How a small security team eliminated nearly all image-level CVEs while keeping developers on the Linux distribution they already run.
RapidFort Images eliminated all but three of the roughly 300 vulnerabilities in a typical container image at a SaaS provider for state and local governments during a proof of concept. The company needed that result to meet GovRAMP vulnerability remediation requirements without growing its security team or moving its developers off Ubuntu. If you lead security or engineering at a company that sells to state and local government, the tradeoffs this team worked through will look familiar. This article covers why GovRAMP put container CVEs at the center of the company’s compliance work, why it chose RapidFort over a competitor that required an OS migration, and what it has deployed so far.
At a glance
| Customer | SaaS provider of revenue collection, billing, and payment software for state and local governments |
|---|---|
| Challenge | About 300 CVEs per container image, GovRAMP remediation requirements, and a small security team |
| Why RapidFort | Near-zero CVE images on Ubuntu, the distribution the company already runs, with no OS migration |
| Early result | About 300 CVEs per image down to three in the proof of concept (about 99%) |
What the company does
The company builds software as a service for state and local governments, including revenue collection, billing, and payment processing. County and state agencies use its platform to run those programs, and residents use its public portal to make payments. The company runs its SaaS offering as containers on Kubernetes, across thousands of servers in its own data centers. Its growth plan includes expanding into additional states, which makes government security compliance a requirement for winning new business.
Why GovRAMP put container CVEs on the critical path
Because the company’s customers are state and local governments, FedRAMP doesn’t apply. GovRAMP fills that gap for providers serving state and local agencies, and the company’s director of information security and compliance has seen it listed in a growing number of RFPs. The company is enrolled in the GovRAMP Progressing Snapshot program, which scores providers against critical NIST 800-53 requirements, and plans to pursue Core verification next year.
Vulnerability remediation was the requirement that made the problem urgent. The company already patched its servers automatically every two weeks and pulled the latest Ubuntu LTS packages each week. Container images needed a different fix: vulnerabilities from the base layer surfaced at build time, after application teams had finished their code, and a typical image carried about 300 of them.
“We really need to get to a point where we can tell the staff, you can’t let a high or critical vulnerability go to production. That’s a government mandate. That’s a mandate I have to show.”
— Director of information security and compliance, SaaS provider for state and local governments
Asking developers to work through 300 CVEs per image, most of them in packages they never chose, wasn’t a realistic plan. The security team is small, and absorbing that volume was going to be unattainable.. The volume keeps growing as well; the director estimates the new vulnerability disclosures the team tracks have gone from about 20 a month to around 600. To meet GovRAMP, the company had to shrink the vulnerability list before it reached a developer.
Why the company chose RapidFort over an OS migration
The company’s infrastructure lead first flagged hardened container images as worth a look, and the director researched vendors in the space from there. The company evaluated RapidFort and one competitor, and three factors decided the choice.
The company stays on Ubuntu. The competitor required the company to move its images to a different base distribution. The director heard that the migration would be easy, but the development teams were already rewriting a large legacy application and moving it to a public cloud. That application is a data-heavy monolith where small platform changes tend to cause outsized problems, so an OS change would have added risk to projects already in flight.
“Why are you throwing extra risk and change into this when I didn’t have to?”
— Director of information security and compliance, SaaS provider for state and local governments
The company saw the reduction on its own distribution. RapidFort showed the vulnerability count of a standard Ubuntu image next to the matching curated Ubuntu image, so the director could judge the result on the distribution the company already runs. For the criteria that matter when you compare vendors, see the guide on how to evaluate near-zero CVE images.
The company gets a path to distroless without building it in-house. The team had planned a future project to investigate distroless containers. RapidFort can build custom distroless versions of the company’s images for its specific applications, which takes that project off the internal roadmap.
What the company deployed
The company purchased a bundle of RapidFort Images, which covers its priority workloads within this year’s budget. Curated Images are running in a limited set of applications carried over from the proof of concept, and the director expects broader production use within the next few months.
For developers, adopting a RapidFort Image means changing the base image their Dockerfiles reference. Application code and the rest of the build stay the same.
# Before FROM ubuntu:22.04 # After FROM quay.io/rfcurated/rfubu:22.04-scratch-rfcurated
The company is keeping its automated patching process and will align its cadence with RapidFort’s image updates. A container release can spend several weeks in testing and non-production environments, so the team will pin a specific RapidFort Image version to each deployment. That way, the image that passes testing is the image that ships, and working out that pinning workflow is part of the kickoff project.
Early results: from about 300 container CVEs to three
The company is early in its rollout, so the results below come from the proof of concept and the decisions it made possible. Each one maps to a problem the company brought to the evaluation.
About 300 CVEs per image dropped to three. In the proof of concept, RapidFort Images eliminated about 99% of the vulnerabilities in a typical container image (297 of 300). The base-layer CVEs that used to surface at build time are now handled upstream, because RapidFort continuously patches the curated images.
A remediation list sized for the team the company has. With three CVEs per image, the remaining work fits a few hours of developer time and a small security team, without a dedicated remediation staff. The director doesn’t measure the value in hours saved, since the company never would have hired the team needed to triage 300 CVEs per image. The value is that GovRAMP compliance is now within reach of the people already on staff.
“What it is allowing us to do is to move into an environment where we can become GovRAMP compliant without having to devote a whole lot more resources to it.”
— Director of information security and compliance, SaaS provider for state and local governments
No OS migration in the middle of a rewrite. Because RapidFort Images support Ubuntu, developers kept their distribution and their tooling, and the security project added no work to the application rewrite or the cloud migration.
A clear number for leadership. The director brought the proof-of-concept result to the company’s CTO and framed the decision plainly: meet the GovRAMP requirement with more people or with tooling. The drop from about 300 CVEs per image to three was enough to win approval.
The measured results so far come from the proof of concept. Production numbers across the full image estate will follow as the rollout continues.
Meeting GovRAMP on the distribution you already run
The company needed to show that high and critical vulnerabilities don’t reach production, with a small security team and container images carrying about 300 CVEs each. It chose RapidFort because RapidFort Images eliminated nearly all of those CVEs on Ubuntu, while the competitor it evaluated required an OS migration in the middle of an application rewrite. The proof of concept brought each image down to three CVEs, which won leadership approval and put GovRAMP within reach of the team the company has today.
If your team faces a GovRAMP, FedRAMP, or similar remediation deadline, schedule a demo to see how RapidFort Images could work for your team.
Latest posts
Eliminate Attack Vectors at the Source
Continuously eliminate up to 99.9% of CVEs without code changes
Products
Use Case
Quicklinks
Stay in touch
Subscribe for product updates and RapidFort newsletter.
Address
440 North Wolfe Road, Sunnyvale, CA 94085
© 2026 RapidFort, Inc.
RapidFort, RAPIDFORT, and RBOM® are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.
