Answers to the questions security and platform engineering teams ask about container image security, software supply chain security, and the RapidFort end-to-end platform across Intake, Build, and Runtime.
RapidFort is an end-to-end software supply chain security platform for containerized applications that covers Intake, Build, and Runtime. It eliminates up to 99.9% of CVEs (Common Vulnerabilities and Exposures) and reduces the software attack surface by up to 90%, without code changes, operating system changes, or pipeline modifications.
It does this with RapidFort Curated Near-Zero CVE Images, which RapidFort engineers manually patch and rebuild; RapidFort Curated Libraries, a catalog of malware-scanned open source libraries; runtime-aware hardening; and continuous production monitoring. RapidFort was founded in 2020.
RapidFort covers the whole lifecycle: Intake, Build, and Runtime in one end-to-end platform, with no gaps, no handoffs, and no blind spots.
Intake: risk is eliminated before entry, with drop-in curated near-zero CVE images and malware-scanned open source libraries. Build: components are hardened and the attack surface is reduced, guided by RBOM® (Runtime Bill of Materials) showing what your application actually runs. Runtime: environments are continuously monitored and protected, with drift detection and audit-ready compliance evidence.
Instead of separate tools for scanning, SBOMs (software bills of materials), and runtime, one platform covers every stage.
RapidFort eliminates vulnerabilities that organizations inherit from software they run but do not control. More vulnerabilities are introduced than engineers can reasonably fix, and security teams are overwhelmed by alerts and false positives.
Attackers do not wait. Under CISA (Cybersecurity and Infrastructure Security Agency) Binding Operational Directive 26-04, vulnerabilities in the CISA Known Exploited Vulnerabilities (KEV) catalog carry federal fix deadlines of 3 or 14 days. RapidFort eliminates attack vectors at the source, before they reach production.
Traditional tools identify vulnerabilities; RapidFort removes them before they can become exploits. With RapidFort, CVEs are removed from your stack, not added to a backlog.
RapidFort Curated Near-Zero CVE Images are compatible with every major scanner, and one platform covers Intake, Build, and Runtime instead of fragmented tools in isolated stages.
RapidFort focuses on enterprise and public sector organizations with open source software exposure, AI-driven companies, platform engineering and DevOps teams, and security teams and CISOs responsible for the software supply chain. Developers keep the images, packages, and files they have standardized on, while security teams make sure the final product meets their security requirements.
Continuous Threat Elimination is the RapidFort model for security: proactive removal of risk across the entire software lifecycle, instead of reactive vulnerability fixing. It runs across the three stages of the RapidFort Platform: Intake, Build, and Runtime.
Intake is where risk is eliminated before software enters your environment.
RapidFort Curated Near-Zero CVE Images are drop-in replacement container images with near-zero CVEs from day one. The catalog has tens of thousands of production-grade images, from base OS images to popular open source applications, built on Ubuntu, Red Hat, Debian, and Alpine.
They are available as distroless and full images, with up to 99.9% CVE elimination across both. Replace your base images and eliminate inherited vulnerabilities before development even begins.
RapidFort Curated Near-Zero CVE Images are not just hardened: RapidFort engineers manually patch and rebuild them, and every image is continuously patched to eliminate all CVEs for which a patch is available. That is how the images reach near-zero CVEs.
The images have rich metadata built in and are compatible with every major scanner. They run on the distributions your teams already use (Ubuntu, Red Hat, Debian, and Alpine), with no OS lock-in.
A scanner shows a CVE in a RapidFort Curated Near-Zero CVE Image for one of these reasons: no applicable upstream patch exists yet, a patch was released recently and the CVE is still inside its target resolution window, the scanner does not recognize a backported fix, or the scanner's vulnerability data differs from that of other scanners. RapidFort patches every CVE for which an applicable patch is available; for CVEs without one, see the question on missing upstream patches below.
Scanners disagree with each other: a 2024 IEEE study of 927 Docker images found that Trivy and Grype reported different numbers of vulnerabilities and different vulnerability IDs for the same images. With a RapidFort Full Catalog subscription, SBOM export includes VEX (Vulnerability Exploitability eXchange) statements in CycloneDX, and joint Wiz and RapidFort customers see RapidFort advisory context alongside findings on RapidFort Curated Near-Zero CVE Images.
RapidFort sets a target resolution time of 1 calendar day for CISA KEV vulnerabilities, from the date an applicable patch is available. For other CVEs, measured from the date an applicable patch is publicly available, the targets are 7 calendar days for Critical and High, 21 calendar days for Moderate (the CVSS, or Common Vulnerability Scoring System, Medium band), and 28 calendar days for Low.
These targets apply to the RapidFort Curated Near-Zero CVE Images in your subscription, and RapidFort uses commercially reasonable efforts to meet them. An applicable patch is a complete upstream fix that can be applied without breaking the image's material functionality or introducing material regression issues. The targets are published in the RapidFort Support and Availability Policy, which is part of the RapidFort Master Subscription Agreement.
For RapidFort Curated Near-Zero CVE Images, RapidFort uses commercially reasonable efforts to provide a fix or a mitigation, according to the severity of the CVE, as set out in the RapidFort Support and Availability Policy.
RapidFort Curated Near-Zero CVE Images support all major long-term support (LTS) releases of Ubuntu, Debian, and Red Hat, plus Alpine, including minor releases and older versions.
End-of-life versions can be supported on request. For end-of-life versions, patching and updates apply only to the open source packages, and RapidFort makes commercially reasonable efforts to provide patches when backporting a fix is possible.
Yes. RapidFort Curated Near-Zero CVE Images come as full images and as distroless images, which contain only the application and its runtime dependencies, with no shell or package manager. To debug a distroless container in Kubernetes, kubectl debug attaches an ephemeral debug container to the running pod, so you can inspect it without adding a shell to the image.
RapidFort Curated Near-Zero CVE Images are drop-in, pin-for-pin compatible replacements: the same distributions and tags, identical environment variables and paths, and ABI (application binary interface) compatibility with existing software and development pipelines. Switching between distributions, for example from Alpine to Debian, needs testing, as with any base image change.
RapidFort runs test scripts on the images in your subscription after each build and runs upstream tests during the build where upstream provides them. A dedicated RapidFort DevOps Test Engineering team deploys and tests the images in their appropriate environments before customer deployments, and is available to troubleshoot any differences in configuration and environment.
Select the RapidFort Curated Near-Zero CVE Image for your distribution, swap the image tag in your build, and build and deploy with your existing pipelines. From then on, you receive continuous hardened updates. RapidFort Analyzer also recommends RapidFort Curated Near-Zero CVE Images as drop-in replacements.
Platform teams can publish the images to an internal registry as the only approved base images for development teams, and enforce this at deployment with Kubernetes policy engines such as Kyverno or Gatekeeper.
Yes. RapidFort Curated Near-Zero CVE Images have rich metadata built in and are compatible with every major scanner. RapidFort Analyzer exports SBOMs in SPDX, CycloneDX, JSON, and CSV.
No. RapidFort is built on trusted open source ecosystems without proprietary lock-in: RapidFort Curated Near-Zero CVE Images run on standard Ubuntu, Debian, Red Hat, and Alpine with no OS lock-in, are compatible with every major scanner, and are registry flexible, so you use the RapidFort registry or your own.
RapidFort Curated Libraries are a catalog of malware-scanned and curated open source libraries, delivered through the package and artifact workflows developers already use, with unchanged versions, interfaces, features, and command line syntax. They cover the npm, PyPI, Maven, RubyGems, and NuGet ecosystems, every package is pin-for-pin compatible, and security teams set policy on approved packages, versions, and images.
RapidFort Curated Libraries help mitigate supply chain malware in compromised packages and dependencies before untrusted packages enter the build, artifacts, or production, including malicious binaries, backdoored dependencies, install-time payloads, typosquatted packages, credential-stealing code, downloaders, cryptominers, rootkits, and ransomware.
For RapidFort Curated Near-Zero CVE Images, RapidFort Supply Chain Risk Analysis scans the open source libraries, files, and packages in the images for malware, tampering, and hidden threats, shows the results in a dedicated Supply Chain Risk view, and compares new package versions against prior releases to catch newly introduced malware or risky behavior changes. The assessment is independently powered by ReversingLabs Spectra Assure.
For RapidFort Curated Libraries, independent validation of open source libraries is generally available for the Python and Java ecosystems, with JavaScript in closed beta, and packages that fail security policy are blocked from the RapidFort catalog until the risks are resolved.
Build is where components are hardened and the attack surface is reduced, guided by RBOM®.
RapidFort eliminates CVEs in three steps: analyze and profile CVEs, replace base images with near-zero CVE images, and optimize and harden. RapidFort Analyzer creates an SBOM and validates which CVEs apply, RapidFort Profiler generates an RBOM® showing what actually runs, and RapidFort Optimizer removes unused components to reduce CVEs and attack surface. Together, this eliminates up to 99.9% of CVEs without code changes.
RapidFort Analyzer finds and validates CVEs, RapidFort Profiler shows what actually runs, and RapidFort Optimizer removes what is never used.
RapidFort Analyzer creates an SBOM that enumerates all files, packages, and configurations within container images, not just those reported by package managers. It confirms whether a vulnerability truly applies to the image, identifies when vulnerabilities originate from base images, and recommends RapidFort Curated Near-Zero CVE Images as drop-in replacements, with validated vulnerability intelligence across images, registries, continuous integration (CI) pipelines, and clusters.
RapidFort Profiler generates an RBOM®, a continuously updated record of the components actually executed at runtime, and distinguishes active code paths from dormant layers to reduce vulnerability triage noise, with no application changes required.
RapidFort Optimizer uses RBOM® runtime intelligence to identify components that never execute and safely remove them while preserving application functionality. The optimized versions of your own images are rebuilt every 24 hours and delivered as drop-in replacements without CI/CD (continuous integration and delivery) changes.
RapidFort reduces the attack surface by up to 90% by removing components your application never uses, guided by the RBOM® evidence of what actually runs. Hardening occurs at the container image layer without modifying code.
RapidFort reduces scanner noise by separating CVEs in code that runs from CVEs in packages that are installed but never execute. RapidFort Analyzer confirms whether a vulnerability truly applies to the image, and RapidFort Profiler distinguishes active code paths from dormant layers.
No. Adopting RapidFort Curated Near-Zero CVE Images means swapping the image tag in your build: no code changes, no OS changes, and no pipeline modifications. Hardening your own images with RapidFort Optimizer works entirely outside your application code, and the optimized images are delivered as drop-in replacements without CI/CD changes.
An SBOM (Software Bill of Materials) is a formal record of the components in a piece of software and their supply chain relationships: a nested inventory, or list of ingredients, of the packages, libraries, and versions it contains. It shows what is installed, lets teams find affected software when a new CVE is disclosed, and supports compliance: the EU Cyber Resilience Act requires an SBOM covering at least top-level dependencies, and CISA's 2026 Minimum Elements for an SBOM (July 2026) replaced the 2021 NTIA minimum elements. RapidFort Analyzer generates SBOMs that enumerate all files, packages, and configurations within container images and exports them in SPDX, CycloneDX, JSON, and CSV.
An RBOM® (Runtime Bill of Materials) shows what software actually runs, while an SBOM shows what is installed. RBOM® is proprietary RapidFort technology and a registered trademark of RapidFort, Inc.
RapidFort Profiler generates an RBOM® so teams focus on real attack surface instead of theoretical CVEs, RapidFort Optimizer uses RBOM® runtime intelligence to remove components that never execute, and RapidFort Runtime generates a dynamic RBOM® for live production environments.
Yes. With a RapidFort Full Catalog subscription, SBOM export includes CycloneDX with VEX support. VEX (Vulnerability Exploitability eXchange) is a machine-readable statement of whether a product is affected by a specific vulnerability, with the statuses not affected, affected, fixed, or under investigation.
Runtime is where environments are continuously monitored and protected, with drift detection and audit-ready compliance evidence.
RapidFort Runtime extends software supply chain security beyond build, deployment, and static monitoring into live production environments. It establishes a runtime baseline of approved packages, libraries, binaries, processes, and behaviors; generates a dynamic RBOM®; continuously correlates new vulnerability disclosures with live production software; detects runtime tampering; and provides actionable mitigation recommendations.
Lightweight agents use BPF and ptrace technology to capture evidence of what software is truly running, with no code changes or proprietary platform migration required. RapidFort Runtime identifies modifications to packages, libraries, processes, and behaviors that could indicate tampering, drift, or compromise.
No. Hardening reduces what can be attacked; RapidFort Runtime keeps protecting software after it ships. It correlates newly disclosed vulnerabilities with deployed software and detects unexpected changes, so one platform covers Intake, Build, and Runtime without gaps.
The CISA Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities with reliable evidence of active exploitation in the wild. CISA adds a vulnerability when it has a CVE ID, reliable evidence of exploitation, and a clear remediation action such as a vendor update. As of October 8, 2026, the catalog held 1,739 entries, 361 of them known to have been used in ransomware campaigns.
Container images bundle many open source packages, so one base image carries its KEV-listed vulnerabilities into every workload built on it. RapidFort sets a target resolution time of 1 calendar day for KEV-listed vulnerabilities in the RapidFort Curated Near-Zero CVE Images in your subscription, from the date an applicable patch is available.
CISA Binding Operational Directive 26-04, issued June 10, 2026, replaced BOD 22-01 and sets risk-based deadlines for federal civilian agencies; KEV-listed vulnerabilities carry due dates of 3 or 14 days under the directive. For the RapidFort Curated Near-Zero CVE Images in your subscription, the KEV target resolution time is 1 calendar day from the date an applicable patch is available.
RapidFort Continuous Compliance is a BOD 26-04 aligned capability within the RapidFort Platform that identifies Known Exploited Vulnerabilities, applies CISA-aligned remediation tiers, and tracks whether every in-scope CVE is inside or outside the required window. It refreshes CISA KEV and Vulnrichment (CISA's CVE enrichment data) on a 15-minute cycle and applies the BOD 26-04 scoring model to running container instances through runtime instrumentation. RapidFort is launching it for eligible critical infrastructure and federal-adjacent organizations, which can register interest in the RapidFort Continuous Compliance Program.
Prioritize what is being exploited, but do not stop there: ranking alone leaves the backlog in place, and more vulnerabilities are introduced than engineers can reasonably fix. RapidFort eliminates risk instead of only ranking it. Near-zero CVE base images and removal of unused components shrink the list, RapidFort Profiler identifies CVEs tied to executed binaries and services so teams focus on vulnerabilities that represent real exposure, and, for eligible organizations, RapidFort Continuous Compliance flags KEV-listed vulnerabilities.
RapidFort CART (Compliance and Remediation Tool) evaluates container environments against approved security benchmarks and compiles the results into audit-ready evidence for Authority to Operate (ATO), NIST, FedRAMP, CMMC, and more. It uses the OpenSCAP framework, detects configuration drift and policy violations, and generates reports in JSON, CSV, HTML, and XML with remediation guidance and generated scripts. It is validated against DISA STIGs, NIST control frameworks, CIS Benchmarks, Red Hat security guides, and custom organizational baselines.
RapidFort supports customers with these compliance programs, standards, and regulations: FedRAMP, continuous ATO (cATO), CMMC (Cybersecurity Maturity Model Certification), NIST SP 800-53, DISA STIG (Security Technical Implementation Guides), CIS Benchmarks, FIPS (Federal Information Processing Standards) 140-2 and 140-3, HIPAA, PCI DSS, SOC 2, NIS2, and the EU Cyber Resilience Act.
Yes, when a benchmark is available. RapidFort Curated Near-Zero CVE Images are hardened against their appropriate DISA STIG or CIS Benchmark, when available, aligned to NIST SP 800-70.
Yes. RapidFort provides FIPS and standard variants of RapidFort Curated Near-Zero CVE Images, unless an image does not need a FIPS variant or upstream license restrictions prevent one.
RapidFort supports FedRAMP container requirements: RapidFort Curated Near-Zero CVE Images are hardened against their appropriate STIG or CIS Benchmark, when available, aligned to NIST SP 800-70, the checklist program that FedRAMP container requirements reference. FedRAMP's 2021 container requirements allow only containers from images scanned within a 30-day window to be deployed in production, and RapidFort Analyzer scans container images across CI/CD pipelines, registries, and Kubernetes environments.
FedRAMP rules are changing: new vulnerability detection and response rules become mandatory on December 7, 2026, and the Consolidated Rules for 2026 on January 1, 2027.
RapidFort maps its capabilities to four core CRA requirements: secure by design and by default (RapidFort Curated Near-Zero CVE Images, hardened and continuously patched); SBOM documentation for all components (RapidFort Analyzer SBOM generation); limited attack surfaces (RapidFort Optimizer removes unused code); and ongoing vulnerability management (audit-ready reports, continuous baseline validation, and an evidence trail).
Since September 11, 2026, a manufacturer that becomes aware of an actively exploited vulnerability must send an early warning within 24 hours, a vulnerability notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available. Severe incidents follow the same 24-hour and 72-hour steps, with a final report within one month of the incident notification. The main CRA obligations apply from December 11, 2027.
RapidFort secures Kubernetes workloads at every stage: RapidFort Curated Near-Zero CVE Images give workloads a near-zero CVE starting point, RapidFort Analyzer scans images across CI/CD pipelines, registries, and Kubernetes environments, and RapidFort Runtime monitors live production. At deployment, Kubernetes admission policies enforce that only approved images run (see the question on switching base images).
Yes. RapidFort integrates with cloud platforms (AWS, Google Cloud, and Microsoft Azure), CI/CD tools (GitHub, GitLab, Jenkins, Harness, and CircleCI), ticketing and logging tools (Jira, Splunk, and Sumo Logic), and security tools (CrowdStrike Falcon Cloud Security and Wiz).
RapidFort is part of the Wiz Integration Network: joint Wiz and RapidFort customers see RapidFort advisory context and advisory-backed status alongside findings on RapidFort Curated Near-Zero CVE Images, without leaving Wiz. With CrowdStrike Falcon Cloud Security, RapidFort ingests vulnerability and SBOM data from Falcon to drive container image hardening.
RapidFort is available as a multi-tenant SaaS subscription or as an on-premises deployment in your private cloud. The RapidFort client is a set of command line interface (CLI) tools and a browser-based user interface, and teams can incorporate continuous hardening into their CI/CD pipelines with the RapidFort CLI tools.
Software supply chain security is protecting every component and process involved in building and delivering software, from the open source you consume and the systems you build with to what runs in production. Attacks arrive through trusted channels; in September 2025, CISA warned of a self-replicating compromise of more than 500 npm packages. RapidFort eliminates software supply chain risk at the source rather than managing it afterwards, across Intake, Build, and Runtime.
AI-driven development is increasing code volume, which expands the attack surface, while attackers use AI to move faster. RapidFort is built on the premise that attack vectors must be eliminated before they reach production, which is what near-zero CVE images and removal of unused components do.
RapidFort provides 24x7x365 telephone and email support for issues caused by the RapidFort Curated Near-Zero CVE Images in your subscription, white glove support with dedicated customer success and hands-on implementation help, and a dedicated DevOps Test Engineering team that tests images in their appropriate environments before customer deployments and troubleshoots configuration and environment differences with you.
Start at Intake with RapidFort Curated Near-Zero CVE Images: near-zero CVEs from day one, with no code changes. Swap the image tag in your build and deploy with your existing pipelines (the steps are in the question on switching base images, above).
Then extend the same platform to Build (analyze, profile, optimize your own images) and to Runtime (protect, govern, prove), where RapidFort CART compiles security benchmarks into audit-ready compliance evidence. Request access or schedule a demo at rapidfort.com.
RapidFort Curated Near-Zero CVE Images are FIPS 140-3 compliant. RapidFort FIPS images include FIPS-validated cryptographic providers, who have their own CMVP certificates. RapidFort also tests the images to verify correct behavior under FIPS constraints.
Yes, RapidFort signs all curated images with a digital signature to ensure authenticity and integrity. You can verify that an image has not been tampered with using the RapidFort public key.
No, removing unused components does not affect SBOM accuracy. When RapidFort hardens an image, it also generates a new/updated SBOM, which reflects the software components that are part of the hardened image.
Yes. The Limited Free Access tier provides 5 RapidFort Curated Near-Zero CVE Images from a limited selection of the catalog at no cost. Check out how to request these from our pricing page.
Continuously eliminate up to 99.9% of CVEs without code changes
