloads, teams are able to prioritize vulnerabilities, streamline their remediation strategy, and make informed decisions across the board.

“Scaling the remediation of software vulnerabilities has become an intractable problem to solve," said Dave Neuman, Senior Analyst at Tag-Cyber. "Security professionals are burdened by an overabundance of vulnerabilities and developers are asked to chase CVEs instead of focusing on innovation and new product features. RapidFort is a quantum leap forward. Now security professionals are empowered to solve up to 90% of software vulnerabilities automatically without involving developers. RapidFort’s innovative technology has taken the complex and made it simple, ushering in a whole new way of managing the risk associated with software vulnerabilities at enterprise scale.”

With the addition of RapidFort Runtime Protection, the RapidFort platform is the first solution on the market that offers build time CI/CD tools and runtime Kubernetes features that work in unison, helping organizations reduce their software attack surface throughout the Software Development Life Cycle and facilitating efficient cooperation between security and development teams. Current industry runtime tools can require up to 30% of compute overhead, which can hinder high-performance cloud native environments. Runtime Protection was purpose-built to be environment agnostic and uses less than 1% compute overhead, allowing frictionless deployment in high-traffic Kubernetes environments.

“Trust and compliance are paramount to success in today's business landscape and RapidFort is fundamentally revolutionizing the cloud application security industry by solving one of the most important and complex issues facing organizations today – software vulnerability management,” said Kevin Baldwin, Chief Revenue Officer at RapidFort. “We realized early on we needed to look at the problem differently and that automation was key to solving this issue at scale. The addition of Runtime Protection to our platform’s tool set ensures that, with the push of a button, only the vulnerabilities that materially impact a company's unique environment are identified and remediated. This innovation doesn’t just eat around the edges of the problem. It simply eliminates it.”

RapidFort’s platform presents security teams with a simple, three-step process to optimize and secure their software attack surface:

Scan & Observe: Scan infrastructure, generate vulnerability reports, and measure risk
Profile & Understand: Understand your software attack surface, identify what packages are used and unused, and prioritize vulnerability remediation
Harden & Secure: Reduce your software attack surface, and improve security posture

A recent study conducted by RapidFort found that 60-90% of software in modern applications is unused and irrelevant to the execution path. Despite its irrelevance, the unused software is continuously maintained, bogging down security and dev teams while posing significant, unnecessary risk. Through its automatic scanning, monitoring, and hardening capabilities, Runtime Protection identifies this unnecessary code and gives security teams contextual insight into what vulnerabilities matter most so they can remediate risks more efficiently.

To learn more about Runtime Protection and the RapidFort platform, please visit http://runtime.rapidfort.com.

About RapidFort

‍

RapidFort Joins Microsoft for Startups Pegasus Program

Press Release

January 20, 2026

RapidFort Joins Microsoft for Startups Pegasus Program

RapidFort selected as a member of the prestigious Microsoft for Startups Pegasus Program.

No items found.

RapidFort selected as a member of the prestigious Microsoft for Startups Pegasus Program

RapidFort Joins Microsoft for Startups Pegasus Program

The program helps RapidFort drive growth and customer value

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), has been selected as a member of the prestigious Microsoft for Startups Pegasus Program. The program helps drive sales and accelerate growth for RapidFort’s advanced software security platform. As part of the program, Microsoft channels and customers now have easy access to RapidFort's market-leading platform, which includes RapidFort Runtime Protection. This tool empowers security teams to automatically scan, understand, and harden their software infrastructure. By leveraging Runtime Protection, companies can expect the automatic remediation of 60-90% of their software vulnerabilities without involving development teams.

“The Microsoft Pegasus Program is a critical part of our go-to-market strategy, and we’re thrilled to be working with such a stellar and capable team,” said Mehran Farimani, CEO at RapidFort. “Being selected as a member of the program validates our unique vision for the future of software attack surface management. With Microsoft's support, we will greatly accelerate our mission to help customers automatically secure and optimize their software, and enjoy the operational efficiency and security benefits that RapidFort enables.”

The Microsoft for Startups Pegasus Program extends the Microsoft for Startup Founders Hub platform with curated training and support for invited startups. The Pegasus Program is an ecosystem of startups with unique solutions to critical market needs and offers a range of resources and support. Participation in the program gives RapidFort access to a dedicated Success Manager, a Cloud Solutions Architect, and an Account Executive, who provide customers with personalized support and the technical assistance needed to make the most of RapidFort's offerings. RapidFort is well-positioned to accelerate top-line expansion and deliver innovative solutions that solve critical business problems for Microsoft and RapidFort's joint customers.

The program also enables RapidFort to serve its current and prospective customers better. Microsoft’s enterprise customers who are looking to streamline their security operations are now able to connect with RapidFort’s offerings and transact seamlessly. These companies can now meet one-on-one with RapidFort to collaborate on digital transformation and innovation opportunities.

“Remediation of software vulnerabilities is a considerable burden to engineering teams, and RapidFort has developed a patented and effective toolset to significantly reduce this cost. RapidFort's acceptance into the Pegasus Program is a testament to their unique approach to software security. We look forward to continuing our work together to drive growth for them, and increased security for our joint customers,” said Tom Davis, Senior Director at Microsoft for Startups.

To learn more about the Microsoft for Startups Pegasus Program, please visit: https://www.microsoft.com/en-us/startups/pegasus

To learn more about Runtime Protection and the RapidFort platform, please visit: http://runtime.rapidfort.com.

About RapidFort

‍

RapidFort Wins The Prestigious 2023 CISO Choice Award For Vulnerability Management

Press Release

January 20, 2026

RapidFort Wins The Prestigious 2023 CISO Choice Award For Vulnerability Management

RapidFort named a winner of the 2023 CISO Choice Awards in Vulnerability Management.

No items found.

RapidFort named a winner of the 2023 CISO Choice Awards in Vulnerability Management

RapidFort Wins The Prestigious 2023 CISO Choice Award For Vulnerability Management

RapidFort is recognized for its innovative approach to vulnerability management and automatic remediation.

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), has been named a winner of the prestigious 2023 CISO Choice Awards in the Vulnerability Management category. The awards honor leading security vendors who exemplify creative entrepreneurship and offer innovative solutions to today's growing security challenges. The board of judges is composed of distinguished CISOs from major organizations across multiple industries, and their choices were rooted in firsthand knowledge and insights from building and maintaining their own programs.

"I would like to congratulate RapidFort for winning the 2023 CISO Choice Awards Vulnerability Management Category. The field was exceptionally competitive this year, and our esteemed CISO Board of Judges was very impressed by the level of innovation that solution providers put forth to safeguard our organizations," said David Cass, CISOs Connect and Security Current President, and Global CISO at GSR.

It's common for large enterprises to find 10-20 million vulnerabilities in their software infrastructure after a scan. Uniquely, through a process of identifying used and unused components, RapidFort's platform can automatically remediate a majority of vulnerabilities. In a recent study conducted by Rapidfort, 73% of people said that their organizations spend up to 30 hours each week remediating each prioritized CVE, taking up a significant amount of time. RapidFort pinpoints these unused components and their associated vulnerabilities in all parts of the software development and deployment lifecycle and provides security and development teams with the tools to mitigate most vulnerabilities automatically.

The platform empowers organizations to:

Scan & Observe: Scan infrastructure, generate vulnerability reports, and measure risk
Profile & Understand: Understand their software attack surface, identify what packages are used and unused, and prioritize vulnerability remediation
Harden & Defend: Reduce their software attack surface and improve security posture

When using RapidFort, discussions between security and development teams change from fixing CVEs in open-source components (i.e., other people's code) to improving software hygiene with actionable reports and tools to eliminate unnecessary software components. This, in turn, frees up development teams to focus on building new software features and solving customer and business issues, resulting in a faster, leaner software organization.

"The CISO Choice Awards are a significant accolade to companies in the cybersecurity industry. The recognition from the highly respected CISO judges validates our unique and innovative approach to reducing organizations' software attack surface," said Mehran Farimani, CEO of RapidFort. "RapidFort is revolutionizing how security teams and developers work together to keep their organizations safe. By automatically identifying and remediating up to 90% of software vulnerabilities, we empower security teams to focus on defending while enabling developers to spend their precious time on innovations relevant to their businesses."

To learn more about RapidFort's platform, please visit https://www.rapidfort.com.

About RapidFort

RapidFort is a cloud-native cybersecurity company that provides a platform to optimize and secure modern cloud infrastructures. The company helps organizations monitor and minimize their software attack surface continuously. RapidFort's free tier and free community images empower development and security teams to improve their security posture and operational efficiency. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort’s Platform Now Available in Microsoft Azure Marketplace

Press Release

January 20, 2026

RapidFort’s Platform Now Available in Microsoft Azure Marketplace

RapidFort’s attack surface management platform now available on Microsoft Azure Marketplace

No items found.

RapidFort’s attack surface management platform now available on Microsoft Azure Marketplace

RapidFort’s Platform Now Available in Microsoft Azure Marketplace

Marketplace inclusion improves access to industry-leading software attack surface management technology

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), is now available in the Microsoft Azure Marketplace, an online repository containing IT software applications and services built by industry-leading technology companies. Customers now have access to the powerful -- Azure optimized -- features of the RapidFort platform to scan, monitor and harden workloads running in Microsoft Azure Kubernetes Services.

RapidFort’s technology will be the first of its kind available on the Azure marketplace and can be fully deployed on the Azure stack within a customer account. With no data leaving the customer account, customers remain secure and can enforce organizational security policies while leveraging the benefits of the RapidFort platform. The locality of the platform and RapidFort Runtime Protection features also allow for accelerated scanning of Common Vulnerabilities and Exposures (CVEs) as all data is local to customer workloads.

“Our inclusion in the Microsoft Azure Marketplace is another crucial step forward in our go-to-market strategy as we expand access to our powerful solution, and tackle the growing challenge of software security,” said Mehran Farimani, CEO at RapidFort. “This affirms our innovative approach to software attack surface management. As we expand access to our platform, we're expediting our mission, empowering customers to effortlessly secure and optimize their software with the operational efficiency and security benefits of RapidFort."

RapidFort’s inclusion in the marketplace serves as further testament to their mission of creating a seamless approach for customers to access its technology. The complete integration of the platform into the Azure Marketplace greatly benefits regulated industries such as financial services and healthcare, as it will allow customers to leverage their existing certifications alongside the benefits of the RapidFort platform.

RapidFort was also recently selected to be in the prestigious Microsoft For Startups Pegasus Program. This in addition to the listing demonstrates the company’s continued dedication to better serve its current and prospective customers by increasing access to its market-leading platform and making it easier than ever to remediate software vulnerabilities.

To find RapidFort on the Microsoft Azure Marketplace, please visit: https://azuremarketplace.microsoft.com/pt-br/marketplace/apps/rapidfortinc1678380358035.saas_sasm_platform?tab=overview

To learn more about RapidFort, please visit: https://www.rapidfort.com.

About RapidFort

‍

RapidFort Unveils New Software Bill of Materials Warehouse Feature

Press Release

January 20, 2026

RapidFort Unveils New Software Bill of Materials Warehouse Feature

RapidFort announces new SBOM warehouse feature, increasing software vulnerability identification and remediation efficiency

No items found.

RapidFort announces new SBOM warehouse feature, increasing software vulnerability identification and remediation efficiency

RapidFort Unveils New Software Bill of Materials Warehouse Feature

New capability increases efficiency in identifying and automatically remediating more than 80% of critical software vulnerabilities

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity, unveiled its Software Bill of Materials (SBOM) Warehouse feature, taking a major leap forward in Software Attack Surface Management (SASM). This innovative platform capability provides a centralized location for SBOMs for all of an organization’s containers, aligning with the National Institute of Standards and Technology’s (NIST) recommendation. The centralized view, coupled with additional benefits like enhanced risk visibility, ingestion and reporting capabilities, allows security teams to swiftly and effectively address critical vulnerabilities in any package and its dependencies, significantly enhancing organizations' cybersecurity posture. This new functionality is part of the process RapidFort uses to automatically eliminate more than 80% of software vulnerabilities, during development, with no code changes.

The Presidential Executive Orders new requirement for cyber devices to provide an SBOM for all software components and a proposal for federal contractors to develop and maintain an SBOM for any software are just two examples of recent compliance requirements making SBOMs among the most critical priorities for government agencies and commercial organizations. RapidFort’s SBOM Warehouse feature is helping to address this new priority by continuously monitoring for risks, updating risk profiles with new security advisories, and reducing the repetitive task of regenerating SBOMs for the same containers on a regular cadence, saving customers time and money.

"The landscape of vulnerabilities within SBOMs is dynamic, changing almost daily. To maintain an accurate risk profile, organizations would traditionally need to generate SBOMs manually every day, a time-consuming and costly process," explained Mehran Farimani, CEO and Co-Founder of RapidFort. "We are thrilled to be one of the only vendors offering a solution that is helping organizations address this growing priority by simplifying and automating the process, saving them valuable time and resources."

RapidFort’s SBOM Warehouse is incorporated within RapidFort's platform and scanning suite, making it simple for organizations to leverage the profiling and hardening feature to remediate risks quickly and automatically. Uniquely, the SBOM Warehouse enables the ingestion of SBOMs generated by scanners, including those not supported by RapidFort's platform. It then converts them to industry standard formats such as SPDX and Cyclone DX. With the SBOM Warehouse's container comparison feature, RapidFort can identify any new components or deficiencies found within containers and associated vulnerabilities. This results in organizations having the most accurate view of their SBOMs, specifically the components used in their containers and the actionable risk metrics based on current information.

RapidFort's SBOM Warehouse is just one of the many capabilities that make up its SASM platform, the first of its kind. This platform is designed to identify and remove unused components without altering the software's behavior, resulting in smaller, more performant and secure software. Its flagship runtime toolset, RapidFort Runtime, takes an active role in scanning, profiling, monitoring, and securing containers in production environments, pinpointing the vulnerabilities within applications' execution paths. This comprehensive approach enables teams to protect their infrastructure by automatically removing unused components and unnecessary vulnerabilities, and reducing software attack surfaces by an impressive 60-90%.

Large portions of the SBOM Warehouse were developed in partnership with and financed by SpaceWERX. SpaceWERX is the innovation arm of the United States Space Force and blends the best of commercial innovation with the needs of United States Space Guardians. The enterprise version is available on RapidFort’s website, while the Department of Defense version is available for download at USAF PlatformOne Ironbank.

To learn more about RapidFort and the SBOM Warehouse capability, please visit https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure cloud development. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort Enhances SASM Platform with Cutting-Edge STIG Compliance Toolset

Press Release

January 20, 2026

RapidFort Enhances SASM Platform with Cutting-Edge STIG Compliance Toolset

RapidFort adds compliance capability to help government and commercial organizations benchmark container images against the STIG framework.

No items found.

RapidFort adds compliance capability to help government and commercial organizations benchmark container images against the STIG framework.

RapidFort Enhances SASM Platform with Cutting-Edge STIG Compliance Toolset

New features will help government and commercial companies more easily achieve and maintain compliance with common industry benchmarks

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), has added a new compliance capability to its platform to help both government and commercial organizations benchmark their container images against the Security Technical Information Guide (STIG) framework. In thirty seconds or less RapidFort scans for and identifies configuration errors and vulnerabilities in code, generating an executable script and automatically remediating identified risks.

Compliance plays a critical role in regulated industries like fintech, healthcare, and critical infrastructure, and RapidFort customers now have access to tools that will help them identify, achieve, and maintain compliance with their necessary industry standards. Government organizations that work with the Department of Defense (DoD) must comply with STIG configuration standards for device hardware and software that help safeguard the DoD’s IT network and systems.

“Compliance benchmarking is essential for businesses within regulated industries as well as companies using containers with intellectual property or customer data,” said Mehran Farimani, CEO of RapidFort. “With regulatory requirements only growing, we recognize the challenge this can present to security and development teams, so we wanted to give our customers an easier way to achieve their compliance requirements. Our simple and easy-to-use tool can now quickly benchmark their containers, and automatically address any vulnerabilities within the code, reducing manual code changes and compliance headaches.”

The compliance features are built into RapidFort’s innovative SASM platform, designed to identify and remove unused components without altering the software's behavior, resulting in smaller, more performant and secure software. RapidFort’s flagship runtime toolset, RapidFort Runtime, scans, profiles, monitors, and secures containers in production environments, pinpointing vulnerabilities within applications' execution paths. This comprehensive approach enables teams to protect their infrastructure and maintain compliance by automatically removing unused components and undetected vulnerabilities, reducing software attack surfaces by more than 80%.

Large portions of the STIG Toolset were developed through contracts with SpaceWERX. SpaceWERX is the innovation arm of the United States Space Force and blends the best of commercial innovation with the needs of United States Space Guardians. The enterprise version is available on RapidFort’s website, while the Department of Defense version is available for download at USAF PlatformOne Ironbank.

For more information about RapidFort’s new compliance tool, visit https://www.rapidfort.com.

The views expressed are those of the author and do not necessarily reflect the official policy or position of the Department of the Air Force, the Department of Defense, or the U.S. government.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

About SpaceWERX

As the innovation arm of the U.S. Space Force and a unique division within AFWERX, SpaceWERX inspires and empowers collaboration with innovators to accelerate capabilities and shape our future in space. Headquartered in Los Angeles, SpaceWERX employs 40 military, civilian and contractor personnel executing an annual $457 million budget. Additionally, SpaceWERX partners with Space Systems Command's Commercial Space Office (COMSO) as a collaborative program. Since it was aligned under AFRL in Aug. 2021, SpaceWERX has executed 1106 contracts worth more than $897 million to strengthen the U.S. defense industrial base and drive faster technology transition to operational capability. For more information, visit spacewerx.us.

‍

RapidFort Launches Free Pre-Hardened Images on GitHub

Press Release

January 20, 2026

RapidFort Launches Free Pre-Hardened Images on GitHub

RapidFort launches GitHub repository with pre-hardened open-source images, offering developers free, secure, efficient, & reliable container solutions.

No items found.

RapidFort launches GitHub repository with pre-hardened open-source images, offering developers free, secure, efficient, & reliable container solutions

RapidFort Launches Free Pre-Hardened Images on GitHub

Repository will strengthen containerized open-source software for developer community

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), has launched their GitHub repository with hundreds of prehardened open-source images. This initiative offers developers free, secure, efficient, and reliable container solutions, transforming the DevSecOps landscape with over 1.85 million unique downloads from developers to date.

Open-source containers, while powerful and widely used, are often bloated with unnecessary code and hundreds of vulnerabilities, shifting the burden of remediation to developers and increasing the risk of insecure software. In a survey conducted by RapidFort, 73% of people said their organizations spend between 11 and 30 hours each week remediating CVEs. RapidFort is addressing this challenge head-on with their free pre-hardened images, giving developers a weekly updated catalog of slimmer, faster, less resource-intensive images, letting developers focus on what developers do best, building. This community-focused initiative provides cost-saving benefits and more efficient infrastructure, allowing developers to focus on innovation rather than vulnerability management, ultimately accelerating development cycles and enhancing their security posture.

“We believe that security should be accessible to everyone, regardless of the size of their organization or the resources they have,” said Mehran Farimani, CEO of RapidFort. “By offering these pre-hardened community images for free, we are not only helping developers save time and resources but also contributing to a safer, more secure digital ecosystem. It's our way of giving back to the open-source community that has given us so much.”

These images are hardened through RapidFort’s innovative SASM platform, with rebuilds to the repository each time a new image is released. RapidFort’s flagship runtime toolset, RapidFort Runtime allows container images to be scanned, profiled, monitored, and secured in a production environment. Its ability to pinpoint vulnerabilities within the execution path results in the automatic removal of unused components and unnecessary vulnerabilities, reducing software attack surfaces by an impressive 60-90%.

To access RapidFort’s hardened community images, please visit: https://github.com/rapidfort/community-images.

To connect with talented engineers worldwide and stay updated on the company's latest developments, join RapidFort's Slack community at: https://www.rapidfort.com/resources/community-center.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort Curated Images Help Organizations Achieve Zero CVEs

Press Release

January 20, 2026

RapidFort Curated Images Help Organizations Achieve Zero CVEs

RapidFort launches Curated Images, offering a secure foundation for software development and deployment as well as accelerated FedRAMP authorization.

No items found.

RapidFort launches Curated Images, offering a secure foundation for software development and deployment as well as accelerated FedRAMP authorization.

RapidFort Curated Images Help Organizations Achieve Zero CVEs

Curated container images provide a secure foundation for software development and accelerated FedRAMP authorization

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), has launched RapidFort Curated Images, helping organizations quickly reach near-zero common vulnerabilities and exposures (CVEs) within their software. Meticulously patched to reduce the number of total vulnerabilities, RapidFort Curated Images offer a secure foundation for software development and deployment, featuring daily rebuilds, FIPS readiness and accelerating FedRAMP compliance and saving enterprise development resources.

RapidFort Curated images is the first of a three step process leveraging the RapidFort Platform to remediate up to 95% of all CVEs across the application development process. RapidFort's secure container image repository includes three categories of curated images, available in both FIPS and non-FIPS versions: base images, framework images and third-party open-source images. All images are STIG-compliant, hardened and patched, and include RapidFort’s unique analysis providing contextual “Justification Advisory” to weed out real vs. false positive CVEs. The repository is updated several times per week and whenever a new patch for a known CVE is released. Historical versions of these images are retained for 6 months after they reach end-of-life, ensuring continued access. Unlike first generation near zero CVE image vendors in the market, RapidFort does not force customers to re-baseline to a proprietary operating system with no real community support. RapidFort images are based on the most mature and popular Linux distributions: Ubuntu, Red Hat, and Alpine to minimize the impact and ensure compatibility with our end customer’s existing software builds.

Organizations can significantly reduce costs and resource allocation dedicated to vulnerability management with RapidFort Curated Images. The need for a dedicated team of engineers to research and patch images is eliminated, reducing costs to a tenth. When combined with RapidFort’s SASM platform, users can remediate the majority of their software vulnerabilities automatically and early in the development cycle. When leveraging Rapidfort’s Platform, users can expect:

Up to a 10% reduction in development cycle time for patching unused components
An 88% reduction in software attack surface
A 2-3 week reduction in code release time for every major release
A 1-3% infrastructure cost savings from smaller size images
Up to 11x faster container boot time

“Software vulnerabilities are a perpetual challenge for developers, creating a relentless cycle of patching that can leave organizations vulnerable. Compliance regulations, like FedRAMP, DSS, PCI and public companies facing breach notification mandates, add another layer of complexity to this problem,” said Mehran Farimani, CEO of RapidFort. “Our new curated images offering is a game-changer for organizations striving to enhance their security posture while maintaining operational efficiency. By providing a secure, meticulously patched foundation for software development, we empower our clients to achieve near-zero CVEs and navigate the complexities of compliance with ease.”

RapidFort offers an end-to-end solution for CVE remediation, addressing all three lifecycle steps: starting with curated images, instrumenting and profiling, and hardening and monitoring. Unlike other offerings that rely on third parties and additional tools, RapidFort provides a comprehensive platform that manages the entire remediation process, from images to production. This unique capability positions RapidFort as a leader in the market, delivering unparalleled security and compliance solutions, as exemplified by the company’s inclusion in SpaceWERX’s Innovate to Accelerate cohort.

To learn more about RapidFort Curated Images, please visit: https://hub.rapidfort.com

For more information about the RapidFort platform, please visit: https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort Appoints Industry Veteran George Manuelian as Chief Strategy and Revenue Officer

Press Release

January 20, 2026

RapidFort Appoints Industry Veteran George Manuelian as Chief Strategy and Revenue Officer

RapidFort names George Manuelian as Chief Strategy and Revenue Officer to accelerate market expansion and adoption of its cybersecurity platform.

No items found.

RapidFort names George Manuelian as Chief Strategy and Revenue Officer to accelerate market expansion and adoption of its cybersecurity platform.

RapidFort Appoints Industry Veteran George Manuelian as Chief Strategy and Revenue Officer

Curated container images provide a secure foundation for software development and accelerated FedRAMP authorization

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), today announced the appointment of George Manuelian as Chief Strategy and Revenue Officer (CRO). With a proven track record of scaling high-growth technology companies, Manuelian brings nearly three decades of experience in the cybersecurity, cloud, and networking industries to his new role.

Prior to joining RapidFort, Manuelian held a pivotal position as Vice President of Worldwide SASE GTM (Go-to-Market) at Palo Alto Networks, where he led the business to impressive revenue growth exceeding $1.2 billion. Before his tenure at Palo Alto Networks, Manuelian was instrumental in building several key software partnerships at Amazon Web Services, fostering strategic alliances and expanding market reach. Following his role at AWS, Manuelian served as VP of Sales Engineering at Versa Networks, where he successfully grew the business to over $100 million ARR. His instrumental role in driving sales strategy and execution contributed significantly to Versa Networks' rapid expansion. Prior to Versa Networks, Manuelian held leadership roles at Cisco for over 20 years, where he spearheaded innovation in mobile and cloud services.

“George's deep understanding of the cybersecurity landscape, coupled with his exceptional leadership abilities, make him an invaluable asset to RapidFort,” said Mehran Farimani, CEO of RapidFort. “His proven success in scaling high-growth companies aligns perfectly with our ambitious growth plans. We are confident that George’s expertise will be instrumental in accelerating our market expansion and delivering exceptional value to our customers.”

“I am thrilled to join RapidFort at this pivotal stage of its growth journey,” said Manuelian. “The company’s innovative cybersecurity platform has the potential to revolutionize the way organizations approach software security. I look forward to leveraging my experience to drive strategic partnerships, expand market reach, and contribute to RapidFort’s continued success.”

RapidFort is a cybersecurity platform that revolutionizes software development by streamlining vulnerability remediation. The platform empowers developers to secure applications effortlessly in just three steps: Curated base image, container instrumentation and profiling, and ongoing hardening and monitoring. By automating vulnerability remediation, RapidFort offers customers a near zero CVE foundation for their base, framework and 3rd party application open source software. This innovative approach delivers substantial cost savings, including a 10% reduction in software development expenses, a 2-3 week decrease in time-to-market for major releases, and a 3% decrease in infrastructure costs. Ultimately, RapidFort dramatically lowers the overall cost of securing software while ensuring compliance with industry standards.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort Appoints Proven Leader Ben de Waal as Vice President of Research and Development

Press Release

January 20, 2026

RapidFort Appoints Proven Leader Ben de Waal as Vice President of Research and Development

RapidFort names Ben de Waal as VP of Research & Development to ensure next generation products meet the demands of security & development teams.

No items found.

RapidFort names Ben de Waal as VP of Research & Development to ensure next generation products meet the demands of security & development teams.

RapidFort Appoints Proven Leader Ben de Waal as Vice President of Research and Development

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), today announced the appointment of Ben de Waal as Vice President of Research and Development. De Waal joins RapidFort as a highly skilled engineer and entrepreneur with more than 65 patents to his name and a proven track record of leading and growing teams in both large organizations and startups.

At RapidFort, de Waal will be responsible for next-generation product development, focusing on enhancing RapidFort’s offerings to meet the evolving demands of security and development teams. Prior to joining RapidFort, de Waal held various senior roles at technology companies, most notably serving as Vice President of GPU Software at NVIDIA. There he led the development of GPU and CUDA products and worked closely with industry partners to help shape the direction of modern GPU technology, significantly improving graphics processing performance for both consumer and enterprise markets.

After his time at NVIDIA, de Waal co-founded IonGrid, where he served as CTO and developed a secure platform for remote document access. His work addressed the critical security challenges of “Bring Your Own Device” (BYOD) policies, which led to IonGrid’s acquisition by NetApp in 2013. Later, as Founding CTO of HintMD, de Waal created an innovative FinTech platform tailored to the medical aesthetics industry, streamlining client-provider interactions and facilitating HintMD’s acquisition by Revance Therapeutics in 2020.

“We’re working to develop our next-generation capabilities at RapidFort, and Ben is exactly the leader we need to make this vision a reality,” said Russ Andersson, Chief Operating Officer of RapidFort. “His unique blend of technical expertise, strategic insight, and entrepreneurial spirit makes him an exceptional fit for this role, and we’re thrilled for him to lead the projects that will shape our future.”

RapidFort is a cybersecurity platform revolutionizing software development through streamlining vulnerability remediation. The platform empowers developers to secure applications effortlessly in three steps with: Curated base images, container instrumentation and profiling, and continual hardening and monitoring. By automating vulnerability remediation, RapidFort offers customers a near zero CVE foundation for their base, framework and 3rd party application open-source software. This innovative approach delivers substantial cost savings, including a 10% reduction in software development expenses, a 2-3 week decrease in time-to-market for major releases, and a 3% decrease in infrastructure costs. Ultimately, RapidFort dramatically lowers the overall cost of securing software while ensuring compliance with industry standards like NIST Zero Trust, DoD requirements, FedRAMP and SOC 2.

“I’m thrilled to be joining RapidFort at this inflection point in the company’s journey,” said de Waal. “I’ve always felt security should be an integral part of the development process, not an afterthought, and at RapidFort they’re making that happen. I’m looking forward to working with this talented team to enhance our solutions and make securing software easier and more accessible.”

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort Now Available in AWS Marketplace

Press Release

January 20, 2026

RapidFort Now Available in AWS Marketplace

RapidFort's SASM platform & curated images available in AWS Marketplace, offering enhanced security, compliance, cost savings, & more to AWS users.

No items found.

RapidFort's SASM platform & curated images available in AWS Marketplace, offering enhanced security, compliance, cost savings, & more to AWS users.

RapidFort Now Available in AWS Marketplace

Inclusion in the marketplace enhances availability of the industry’s premier attack surface management solution

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), is now available in AWS Marketplace, a tailored online marketplace enabling businesses of all sizes to discover, evaluate, purchase, implement, and manage solutions from AWS Partners. Customers now have greater access to the latest and powerful RapidFort SASM platform and curated near zero CVE images, which remove up to 95% of vulnerabilities with no code changes in the CI/CD pipeline.

RapidFort’s solution will be the first of its kind available within the AWS ecosystem and can be purchased directly through private offering and special pricing, meeting AWS spending obligations. By participating in AWS Marketplace RapidFort offers customers within the ecosystem unique benefits like simplified billing, cost savings, streamlined compliance, simple procurement, reduced risk and faster tool deployment. While most SASM solutions target specific stages of the software development lifecycle and cybersecurity, RapidFort stands out as the only proven end-to-end vulnerability management solution which includes curated zero-CVE images trusted by the DOD.

“We're excited to officially join the AWS Partner Network, offering AWS customers a comprehensive software vulnerability management solution that accelerates SOC-2 and FedRAMP compliance. Our solution accelerates AWS production deployments by at least three months,” said George Manuelian, CRO, Chief Strategy & Revenue Officer at RapidFort. “This partnership will empower more organizations to seamlessly secure their software infrastructure, and significantly reduce their attack surface meeting FedRAMP and NIS-2 software hardening requirements. We look forward to expanding our reach and continuing to deliver innovative solutions that fortify software security at scale.”

RapidFort's impact on the open-source community is significant. It has thousands of free hardened container images, over 6 million downloads, and more than 1.6 million active users, highlighting the critical need for its vulnerability remediation solution. As part of the AWS Marketplace, RapidFort provides a comprehensive and proven solution to AWS ecosystem customers globally.

RapidFort's innovative approach helps organizations remediate up to 95% of CVEs across the application development process, reduce their software attack surface by up to 90%, and speed up code release times by more than 3 weeks. This results in at least 10% reduction in software development expenses and a 3% decrease on average in infrastructure costs. RapidFort also accelerates compliance with industry standards like NIST Zero Trust requirements such as FedRAMP, SOC 2, NIS2, PCI, and HIPPA.

To find RapidFort on AWS Marketplace, please visit: https://aws.amazon.com/marketplace/seller-profile?id=a006c02c-541f-4dda-99b5-2706f70d5c11

To learn more about RapidFort, please visit: https://www.rapidfort.com.

About RapidFort

‍

RapidFort Expedites FedRAMP and SOC 2 Compliance - Now Available on Google Cloud Marketplace

Press Release

January 20, 2026

RapidFort Expedites FedRAMP and SOC 2 Compliance - Now Available on Google Cloud Marketplace

RapidFort's innovative SASM platform now available on Google Cloud Marketplace.

No items found.

RapidFort's innovative SASM platform now available on Google Cloud Marketplace.

RapidFort Expedites FedRAMP and SOC 2 Compliance - Now Available on Google Cloud Marketplace

Marketplace listing expands access to the industry's leading software attack surface management solution and near-zero CVE images

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), is now available in Google Cloud Marketplace, a unified marketplace of Google and partner solutions, designed to help customers easily explore, test, acquire, and deploy products. Organizations now have even greater access to RapidFort’s SASM platform and curated near zero CVE images, that when used together, remove up to 95% of vulnerabilities with no code changes in the CI/CD pipeline.

RapidFort can be purchased directly through private offering and special pricing within Google Cloud Marketplace, meeting any required spending obligations. Customers within the marketplace now have unfettered access to unique benefits such as simplified billing, cost savings, streamlined compliance, simple procurement, reduced risk and faster tool deployment. Most SASM solutions on the market are limited, targeting only specific stages of the software development lifecycle and cybersecurity. RapidFort stands out within the industry as the only proven end-to-end vulnerability management solution that includes curated zero-CVE images trusted by the DOD.

“We’re thrilled to join Google Cloud Marketplace, enabling greater access to RapidForts’ solutions,” said George Manuelian, CRO, Chief Strategy and Revenue Officer at RapidFort. “Our collaboration will allow more organizations to effectively and efficiently secure their software infrastructure, achieve SOC-2 and FedRAMP compliance, and accelerate GCP production deployments. As we grow our market presence, we look forward to continuing our mission of providing innovative solutions that enhance software security for all.”

RapidFort has had a major impact on the open-source community providing thousands of free hardened container images. With over 6 million downloads and more than 1.6 million active users, there's a clear need for RapidFort’s vulnerability remediation solution. RapidFort's innovative approach to SASM helps organizations remediate up to 95% of CVEs across their application development pipeline, reducing their software attack surface by up to 90%, and speeding up code release times by more than 3 weeks. These efficiencies result in a 10% or more reduction in software development expenses and a 3% decrease on average in infrastructure costs. RapidFort also accelerates compliance with industry standards like NIST Zero Trust requirements for FedRAMP, SOC 2, NIS2, PCI, and HIPPA.

To find RapidFort on Google Cloud Market Place, please visit: https://console.cloud.google.com/marketplace/product/rapidfort-public/rapidfort-near-zero-cve-images-and-sasm-platform

To learn more about RapidFort, please visit: https://www.rapidfort.com.

About RapidFort

Beyond Identity Accelerates Path to FedRAMP Certification with RapidFort, Slashing Time and Costs

Press Release

January 20, 2026

Beyond Identity Accelerates Path to FedRAMP Certification with RapidFort, Slashing Time and Costs

Beyond Identity cut FedRAMP costs by 50% and shortened the certification process by 3 months using RapidFort’s platform.

No items found.

Beyond Identity cut FedRAMP costs by 50% and shortened the certification process by 3 months using RapidFort’s platform.

Beyond Identity Accelerates Path to FedRAMP Certification with RapidFort, Slashing Time and Costs

Partnership fast-tracks access to government markets and simplifies compliance

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, has partnered with Beyond Identity, a leading provider of identity and access management solutions, to reduce the time and costs of FedRAMP certification. By working together with RapidFort, Beyond Identity shortened the certification process by three months and cut associated costs by 50%, outperforming alternative approaches and cementing its credibility in the government sector.

"RapidFort was an excellent and comprehensive partner during our FedRAMP journey,” says Borislav Ivanov, Engineering Manager, Site Reliability Engineering at Beyond Identity. “They cut the cost of image hardening and SSDLC efforts by 50%, shaved three months off our overall compliance timeline, and delivered outstanding support every step of the way."

Achieving FedRAMP certification is a crucial and complex process for any organization looking to provide solutions to the federal government, demanding extensive documentation, security testing, and ongoing compliance efforts. Beyond Identity wanted to streamline this process and reduce overall certification costs, all without overburdening its engineering team.

RapidFort played a critical role in helping Beyond Identity earn its certification, while achieving its budgetary and process goals in 3 key ways:

Simplified the compliance process with pre-hardened, near-zero CVE Curated Images aligned with NIST 800-70, FIPS 140-2, and 140-3 standards, establishing a secure foundation, and cutting through a significant portion of the initial compliance work.
Streamlined the benchmarking process with their automated scanning tools, ensuring Security Technical Implementation Guide (STIG) hardened applications.
Automatically generated the necessary compliance documentation, including Plan of Action and Milestones (POAM) and Software Bill of Materials (SBOM), further reducing labor-intensive work.

“Our customers are developing cutting-edge security solutions for both the private and public sectors, so it’s imperative that their offerings are approved for government use as quickly as possible,” said Mehran Farimani, CEO of RapidFort. “We’re proud to be setting the industry standard for FedRAMP certification support, streamlining a traditionally formidable process, and strengthening the infrastructure that helps secure our nation.”

RapidFort, already available through Platform One, Tradewind Marketplace, AWS Marketplace, Microsoft Azure Marketplace, Google Cloud Marketplace, and Carahsoft, provides a reliable and efficient pathway for organizations looking to enter the federal marketplace and drive growth in the government sector. For more information about the RapidFort platform, please visit: https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort to Showcase at RSA Conference 2025

Press Release

January 20, 2026

RapidFort to Showcase at RSA Conference 2025

RapidFort will showcase its Software Attack Surface Management platform at RSA 2025, enabling 95% vulnerability remediation with no code changes.

No items found.

RapidFort will showcase its Software Attack Surface Management platform at RSA 2025, enabling 95% vulnerability remediation with no code changes.

RapidFort to Showcase at RSA Conference 2025

Remediate 95% of vulnerabilities, shrink software attack surfaces up to 90% with no code changes and speed up software releases by 2 - 3 weeks

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, will be exhibiting at RSA 2025.

Meet Face-to-Face:

Visit the company's live demo spotlight at booth #0867, Moscone South Expo., as they highlight their cutting-edge, global software supply chain security solution, the RapidFort Software Attack Surface Management (SASM) platform.

RapidFort is also hosting a series of exclusive networking events to engage with customers, partners, and industry leaders. Space is limited and attendance is by invitation only. Attendees interested in requesting an invitation can visit RapidFort’s Booth (#0867) during RSA or contact us ahead of the event.

Opening Yachting Day on the Bay | Expert panel discussion on evolving DoD security, Authority to Operate (ATO), and procurement standards (In partnership with the Spades Institute)
RapidFort Customer Networking Event
Cloud Meets Wine: A Women & Colleagues Cybersecurity Event (In partnership with Firstboard.io)

“At RSA Conference 2025, we’re excited to demonstrate how RapidFort is transforming vulnerability management, compliance acceleration, and cost reduction, with our end-to-end platform and near-zero CVE images,” said George Manuelian, CRO RapidFort. “Organizations need a proactive, automated approach to securing their environments, and that’s exactly what we deliver.”

The RapidFort Platform

Software vulnerabilities are a constant challenge for developers, creating an ongoing cycle of patching that leaves organizations unnecessarily exposed. At the same time, compliance requirements like FedRAMP, cATO, CMMC, and SOC 2 add operational and financial overhead, especially for government and defense. To achieve compliance and effectively secure software, businesses need a proactive, scalable approach to vulnerability management that reduces risks without adding unnecessary complexity. Specifically designed to secure modern software infrastructure, RapidFort’s Software Attack Surface Management (SASM) platform automatically remediates 95% of vulnerabilities, streamlines compliance efforts, and speeds up software releases by 2 - 3 weeks, all while reducing the overall cost of securing software by 10%. RapidFort provides an end-to-end solution that empowers organizations to secure their software supply chain and developers to secure applications effortlessly in three steps with curated images, instrumenting and profiling, and continual hardening and monitoring.

At the core of RapidFort’s platform are thousands of curated Near-Zero CVE images. Meticulously patched to reduce the number of total vulnerabilities, RapidFort’s curated images feature daily rebuilds, FIPS readiness and FedRAMP acceleration, providing unmatched savings on enterprise development resources. Trusted by the U.S. Department of Defense (DoD) and IronBank, they provide organizations with a secure foundation to build and deploy applications. Combined with automated vulnerability remediation, the platform can shrink software attack surfaces up to 90% with no code changes. Unlike traditional vulnerability management tools, RapidFort integrates effortlessly into your existing CI/CD pipelines, requiring minimal adjustments, leveraging community-supported operating systems, and avoiding vendor lock-in. Ultimately, RapidFort dramatically lowers the overall cost of securing software while ensuring compliance with industry standards like NIST Zero Trust, DoD requirements, FedRAMP, CMMC, FIPS, CIS/STIG and SOC 2.

Upcoming

Following RSA, RapidFort will be at FeinDef 2025, booth 6A08, from May 12th-14th in Madrid, a premier European defense event where the team will demonstrate how European organizations can fast-track compliance for the European market. Additionally, RapidFort will participate in CMMC Day 2025 on May 5th, in College Park, MD, reinforcing RapidFort’s commitment to helping organizations streamline compliance in the U.S.

For more information about the RapidFort platform, please visit: https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

Press Release

January 20, 2026

RapidFort to Showcase at FeinDef 2025

RapidFort, the fastest growing cybersecurity company securing the global software supply chain, exhibiting at FeinDef 2025.

No items found.

RapidFort, the fastest growing cybersecurity company securing the global software supply chain, exhibiting at FeinDef 2025.

RapidFort to Showcase at FeinDef 2025

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, will be exhibiting at FeinDef 2025 in Madrid, Spain.

Meet At FeinDef:

Attendees can visit the company at booth 6A08 to see how their platform is securing supply chains across the globe by remediating up to 95% of vulnerabilities and shrinking software attack surfaces by as much as 90% with no code changes.

RapidFort is participating in AFCEA TechNet Augusta, CrowdStrike fal.con, Billington CyberSecurity Summit 2026, and DevOpsDays Dallas later this quarter.

Already trusted by the U.S. Department of Defense (DoD), IronBank, P1 Marketplace and Carahsoft, RapidFort has a proven track record of helping government agencies and contractors secure their software infrastructure, streamline compliance efforts, and accelerate the deployment of critical solutions. RapidFort provides the most efficient pathway for organizations looking to enter the federal marketplace and drive growth in the government sector by fast-tracking compliance processes like FedRAMP by months, slashing developer workloads by 30%, and speeding up software releases by 2-3 weeks.

“Our work with U.S. government agencies and federal contractors has demonstrated how organizations can secure their software and achieve compliance requirements quicker than ever before by leveraging RapidFort,” said George Manuelian, CRO RapidFort. “Our platform helps organizations reduce the burden of compliance processes felt by development and security teams. As we continue to expand globally, we’re helping organizations expedite certification, harden their software, and streamline their path to operational readiness.”

The RapidFort Platform

Developers are in a constant battle against software vulnerabilities, often caught in endless patch cycles, increasing organizational risk. At the same time, compliance frameworks like FedRAMP, FIPS 140-3, cATO, CMMC, and SOC 2 place financial and operational burdens on government agencies and the defense sector. To meet these demands and secure their software effectively, organizations need a proactive, streamlined approach to vulnerability management that strengthens software security without introducing unnecessary roadblocks.

Designed to secure modern software infrastructure, RapidFort’s Software Attack Surface Management (SASM) platform automatically remediates most vulnerabilities, streamlines compliance efforts, and speeds up software releases while reducing the overall cost of securing software by 10%. In just three steps—curated images, instrumenting and profiling, and continual hardening and monitoring—RapidFort provides a comprehensive solution that enables organizations to protect their software supply chain and developers to more easily build secure applications.

At the core of RapidFort’s platform are thousands of curated Near-Zero CVE images. Meticulously patched to reduce the number of total vulnerabilities, RapidFort’s curated images feature daily rebuilds, providing unmatched savings on enterprise resources and a secure foundation to build and deploy applications. Combined with automated vulnerability remediation, the platform drastically reduces attack surfaces. Unlike traditional vulnerability management tools, RapidFort integrates effortlessly into your existing CI/CD pipelines, requiring minimal adjustments, leveraging community-supported operating systems, and avoiding vendor lock-in. Ultimately, RapidFort dramatically lowers the overall cost of securing software while ensuring compliance with industry standards like NIST Zero Trust, DoD requirements, CIS/STIG and more.

For more information about the RapidFort platform, please visit: https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

CyberShark Pitch Competition Names Finalists from Second Round of 2025 Event Series

Press Release

January 20, 2026

CyberShark Pitch Competition Names Finalists from Second Round of 2025 Event Series

Congratulations to Sandfly Security and Senteon for joining Dropzone AI and RapidFort as finalists in the 2025 CyberShark Pitch Competition.

No items found.

Congratulations to Sandfly Security and Senteon for joining Dropzone AI and RapidFort as finalists in the 2025 CyberShark Pitch Competition.

CyberShark Pitch Competition Names Finalists from Second Round of 2025 Event Series

While on site at Black Hat, a panel of CISO judges evaluated pitches from emerging cybersecurity companies – congratulations to finalists Sandfly Security and Senteon

BALTIMORE--(BUSINESS WIRE)--LaunchTech Communications, a CyberRisk Alliance (CRA) resource specializing in PR and AR services for the cybersecurity industry, today announced the next two finalists to advance in the 2025 CyberShark Pitch Competition.

RSA Conference marked the launch of the 2025 program, where Dropzone AI and RapidFort advanced as finalists. Building on that momentum, Black Hat provided the stage for the next round of pitches, further expanding the pool of innovative companies advancing toward the final competition.

Sandfly & Senteon will advance to the final round of the competition, scheduled for October 16, where they will compete head-to-head with Dropzone AI & RapidFort in a live virtual broadcast. All members of CyberRisk Collaborative will be invited to judge.

2025 CyberShark Pitch Competition “Round 2” Finalists (Black Hat 2025):

Sandfly Security: Agentless Endpoint Detection and Response (EDR) for Linux.
Senteon: Continuous configuration remediation and enforcement for workstations, servers, and browsers that delivers audit ready endpoint compliance.

Other strong competitors in this round included Mimic, Bytewhisper, and Stream Security, who impressed judges with innovative approaches and advanced capabilities.

The CISO judges represented a range of industries, including technology infrastructure, financial and investment services, healthcare and pharmaceuticals, and retail and grocery. They voted to determine which presentation conveyed the most distinct value proposition and clear messaging.

Just as RSA set the tone for this year’s CyberShark series by identifying the first set of standout solutions, Black Hat reinforced the competition’s role as a proving ground for cutting-edge startups – highlighting the diverse ways innovators are tackling today’s cybersecurity challenges.

"The CyberShark Pitch Competition gives early-growth cybersecurity vendors a unique opportunity to validate their solutions in front of decision makers, while receiving candid, actionable feedback on their messaging, positioning, and product-market fit,” said Wayne Schepens, Chief Cyber Market Analyst at CyberRisk Alliance. “What makes this program so valuable is the collaborative spirit – our judges not only bring their deep expertise, but also an enthusiasm to engage in a supportive, low-pressure environment. The result is a win-win: vendors gain champions, grow relationships, refine their go-to-market strategy, and test their solutions against peers, while CISOs gain early insight into innovations that could shape the future of the industry."

Sandfly and Senteon will advance to the final round of the competition, scheduled for October 16, 2025, where they will compete head-to-head with Dropzone AI and RapidFort in a live virtual broadcast. All 3,000+ members of CyberRisk Collaborative will be invited to participate as judges in the final round.

For more information about LaunchTech Communications, visit https://golaunchtech.com.

About CyberRisk Alliance (CRA)

CyberRisk Alliance provides business intelligence that helps the cybersecurity ecosystem connect, share knowledge, accelerate careers, and make smarter and faster decisions. Through our trusted information brands, network of experts, and more than 250 innovative annual events we provide cybersecurity professionals with actionable insights and act as a powerful extension of cybersecurity marketing teams. Our brands include SC Media, the Official Cybersecurity Summits, Security Weekly, InfoSec World, Identiverse, CyberRisk Collaborative, ChannelE2E, MSSP Alert, LaunchTech Communications, TECHEXPO Top Secret and CyberRisk TV. Learn more at www.cyberriskalliance.com.

The Modern Data Company Selects RapidFort’s Curated Images and Platform to Enhance and Accelerate Customer Data Security

Press Release

January 20, 2026

The Modern Data Company Selects RapidFort’s Curated Images and Platform to Enhance and Accelerate Customer Data Security

The Modern Data Company enhances security and accelerates compliance with RapidFort's platform and curated images.

No items found.

The Modern Data Company enhances security and accelerates compliance with RapidFort's platform and curated images.

The Modern Data Company Selects RapidFort’s Curated Images and Platform to Enhance and Accelerate Customer Data Security

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced that The Modern Data Company, a pioneer in data products that radically simplify how enterprises activate their data, has chosen the RapidFort platform and curated images to enhance and accelerate its customer data security deployments across its environments.

With a mission to deliver reliable and scalable solutions for its customers, Modern identified the need for a security partner capable of reducing software vulnerabilities at the source. By adopting RapidFort’s curated images, Modern ensures its development teams and customers benefit from optimized, hardened containers with minimized attack surfaces, enhancing security and accelerating compliance across cloud and hybrid environments.

“Security is critical to the trust we build with our customers,” said Saurabh Gupta, Chief Strategy and Revenue Officer at The Modern Data Company. “RapidFort gives us a faster, more reliable way to enhance and accelerate secure deployments, empowering us to deliver safe, compliant, and resilient solutions, establishing trust from the start.”

RapidFort’s AI-powered platform offers Modern:

Curated Hardened Images: Continuously optimized, near-zero CVE images to enhance security posture from the start.
Automated Vulnerability Management: Real-time visibility and remediation to accelerate compliance with standards such as FedRAMP and CMMC.
Accelerated Time-to-Secure Deployment: Security embedded by default, enabling quick delivery of data-driven solutions to customers.

“There’s a growing demand for secure-by-design approaches to software deployment as security and compliance regulations evolve,” said Mehran Farimani, CEO of RapidFort. “We’re proud to partner with Modern to provide solutions that enhance and accelerate security while reducing vulnerabilities at scale.”

This partnership underscores a shared commitment between Modern and RapidFort to advance data security, compliance readiness, and customer trust. Schedule a call to learn more about how you can become a RapidFort partner.

About The Modern Data Company

The Modern Data Company is revolutionizing how businesses use data as a strategic asset. Its flagship platform, DataOS, is a cloud-native solution that solves complex data challenges 90% faster than traditional methods, at substantial cost savings. DataOS simplifies the entire data product lifecycle—from creation to deployment and maintenance—while uniquely supporting AI/ML era demands, including LLM and GenAI use cases, beyond conventional architectures. This empowers businesses to democratize data access for true self-service, accelerate time-to-market for data initiatives, and unlock data's full potential across the organization. By bringing software best practices to the data world, Modern is transforming data management with a focus on business outcomes. For more information visit: www.themoderndatacompany.com.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with curated near-zero CVE images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort Achieves Red Hat Certification, Strengthening Security for Enterprise Container Workloads

Press Release

January 13, 2026

RapidFort Achieves Red Hat Certification, Strengthening Security for Enterprise Container Workloads

RapidFort Analyzer has achieved the Red Hat Vulnerability Scanner Certification, validating compatibility, reliability, and performance.

No items found.

RapidFort Analyzer has achieved the Red Hat Vulnerability Scanner Certification, validating compatibility, reliability, and performance.

RapidFort Achieves Red Hat Certification, Strengthening Security for Enterprise Container Workloads

Certification validates accuracy, interoperability, and performance across Red Hat environments

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced that RapidFort Analyzer has achieved the Red Hat Vulnerability Scanner Certification, validating its compatibility, reliability, and performance across Red Hat platforms. This milestone underscores RapidFort’s commitment to delivering secure, high-performance container analysis and vulnerability management for enterprise workloads across Red Hat environments. Customers now gain increased confidence that their Red Hat–based container images are analyzed with exceptional precision, speed, and depth. This certification ensures seamless integration with Red Hat ecosystems, enabling organizations to trust that vulnerability scan results are accurate, reliable, and aligned with Red Hat’s rigorous quality standards.

As enterprises face an unprecedented surge in software vulnerabilities and supply chain risks, the challenge is more than operational, it’s systemic. According to the WEF Global Cybersecurity Outlook 2025, more than half of large organizations identify supply chain interdependencies as the top barrier to achieving cyber resilience, highlighting how hidden vulnerabilities in third-party software and vendors can ripple across entire ecosystems. Customers now benefit from RapidFort’s ability to eliminate noise from false positives, deliver research-backed vulnerability insights, and generate comprehensive SBOMs that improve software supply chain transparency. Combined with its ability to scan registries and Kubernetes clusters at scale, organizations can rapidly surface real risks, prioritize what truly matters, and strengthen compliance and security posture across their cloud-native environments, all while reducing operational overhead and accelerating secure software delivery.

The certification also demonstrates that RapidFort Analyzer seamlessly integrates with Red Hat platforms, leveraging Red Hat’s authoritative security data to accurately identify affected components, apply Red Hat–specific severity ratings, and exclude vulnerabilities that are not applicable or have already been resolved through backported fixes. This reduces false positives and enables teams to focus on actionable security findings.

“Developers are asked to do more than ever, and they need clear, reliable information so they can focus on the work that matters,” said Rajeev Thakur, CTO and Co-Founder of RapidFort. “As developers ourselves, the goal is to give teams accurate results they can trust, so they can move quickly and build with confidence. This certification reinforces that commitment and ensures we’re meeting the standards Red Hat teams depend on.”

Unlike other scanners, RapidFort Analyzer’s deep binary-level visibility and alignment with Red Hat security practices help organizations strengthen their security posture, reduce noise, and accelerate remediation across their containerized environments. For more information on RapidFort’s Analyzer, please visit: https://www.rapidfort.com/blog/inside-rapidfort-analyzer-precision-vulnerability-intelligence-for-containers.

For additional details on the Red Hat Vulnerability Scanner Certification, view Red Hat’s official listing here: https://catalog.redhat.com/en/software/vulnerability-scanner/detail/297217.

About RapidFort

With a free tier and community-maintained images, RapidFort makes secure development accessible to teams of any size. Learn more at rapidfort.com.

RapidFort Introduces Kimia Open Source Project

Press Release

January 13, 2026

RapidFort Introduces Kimia Open Source Project

Kimia provides an actively maintained alternative to Kaniko, enabling secure, verifiable, and compliant container builds.

No items found.

Kimia provides an actively maintained alternative to Kaniko, enabling secure, verifiable, and compliant container builds.

RapidFort Introduces Kimia Open Source Project

New container build platform replaces Kaniko with enterprise-grade security, 100% backward compatibility, and 90% attack surface reduction

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced the release of the Kimia open source project, a next-generation, daemon-less container build system, developed in collaboration with SOSi. Kimia is the natural successor to Kaniko—which is no longer maintained—and delivers 100% backward compatibility for Kaniko users while dramatically improving performance and security.

As organizations look for a secure, actively maintained alternative to Kaniko, Kimia steps in to fill the gap. Building on Kaniko’s innovation of removing Docker daemon dependencies, Kimia adds enterprise-grade security features and complete Dockerfile support. While maintaining Kaniko’s ease of use, Kimia introduces true rootless operation, and real-time Software Bill of Material (SBOM) generation, giving teams a secure, compliant, and efficient build pipeline for modern cloud environments. By running entirely as a non-root process and using minimal Linux capabilities (SETUID and SETGID), Kimia provides complete privilege isolation through user namespaces and is fully compliant with Kubernetes Pod Security Standards “Restricted” policy.

“Kaniko solves a critical challenge for developers, building containers securely without privileged mode,” said George Manuelian, Chief Strategist at RapidFort. “With Kimia, we take that foundation further by embedding attestation, signing, and continuous validation directly into the build process, transforming container builds into verifiable, supply chain–secure operations.”

Key highlights of Kimia include:

Drop in replacement for Kaniko
Reproducible builds: Ensures consistent, bit-for-bit identical outputs
Image Signing: Cryptographic signatures for verification
Attestation (SBOM & Provenance)
SBOM: Lists all software components in the image
Provenance: Documents how/when/where the image was built

“Collaborating on Kimia reinforces our commitment to advancing secure, modern software delivery,” said Kyle Fox, Chief Technology Officer at SOSi. “Kimia gives our teams — and the customers we serve — a hardened, fully verifiable build process with strong attestation that finally closes long-standing gaps in supply-chain security. It offers a seamless path forward for organizations that need both speed and compliance.”

Kimia is available immediately for download from ghcr.io, and organizations currently using Kaniko can migrate within minutes using existing configurations. For detailed migration guides, documentation, and deployment examples, visit https://us01.rapidfort.com/docs/smithy or the project’s GitHub repository at https://github.com/rapidfort/kimia.

About RapidFort

With a free tier and community-maintained images, RapidFort makes secure development accessible to teams of any size. Learn more at rapidfort.com.

RapidFort Strengthens Market Leadership and Gains Industry Recognition: Surpasses 100 Customers, 15,000 Curated, Near-zero CVE hardened images, and inclusion in Gartner® Research

Press Release

January 13, 2026

RapidFort Strengthens Market Leadership and Gains Industry Recognition: Surpasses 100 Customers, 15,000 Curated, Near-zero CVE hardened images, and inclusion in Gartner® Research

RapidFort advances software supply chain security, surpasses 100 customers, 15k hardened images, and earns 2025 Gartner Cool Vendor recognition.

No items found.

RapidFort advances software supply chain security, surpasses 100 customers, 15k hardened images, and earns 2025 Gartner Cool Vendor recognition.

RapidFort Strengthens Market Leadership and Gains Industry Recognition: Surpasses 100 Customers, 15,000 Curated, Near-zero CVE hardened images, and inclusion in Gartner® Research

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced major milestones that mark a surge in adoption, positioning the company for accelerated momentum and market expansion in 2026. The company has now exceeded 100 customers worldwide, including 40 that achieved FedRAMP or ATO certification through RapidFort’s platform and curated images. This continued traction underscores RapidFort’s leadership in trusted, compliant software delivery, reflected by a catalog of more than 15,000 Curated, near-zero CVE hardened images. RapidFort was also recognized in the 2025 Gartner® Cool Vendors™ in Container Management report.

“We maintain that our success reflects the trust our customers place in RapidFort to help them move faster and stay secure,” said George Manuelian, Chief Strategy and Sales Officer at RapidFort. “Our mission has always been to make secure software delivery a natural part of how modern teams build. The momentum we’re seeing today is proof that our approach resonates, and that RapidFort is becoming a trusted foundation for building software with confidence.”

Customer Trust Drives RapidFort’s Momentum

RapidFort’s growth is fueled by its ability to help teams build and ship secure software faster while reducing attack surfaces. Through a powerful combination of automated CVE remediation, continuous scanning, intelligent profiling, and automated hardening tools, RapidFort eliminates unnecessary vulnerabilities, streamlines compliance, and accelerates deployment cycles. Customers routinely achieve up to 95% fewer CVEs, reduced exposure across their software supply chain, and simplified audit readiness, all without code changes or pipeline disruption.

Expanding Customer Impact Across Regulated and Enterprise Markets

With over 100 organizations now leveraging RapidFort, the platform has become trusted across defense, federal, and enterprise sectors, with over 40 customers achieving FedRAMP or ATO certification. By automating vulnerability remediation, integrating runtime hardening, and providing Runtime Bill of Materials (RBOM™) visibility, RapidFort empowers teams to meet federal and enterprise standards with unprecedented speed. RapidFort’s customers include organizations such as:

Defense Unicorns - Used RapidFort to harden and deploy secure software in classified environments, eliminating over 98% of critical and high CVEs and reducing image sizes by a total of 140MB (5.9%).
ColorTokens - Accelerated federal certification timelines by three months after reducing its attack surface by 77% and cutting their vulnerability backlog.
Beyond Identity - Reduced compliance costs by 50% while shortening its path to FedRAMP approval by three months.

Expanding the Industry’s Most Comprehensive Hardened Image Catalog

In addition, RapidFort’s 15,000 curated near-zero CVE, hardened images represent the most comprehensive secure image catalog available today. Each image is FIPS 140-3 validated, and STIG/CIS benchmarked, ensuring enterprise-grade compliance from the start. Beyond images, RapidFort provides end-to-end supply chain protection, securing both first and third-party software with RBOM™ insights, runtime monitoring, and automatic workload hardening, all of which is designed to reduce vulnerabilities and strengthen software security across the software development lifecycle.

Industry Recognition and a Look Ahead

RapidFort’s recognition in the 2025 Gartner® Cool Vendors™ in Container Management report comes at a time where software supply chains have become central to national and enterprise resilience. It’s clear to us that, RapidFort is setting the standard for delivering hardened, compliant, and open-source-based software, faster and confidently.

For reference requirements for any listed customers, please email: [email protected]

For more information about the RapidFort platform, please visit: https://www.RapidFort.com.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with curated near-zero CVE images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

‍

CyberShark Pitch Competition Names RapidFort as 2025 Winner

Press Release

January 13, 2026

CyberShark Pitch Competition Names RapidFort as 2025 Winner

RapidFort is the winner of the 2025 CyberShark Pitch Competition, determined by CISO voting in the final round of the event series.

No items found.

RapidFort is the winner of the 2025 CyberShark Pitch Competition, determined by CISO voting in the final round of the event series.

CyberShark Pitch Competition Names RapidFort as 2025 Winner

LaunchTech extends gratitude to the CISOs who served as judges and provided expert insights and guidance throughout the 2025 CyberShark season

BALTIMORE--(BUSINESS WIRE)--LaunchTech Communications, a CyberRisk Alliance (CRA) resource specializing in PR and AR services for the cybersecurity industry, today announced RapidFort as the winner of the 2025 CyberShark Pitch Competition.

The 2025 event series spotlighting innovation and excellence in cybersecurity brought together promising growth-stage companies from across the market landscape, offering them a platform to demonstrate their technology and vision to a panel of CISOs and experienced industry experts.

The 2025 CyberShark Pitch Competition highlighted the innovative strength of cybersecurity vendors and reinforced CyberRisk Alliance’s commitment to advancing collaboration, thought leadership, and technological innovation across the industry.

RapidFort emerged as the 2025 winner as a result of presenting a compelling pitch during the final round, held virtually on Oct. 16. The event featured dedicated CISO members of the CyberRisk Collaborative and broader industry who participated as judges to vote for the winner.

Earlier rounds of this year’s CyberShark competition saw strong performances from a diverse field of competitors. At RSA Conference 2025, Dropzone AI, represented by Edward Wu, advanced as a finalist alongside RapidFort. At Black Hat USA 2025, Sandfly Security, represented by Craig Rowland, and Senteon, represented by Henry Zhang, joined the finalist lineup following standout presentations.

“We are honored to be named the winner of the 2025 CyberShark Pitch Competition,” said George Manuelian, Chief Strategy and Sales Officer at RapidFort. “This recognition reinforces our commitment to helping organizations build secure software, faster and with confidence. As security and compliance requirements evolve, it’s clear that integrating security from the start is no longer optional. The CyberShark experience has been incredible, connecting us directly with CISOs, providing valuable insights, and validating our mission to make secure software delivery a natural, continuous part of how modern teams build.”

Wayne Schepens, Chief Cyber Market Analyst at CyberRisk Alliance, added, “The CyberShark Pitch Competition is one of the most exciting projects I’ve had the fortune to lead. CyberShark gives growth-stage cybersecurity vendors a unique opportunity to validate their solutions, while receiving candid, actionable feedback on their messaging, positioning, and product-market fit. What makes this program so valuable is the collaborative spirit; our judges not only bring their deep expertise, but also an enthusiasm to engage in a supportive, low-pressure environment. It's a win-win: vendors gain champions, grow relationships, refine their go-to-market strategy, and test their solutions against peers, while CISOs gain early insight into innovations that could shape the future of the industry.”

The 2025 CyberShark Pitch Competition highlighted the innovative strength of cybersecurity vendors and reinforced CyberRisk Alliance’s commitment to advancing collaboration, thought leadership, and technological innovation across the industry.

If you are an emerging cybersecurity vendor and would like to be considered for a pitch slot in the 2026 CyberShark event series, please submit your self-nomination to [email protected].

For more information about LaunchTech Communications, visit https://golaunchtech.com.

About CyberRisk Alliance (CRA)

CyberRisk Alliance provides business intelligence that helps the cybersecurity ecosystem connect, share knowledge, accelerate careers, and make smarter and faster decisions. Through our trusted information brands, network of experts, and more than 250 innovative annual events we provide cybersecurity professionals with actionable insights and act as a powerful extension of cybersecurity marketing teams. Our brands include SC Media, the Official Cybersecurity Summits, Security Weekly, Identiverse, CyberRisk Collaborative, LaunchTech Communications, Execweb, InfoSec World, ChannelE2E, MSSP Alert, and TECHEXPO Top Secret. Learn more at www.cyberriskalliance.com.

‍

Krumware and RapidFort Partner to Deliver Comprehensive Container Security Solutions with Near-Zero CVE Images

Press Release

January 13, 2026

Krumware and RapidFort Partner to Deliver Comprehensive Container Security Solutions with Near-Zero CVE Images

RapidFort and Krumware partner to deliver near-zero CVE images, 60% faster deployments, and streamlined compliance for enterprise container security.

No items found.

RapidFort and Krumware partner to deliver near-zero CVE images, 60% faster deployments, and streamlined compliance for enterprise container security.

Krumware and RapidFort Partner to Deliver Comprehensive Container Security Solutions with Near-Zero CVE Images

New container build platform replaces Kaniko with enterprise-grade security, 100% backward compatibility, and 90% attack surface reduction

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced a strategic partnership with Krumware, a leading platform engineering and cloud-native application development company, to provide enterprises with secure, optimized container workloads. By combining Krumware’s platform engineering expertise with RapidFort's container hardening technology and AI-powered software security platform, the two companies are addressing the critical security challenges enterprises face deploying containerized applications at scale.

According to the SecurityVulnerability.io database there have been 33,969 vulnerabilities published so far in 2025, a 21% YoY increase when compared to this time in 2024, highlighting common enterprise security challenges like image sprawl, vulnerability management, and upstream supply chain risk. These challenges only represent a portion of the issues modern enterprises face when securing and deploying containerized applications across their environments and underscore the urgency of adopting comprehensive software supply chain security solutions. With RapidFort's curated near-zero CVE Images, DevTime profiling, and RunTime protection, organizations can reduce up to 95% of vulnerabilities and shrink their attack surface by 90%. Complementing this, Krumware’s platform engineering expertise ensures quick, seamless integration and enterprise-wide adoption.

"Modern enterprises need more than just vulnerability scanning; they need proactive security that's built into their development lifecycle," said Colin Griffin, Founder & CEO of Krumware. "Our partnership with RapidFort enables us to deliver hardened, optimized container workloads that dramatically reduce security risk while accelerating time-to-market for our clients' applications."

The integrated solution combines:

RapidFort's Near-Zero CVE Images: Hardened container images based on trusted LTS Linux distributions like Ubuntu, RHEL, Debian, and Alpine, with no vendor lock-in to proprietary OS.
Automated Attack Surface Reduction: Automatically secure unused components and shrink your software attack surface by 90% without burdening your development teams.
Krumware's Implementation Expertise: Industry leading cloud-native application development, Kubernetes deployment strategies, and platform engineering practices.
Continuous Security Optimization: Runtime protection and DevTime profiling for ongoing security posture improvement.

"Container security can't be an afterthought in today's threat landscape," said Mehran Farimani, CEO of RapidFort. "Our partnership with Krumware ensures that enterprises not only have access to secure container images, but also the engineering expertise and implementation support needed to deploy and maintain truly secure container environments."

The partnership delivers immediate value by accelerating deployment timelines and strengthening enterprise security posture. Early implementations have shown up to 95% fewer vulnerabilities and deployment time improvements of 60% compared to traditional container security approaches. Enterprises also benefit from faster compliance with hardened NIST 800-70 images, FIPS 140-2 validation, and integrated CIS/STIG benchmarks, as well as lower infrastructure costs through smaller, more efficient containers.

The joint solution is immediately available to enterprise customers through both companies' professional services organizations.

For more information about the RapidFort platform, please visit: https://www.RapidFort.com

About Krumware:

Krumware specializes in cloud-native software and platform engineering and provides services, software, and technical resources. By leading with developer advocacy and expertise developed through practice, Krumware helps companies build better software. For more information, visit: https://www.krum.io.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort the Leading Replacement for Bitnami Helm Charts Compatible Images

Press Release

January 13, 2026

RapidFort the Leading Replacement for Bitnami Helm Charts Compatible Images

RapidFort emerges as the leading replacement for Bitnami helm charts compatible images.

No items found.

RapidFort emerges as the leading replacement for Bitnami helm charts compatible images.

RapidFort the Leading Replacement for Bitnami Helm Charts Compatible Images

RapidFort’s hardened, near-zero CVE, image catalog offers Bitnami compatibility and simple migration, reducing CVEs by up to 100% while helping maintain compliance, strengthen security, and reduce costs

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, emerges as the clear leader in this transition, offering curated near-zero CVE images compatible with Bitnami helm charts, as enterprises seek alternatives to Bitnami’s recently deprecated image registry. With a catalog of Bitnami-compatible, production-grade container images, RapidFort enables organizations to maintain operational continuity while strengthening security and streamlining compliance.

Bitnami’s transition to a subscription-based image catalog has affected more than 500 million image pulls, forcing teams to remediate sudden risks in operational stability, compliance, and security. Many organizations project replacement costs to be between $100,000 and $500,000 annually. RapidFort’s curated images offer a cost-effective replacement that preserves existing workflows while strengthening long-term security and compliance.

RapidFort’s curated images offer a cost-effective replacement that preserves existing workflows while strengthening long-term security and compliance.

“We started RapidFort with the purpose of giving organizations the confidence to scale without sacrificing security,” said Mehran Farimani, CEO of RapidFort. “As the container ecosystem continues to evolve, teams need reliable tools that they can trust. We remain focused on helping teams adapt quickly and securely without compromising the standards they rely on.”

RapidFort’s AI-powered platform analyzes runtime to remove unused components, producing smaller, faster containers with an average ~95% CVE reduction and up to ~80% smaller images; for many popular stacks it eliminates all known vulnerabilities. Each SLSA Level 3, non-root image includes continuous monitoring and hardening, zero-day protection, cryptographic signing, provenance, SBOMs and VEX, and the catalog spans 200+ hardened images across common infrastructure, developer stacks and DevOps tooling.

RapidFort’s runtime scanner integrates with Helm charts, GitOps and Kubernetes operators with no app changes, inventories images to flag safe replacements, and enables validation and rollout in under four weeks with automated tests and blue-green deployment with rollback, supporting no-downtime migration and compliance with SOC 2, PCI DSS and NIST through minimized scope, distroless execution, audit trails and continuous control validation.

To begin your transition, schedule a 30-minute assessment to evaluate current Bitnami image usage and identify compatible RapidFort alternatives. With the help of RapidFort’s team, organizations can develop a customized transition strategy and complete rollout in under four weeks, resulting in long term improvements in security, compliance, and operational efficiency.

For more information about the RapidFort platform, please visit: https://www.RapidFort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

Defense Unicorns Accelerates Secure Software Delivery for Defense Missions with RapidFort

Press Release

January 13, 2026

Defense Unicorns Accelerates Secure Software Delivery for Defense Missions with RapidFort

Defense Unicorns achieves near-zero CVEs, delivers FIPS-validated modules, and accelerates secure software deployment using RapidFort’s platform.

No items found.

Defense Unicorns achieves near-zero CVEs, delivers FIPS-validated modules, and accelerates secure software deployment using RapidFort’s platform.

Defense Unicorns Accelerates Secure Software Delivery for Defense Missions with RapidFort

Partnership strengthens software security posture and enables faster deployments for defense environments

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, has partnered with Defense Unicorns, a veteran-owned defense tech startup, to scale and strengthen its container infrastructure while accelerating deployment of its secure runtime platform for defense missions, Unicorn Delivery Service (UDS). By leveraging RapidFort’s platform and Curated Near-Zero CVE Images, Defense Unicorns achieved a near-zero CVE state across the UDS platform, accelerated delivery, enhanced compliance, and optimized deployment without the overhead of building internal hardening pipelines.

“RapidFort’s experience within classified environments and collaborative approach has made them a trusted partner in helping us deliver secure, reliable software to the teams who need it most, without slowing down mission-critical deployments,” said Rob Slaughter, CEO of Defense Unicorns. “Their curated images, FIPS-validated modules, and hands-on support enabled our teams to meet compliance requirements effortlessly while accelerating delivery.”

Like many organizations delivering software in classified environments, Defense Unicorns faced the challenge of hardening software containers at scale, without delaying delivery. This prompted them to make a “build vs. buy” decision and, after evaluating multiple options and the current ecosystem of secure container vendors, they selected RapidFort as the most effective partner to meet their operational and security goals.

RapidFort and Defense Unicorns addressed these challenges by:

Eliminating over 98% of critical and high CVEs in the UDS Core platform compared to upstream images.
Delivering FIPS-validated modules across all 32 UDS Core images to support deployments in compliance-sensitive environments.
Reducing image sizes by a total of 140MB (5.9%), accelerating deployment in low-bandwidth and tactical edge environments.
Providing engineering collaboration to support fast turnaround on FIPS-compliant builds and resolve emerging issues.
Enabling Defense Unicorns to harden containers for its proprietary products, such as the UDS Registry, an OCI-compliant registry launched in June 2025.

“Security and speed are equally mission-critical in defense environments, but for many companies, achieving both can feel impossible,” said Mehran Farimani, CEO of RapidFort. “By leveraging RapidFort’s platform and Curated Near-Zero CVE Images, Defense Unicorns proved that it’s possible to accelerate the delivery of secure, compliant software, without compromising mission readiness.”

RapidFort, available through Platform One, Tradewind Marketplace, AWS Marketplace, Microsoft Azure Marketplace, Google Cloud Marketplace, Carahsoft, and now Azul provides organizations with a reliable and efficient pathway to secure their software supply chain. For more information about the RapidFort platform, please visit: https://www.rapidfort.com

To get started using UDS with RapidFort’s Curated Near-Zero CVE Images to securely deliver software for national security missions, reach out to Defense Unicorns at [email protected] or https://defenseunicorns.com/contact-us.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

About Defense Unicorns

Defense Unicorns is a veteran-owned defense tech startup founded in 2021 to make software a strategic deterrent for the U.S. Department of Defense. They build innovative technical solutions to securely develop and deploy mission software across cloud, on-premises, and tactical edge environments. ‘Defense Unicorns’ is trusted by the operators of some of the most critical systems in the world, including the U.S. Navy, Army, Air Force, and Space Force. Learn more about Defense Unicorns at https://defenseunicorns.com.

Azul and RapidFort Partner to Deliver Near-Zero CVE Enterprise Grade Java Container Images, Backed by Commercial Java Support

Press Release

January 13, 2026

Azul and RapidFort Partner to Deliver Near-Zero CVE Enterprise Grade Java Container Images, Backed by Commercial Java Support

Strategic collaboration aims to dramatically reduce security patching burden and strengthen software supply chain security for enterprise Java customers

No items found.

Azul and RapidFort Partner to Deliver Near-Zero CVE Enterprise Grade Java Container Images, Backed by Commercial Java Support

Strategic collaboration aims to dramatically reduce security patching burden and strengthen software supply chain security for enterprise Java customers

SUNNYVALE, Calif. & PALO ALTO, Calif.--(BUSINESS WIRE)--Azul, the only company 100% focused on Java, and RapidFort, the industry leader in software supply chain security, today announced a strategic partnership to deliver near-zero Common Vulnerabilities and Exposures (CVEs) third-party container images backed by Azul’s world-class Java support. This partnership, which combines Azul’s entire commercial Java portfolio, including Azul Platform Core and Azul Platform Prime, with RapidFort Curated Images, will accelerate developer productivity and reduce the burden of security patching while enabling secure software development practices to protect the software supply chain.

The partnership comes at a critical time as organizations face mounting pressure to secure their software supply chains amid escalating cyber threats. According to Verizon’s 2025 Data Breach Investigations Report, the exploitation of vulnerabilities (CVEs) has seen another year of growth and will surpass credential abuse as the #1 security attack vector by 2026. This places an enormous burden on both security and developer teams who must continuously patch and update systems.

Strategic collaboration between Azul and RapidFort aims to dramatically reduce security patching burden and strengthen software supply chain security for enterprise Java customers.

Transforming Container Security

RapidFort and Azul have joined forces to redefine how enterprises secure and run Java workloads in containers. By combining RapidFort’s advanced container optimization technology with Azul’s Platform Core and Platform Prime runtimes for Java 8 and later, organizations can now deploy hardened Java containers with unprecedented efficiency and security. These jointly curated images reduce vulnerabilities by up to 90%, significantly shrinking the attack surface. As a result, development teams benefit from less frequent patching and greater productivity, accelerating innovation without compromising security.

Unlocking Value Across Security, Speed, and Costs

The Azul/RapidFort partnership delivers several significant advantages for enterprise customers, including:

Reduced Patching Burden: Near-zero CVE container images mean fewer vulnerabilities to patch, allowing security teams to focus on more strategic initiatives.
Enhanced Supply Chain Security: Hardened container images provide a secure foundation for the entire software development lifecycle.
Accelerated Development: Developers can build applications faster without compromising security.
Regulatory Compliance: Compliance is made easier despite increasingly stringent security regulations and frameworks such as NIS2, CMMC and FedRAMP.
Lower Operational Costs: Maintenance burden and risk of security incidents is dramatically reduced.

”Enterprises are drowning in security vulnerabilities and patches,” said Mehran Farimani, founder and CEO of RapidFort. “Our partnership with Azul allows us to provide customers with hardened container images that are not only more secure by design but require significantly less ongoing maintenance. This is a game-changer for organizations looking to strengthen their security posture while reducing operational overhead.”

“Java remains the backbone of enterprise applications worldwide, and securing the Java ecosystem is critical to protecting the software supply chain,” said Scott Sellers, co-founder and CEO at Azul. “By partnering with RapidFort, we’re enabling organizations to deploy Java applications with confidence, knowing they’re backed by Azul’s world-class support organization and built on a foundation of security-hardened container images with minimal vulnerability exposure.”

Availability

The first set of jointly developed hardened container images is available immediately. These images will include all Java LTS (Long Term Support) releases starting with Java 8, and popular Java applications such as Apache Spark, Apache Kafka and Apache Tomcat. Interested customers can request more information here.

For more information:

About Azul

Headquartered in Sunnyvale, California, Azul provides the Java platform for the modern cloud enterprise. Azul is the only company 100% focused on Java. Millions of Java developers, hundreds of millions of devices and the world’s most highly regarded businesses trust Azul to power their applications with exceptional capabilities, performance, security, value, and success. Azul customers include 36% of the Fortune 100, 50% of Forbes top 10 World’s Most Valuable Brands, all 10 of the world’s top 10 financial trading companies. and leading brands like Avaya, Bazaarvoice, BMW, Deutsche Telekom, LG, Mastercard, Mizuho, Priceline, Salesforce, Software AG, and Workday. Learn more at azul.com and follow us @azulsystems.

About RapidFort

RapidFort is a software supply chain security platform that secures and optimizes modern infrastructure by reducing the attack surface of containerized applications and near-zero CVE, curated base images. Through continuous monitoring and intelligent removal of unnecessary components from container images, RapidFort significantly minimizes vulnerability exposure and patching requirements. This innovative approach enhances security posture, improves operational efficiency, and ensures end-to-end protection across the global software supply chain. The company's innovative approach has been recognized by leading industry analysts and is trusted by Global 2000 companies across finance, healthcare, and government sectors. For more information, visit www.rapidfort.com

RapidFort Assessed “Awardable” for Department of Defense work in the P1 Solutions Marketplace

Press Release

January 13, 2026

RapidFort Assessed “Awardable” for Department of Defense work in the P1 Solutions Marketplace

RapidFort now available in the P1 Solutions Marketplace, enabling government agencies and contractors to streamline software security and compliance.

No items found.

RapidFort now available in the P1 Solutions Marketplace, enabling government agencies and contractors to streamline software security and compliance.

RapidFort Assessed “Awardable” for Department of Defense work in the P1 Solutions Marketplace

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM) today announced that it has achieved “Awardable” status through the Platform One (P1) Solutions Marketplace.

The P1 Solutions Marketplace is a digital repository of post-competition, 5-minute long readily awardable pitch videos, which address the Government’s greatest requirements in hardware, software and service solutions. RapidFort’s solutions are designed to help developers significantly reduce the time and cost by at least 50% to achieve cATO and FedRAMP with near Zero CVE Curated Images and a broad set software hardening tools. RapidFort is used by a wide range of businesses, including Beyond Identity, Avalara, and Blue Cycle as well as government agencies such as the U.S. Air Force and Space Force.

“Our inclusion in the P1 Marketplace is a major step forward as we continue to strengthen our relationship with the Department of Defense,” said Mehran Farimani, CEO of RapidFort. “This milestone allows us to better support government agencies and contractors as they secure their software infrastructure, streamline compliance efforts, and accelerate the deployment of critical solutions. We’re excited to continue supporting the defense community with our innovative solutions, enhancing software security for all.”

RapidFort’s video, RapidFort CVE Management Platform with SCA Scanner, Profiler, Automated Image Hardening and Near Zero CVE Image Catalog, accessible only by government customers on the P1 Solutions Marketplace, presents an actual use case in which the company provides a complete software supply chain toolset for containerized workloads that includes image scanner, profiler, hardening tools along with FIPS compliant, STIGed Near Zero CVE Images. RapidFort was recognized among a competitive field of applicants to the P1 Solutions Marketplace whose solutions demonstrated innovation, scalability, and potential impact on DoD missions. Government customers interested in viewing the video solution can create a P1 Solutions Marketplace account at https://p1-marketplace.com.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

About the P1 Solutions Marketplace:

The P1 Solutions Marketplace is a digital repository of post-competition, readily awardable pitch videos that address the Department of Defense’s (DoD) most significant challenges in hardware, software and service solutions. All awardable solutions have been assessed through complex scoring rubrics and competitive procedures and are available to Government customers with a Marketplace account. Government customers can create an account at https://p1-marketplace.com.

For more information or media requests, contact: [email protected].

Contact RapidFort for additional information.

CyberShark Pitch Competition Names Finalists from First Round of 2025 Event Series

Press Release

January 13, 2026

CyberShark Pitch Competition Names Finalists from First Round of 2025 Event Series

Congratulations to Dropzone AI and RapidFort, the "Round 1" Finalists in the 2025 CyberShark Pitch Competition

No items found.

Congratulations to Dropzone AI and RapidFort, the "Round 1" Finalists in the 2025 CyberShark Pitch Competition

CyberShark Pitch Competition Names Finalists from First Round of 2025 Event Series

While on site at the 2025 RSA Conference, a panel of 10 CISO judges evaluated pitches from emerging cybersecurity companies in search of stand-out solutions – Congratulations to finalists Dropzone AI and RapidFort

BALTIMORE--(BUSINESS WIRE)--Hosted by LaunchTech Communications, a CyberRisk Alliance (CRA) resource specializing in PR and AR services for the cybersecurity industry, the CyberShark Pitch Competition today announced the first two finalists to advance in the 2025 program.

The CyberShark Pitch Competition provides emerging cybersecurity companies with an opportunity to pitch their product and receive feedback from Chief Information Security Officers (CISOs). During the in-person event held the week of RSA Conference, CISO judges from a variety of industries – including insurance, technology, food and beverage, pharmaceutical distribution, manufacturing, financial services, and more – voted to determine which presentation conveyed the most distinct value proposition and clear messaging.

By providing a platform for emerging companies to showcase their innovative solutions, we're not just identifying potential game-changers, we're actively investing in the future of cybersecurity.

“Not only did our exceptional panel of judges generously offer their time and deep cybersecurity expertise, but they also brought an incredibly meaningful level of enthusiasm to engage with the early-stage participants,” said Taylor Hadley, Vice President, LaunchTech Communications. “Their thoughtful post-pitch feedback ensured that each pitching company received immediate, actionable feedback on their messaging, positioning, and product-market fit in a supportive, low-pressure environment.”

Congratulations to the finalists!

2025 CyberShark Pitch Competition “Round 1” Finalists:

Dropzone AI – Provides pre-trained autonomous AI SOC analysts that work tirelessly alongside human teams.
RapidFort – Eliminates 95% of software vulnerabilities without code changes through its attack surface management platform and near-zero CVE images.

This round of the pitch event was particularly competitive, with each participating company demonstrating exceptional preparedness and exciting technological advancements. During the judging process, the CISO panel consistently commented on a few key elements of a strong pitch. These included: the value of delivering a clear problem statement, while avoiding FUD (fear, uncertainty and doubt); addressing how the product integrates with other systems and how it fits into the broader cybersecurity landscape; and providing examples of how the product performs in real-world scenarios demonstrates measurable benefits.

"The CyberShark Pitch Competition exemplifies the community spirit of our CISO network," said Dustin Sachs, Chief Technologist and Senior Director of Programs with the CyberRisk Collaborative. "By providing a platform for emerging companies to showcase their innovative solutions, we're not just identifying potential game-changers, we're actively investing in the future of cybersecurity. This program is a win-win; cybersecurity vendors gain invaluable feedback to inform their go to market strategy and exposure to potential word of mouth referrals, and our CISO community gains insight into breakthrough solutions and serve to potentially influence how these companies ultimately meet market needs."

"We established this program to ensure our clients have the opportunity to validate their solutions and interact directly with industry decision makers,” said Wayne Schepens, Chief Cyber Market Analyst of CyberRisk Alliance. "CyberShark allows vendors to gather valuable input, identify champions, validate their messaging and test their solutions against others. For vendors, there is no better test than pitching industry CISOs in a competitive environment; and for buyers there is no better way for them to play a role in the direction of future innovation. We look forward to continuing this initiative while making it available to more and more practitioners and technology producers.”

A second opportunity to pitch CISO judges in person will take place during the week of Black Hat USA 2025, where two more finalists will advance in the CyberShark Pitch Competition. Those finalists, and the finalists from RSA Conference, will go head-to-head in the final round of the competition taking place virtually as part of a live broadcast in the fall of 2025. All 2,000+ members of CyberRisk Collaborative will be invited to participate as judges in the final round. More information about CyberShark can be found here.

For more information about LaunchTech Communications, visit https://golaunchtech.com.

About CyberRisk Alliance (CRA)

ColorTokens Slashes Federal Compliance Timelines and Enhances Container Security with RapidFort

Press Release

January 13, 2026

ColorTokens Slashes Federal Compliance Timelines and Enhances Container Security with RapidFort

RapidFort optimizes ColorTokens federal compliance efforts and containerized infrastructure security.

No items found.

RapidFort optimizes ColorTokens federal compliance efforts and containerized infrastructure security.

ColorTokens Slashes Federal Compliance Timelines and Enhances Container Security with RapidFort

Partnership significantly improved company’s operational efficiency by eliminating critical software vulnerabilities and fast-tracking certification audits by three months

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, has partnered with ColorTokens Inc., a pioneer in Zero Trust security and leader in microsegmentation, to strengthen its containerized infrastructure security and optimize its federal compliance efforts. By leveraging RapidFort’s platform, ColorTokens notably reduced its attack surface by 77%, minimizing its security risks and improving security operations.

“RapidFort has measurably strengthened the security of both our cloud‑hosted SaaS platform and our on‑premise product,” said Harish Akali, CTO of ColorTokens, “It’s hardened container images, continuous scanning, and clear remediation guidance have cut our vulnerability backlog and supplied the evidence we needed to fast‑track FedRAMP, IRAP, and other certification audits.”

Like many organizations who enter the federal marketplace, ColorTokens was challenged by diverse third-party base images and complex DevSecOps workflows. The constant need to maintain stringent federal compliance standards, including FIPS and STIG, required a solution that would reduce vulnerabilities without overburdening engineering resources.

RapidFort helped ColorTokens address these challenges by:

Deploying FIPS and STIG aligned pre-hardened, near-zero CVE images for Ubuntu, Redis, Golang, and Node.js.
Reducing vulnerabilities through intelligent runtime profiling and automated removal of unused software components, dramatically reducing exposure and cutting down on manual patching efforts.
Embedding RapidFort’s runtime-aware scanner into CI/CD pipelines, providing continuous visibility, real-time vulnerability insights, and proactive control.
Accelerating compliance readiness by three months using built-in benchmarking and STIGing tools, simplifying the path to federal certifications like FedRAMP.

“Far too often, organizations must divert critical resources to remediate vulnerabilities and meet compliance requirements, rather than advancing core business priorities,” said Mehran Farimani, CEO of RapidFort. “By leveraging the RapidFort platform to optimize vulnerability management and minimize their security risks, ColorTokens was able to secure their software faster and with less strain on their teams, reducing the burden of meeting stringent federal compliance requirements.”

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort Simplifies FedRAMP Certification with Curated Images Supporting FIPS 140-3 Compliance

Press Release

January 13, 2026

RapidFort Simplifies FedRAMP Certification with Curated Images Supporting FIPS 140-3 Compliance

RapidFort adds FIPS 140-3 compliance to Curated Images, providing a secure foundation for software development, deployment, and FedRAMP authorization.

No items found.

RapidFort adds FIPS 140-3 compliance to Curated Images, providing a secure foundation for software development, deployment, and FedRAMP authorization.

RapidFort Simplifies FedRAMP Certification with Curated Images Supporting FIPS 140-3 Compliance

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), has announced support for FIPS (Federal Information Processing Standards) 140-3 compliance through its industry-first curated images offering. This leading-edge capability enables customers to easily meet the stringent security and compliance requirements of federal agencies and contractors. RapidFort is the first in the industry to achieve this milestone, accelerating the company’s leadership in zero Common Vulnerabilities and Exposure (CVE) images.

Replacing the widely adopted FIPS 140-2 cryptographic standard, FIPS 140-3 introduces enhanced protection against modern threats and aligns with international ISO/IEC (International Organization for Standardization/International Electrotechnical Commission) standards. FIPS 140-3 compliance is critical for organizations in government and regulated markets, securing sensitive data and meeting modern security requirements. A necessary step for companies looking to enter the federal marketplace, RapidFort streamlines FIPS readiness by providing FIPS 140-3 compliance across its entire portfolio of curated images, going beyond any other offering in the market. This ensures federal agencies and contractors can deploy secure and compliant software faster and more efficiently, accelerating time to market and saving enterprise development resources. When leveraging RapidFort’s Curated Images, users can expect:

Broad community support and no vendor lock-in: RapidFort allows customers to retain access to a wide range of major operating system (OS) distributions like Ubuntu, Red Hat, Alpine, and Debian (both FIPS and non-FIPS), with active community support. This ensures flexibility and cutting-edge functionality without compromise.
Minimal disruption to existing software pipelines: RapidFort integrates seamlessly into current workflows, allowing users to address vulnerabilities without requiring changes to existing tools or distributions. This reduces risks and avoids the disruptions typically associated with switching to unfamiliar operating systems, frameworks or platforms.
Cost-effective Enterprise License Agreement (ELA) model for comprehensive use: With a simplified pricing structure, RapidFort provides access to both FIPS and non-FIPS variants, including Bitnami and official-image versions, under a single repository. This unified model offers significant cost savings compared to competitors that charge separately for each variant, making it ideal for both Federal Risk and Authorization Management Program (FedRAMP) and commercial environments.
Streamlined compliance for FedRAMP and other standards: RapidFort simplifies regulatory compliance by including essential Center for Internet Security (CIS) and Security Technical Implementation Guides (STIG) benchmarking tools. Unlike competitors, RapidFort supports Defense Information Systems Agency (DISA) -approved distributions like Ubuntu and Red Hat, ensuring compliance even when configurations change during the build process.

“Meeting strict security and compliance requirements, especially in the federal space, can be an overwhelming challenge for organizations,” said Mehran Farimani, CEO of RapidFort. “We believe the path to compliance shouldn’t have to be complicated or restrictive. Our curated images streamline this process, allowing our customers to focus on their core mission, while we handle the rest.”

RapidFort offers an end-to-end solution for CVE remediation, addressing all three lifecycle steps: curated images, instrumenting and profiling, and hardening and monitoring. Unlike other offerings that rely on third parties and additional tools, RapidFort provides a comprehensive platform that manages the entire remediation process, from images to production.

To learn more about RapidFort Curated Images, please visit: https://hub.rapidfort.com

For more information about the RapidFort platform, please visit: https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

Solution Brief

July 13, 2026

RapidFort Curated Libraries

No items found.

Solution brief | Software supply chain security

RapidFort Curated Libraries

A comprehensive catalog of malware-scanned and curated libraries

Extends RapidFort protection beyond operating systems, software images, and packages to independently deployable libraries.

npm

PyPI

Maven

RubyGems

NuGet

WHERE RAPIDFORT CURATED LIBRARIES FIT

Curated Libraries sit early in the software delivery process - before untrusted packages enter the build, artifacts, or production.

Open Source Ecosystems

npm PypI Maven RubyGems NuGet

RapidFort Curated Libraries
Trusted libraries consumed through existing workflows

Build & CI/CD
Buid pipelines packages

Images & Artifacts

Container images internal artifacts

Delivered through existing package and artifact workflows no new security friction while security teams set policy on approved packages, versions, and images.

The Challenge

Attackers compromise maintainer accounts, publish malicious updates, or typosquat popular packages.

Attackers compromise maintainer accounts, publish malicious updates, or typosquat popular packages.
‍
The RapidFort Solution

Malware-scanned libraries developers can trust.

Same versions, interfaces, features, and CLI syntax already in use.

Consumed earlier in development - a preventive, not reactive, model.

The Result

Lower likelihood that malware reaches build pipelines, artifacts, or production.

Prevention up front instead of reaction after public disclosure.

KEY CAPABILITIES

Malware scanning at the source

Helps prevent malicious packages and compromised dependencies from entering pipelines.

Existing workflow support

Works with current operating systems, tools, artifact repositories, interfaces, and CLI syntax.

Reduced incident response burden

Less time hunting for malware and vulnerabilities after public disclosures.

Continuous compliance visibility

Up-to-date assessment and reporting for auditors, customers, and boards.

Policy-driven security

Shift from reactive vulnerability response to a proactive consumption model.

COMMON USE CASES

Secure open-source package consumption

Protected libraries for npm, PyPI, Maven, RubyGems, and NuGet ecosystems.

Reduce incident-response churn

Limit recurring "are we exposed?" investigationsafter a newly disclosed malicious package.

Protect CI/CD and production environments

Reduce the risk that malware enters a build,
artifact, image, or runtime through a dependency.

Support audits and customer assurance

Current compliance reporting to demonstrate security controls are in place.

Standardize approved software intake

A shared process across engineering and security
for consuming open-source libraries, packages,
and images.

THREATS ADDRESSED

Helps mitigate supply-chain malware in compromised packages and dependencies, including:

Malicious binaries

Backdoored dependencies

Install-time payloads

Typosquatted packages

Credential-stealing code

Downloaders

Cryptominers

Rootkits

Ransomware

…and other unauthorized changes introduced into open-source components.

BUSINESS OUTCOMES

Developer velocity

Maintain velocity while consuming trusted libraries.

Reduced malware risk

Lower chance of malware entering development and production.

Less incident churn

Less time responding to supply-chain incidents.

Audit-ready posture

Current reporting for customer, auditor, and board-level assurance.

No vendor lock-in

Keep familiar tools and operating systems.

SUMMARY

RapidFort Curated Libraries shift open-source security from detection and response to prevention -giving developers malware-scanned, compatible libraries that reduce the risk of compromised dependencies reaching production.

Solution Brief

July 7, 2026

RapidFort Supply Chain Risk Analysis

No items found.

Solution brief

RapidFort Supply Chain Risk Analysis

Independent, deep-binary malware and tampering detection across every image, library, file, and package before it ever reaches your environment.

Software supply chains run components that organizations did not build and cannot fully see. Malicious actors increasingly compromise open-source packages and container layers, embedding threats deep inside artifacts that signature-based scanners and vulnerability lists never reach. Self-reported fixes in new versions are not independently verifiable, and by the time a compromised package is discovered, it is often already running in production.

Security teams need a way to assess every artifact entering their environment, including images, open-source libraries, files, and packages, for malware and tampering before onboarding, not after an incident.

Solution

Supply Chain Risk mitigation is an integrated profiling and risk assessment capability built into the RapidFort platform. For RapidFort Curated Images (for Red Hat, Ubuntu, Debian, and Alpine) it automatically scans open-source libraries, files, and packages across ecosystems (including npm, PyPI, Maven, and RubyGems) for malware, tampering, and hidden threats, and surfaces the results in a dedicated Supply Chain Risk view.

This assessment is independently powered by ReversingLabs Spectra Assure, giving businesses a security claim backed by an independent, named third-party company rather than a self-reported scan result.

Up to 99.9%

CVE elimination in open-source images

422B+

files tracked by ReversingLabs threat intelligence

3-6 Months

faster time to compliance vs. platform migration

Key Capabilities

Malware-Scanned : Eliminate malicious binaries and install-time payloads at the source, across images, libraries, files, and packages.

Differential Version Analysis : Compares new package versions against prior releases to catch newly introduced malware or risky behavior changes.

Evidence-Backed Audit Trail : Every release includes an independently generated security report for customers, auditors, and regulators.

Tampering Verification : Cryptographic andstructural analysis helps identify unauthorizedmodification or repackaging of delivered artifacts.

Policy-Driven Release Gates : Packages that failsecurity policy are automatically blocked from the catalog until risks are remediated.

Pin-for-Pin Compatibility : Drop-in replacement that works with existing OS, tools, and CLI syntax. No migration or proprietary package manager.

How It Works

Assess before inclusion

Open-source packages from a
public repository are automatically
scanned for malware, tampering,
and hidden threats before they
are included, giving security
teams a full risk profile.

Identify risky updates
automatically

Version-to-version analysis
verifies that a new version
actually reduces risk instead of
introducing a new supply chain
risk.

Security becomes an
enabler, not a bottleneck

Policy-driven assessments
embedded directly in the
workflow let teams understand
risks to enable rapid decisions.

Why RapidFort

Named, independent validationRapidFort is the only vendor whose open-source library catalog is independently validated by a separate, namedthird-party security company using enterprise-grade deep-binary malware detection.

Hardening and risk assessment in one pipeline.The RapidFort hardening pipeline has helped enterprise customers eliminate up to 99.9% of CVEs from containerimages combined with continuous malware and tampering assessment across the same artifacts.

No migration, no lock-inWorks with standard pip, Maven, npm, and OS package interfaces that teams already use with no proprietarypackage manager, custom OS distribution, or vendor-specific toolchain required.

Availability

RapidFort Supply Chain Risk, with open-source library validation powered by ReversingLabs Spectra Assure, is generally available today for Python and Java ecosystems, with JavaScript in closed beta. OS package coverage spans Red Hat, Ubuntu, Debian, and Alpine, with additional language runtimes and application package catalogs on an accelerated roadmap. Existing RapidFort customers can enable Supply Chain Risk and library coverage through the platform console or by contacting their account team.

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software, enabling organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and independently malware-scanned open-source images. RapidFort is headquartered in Sunnyvale, California.