An admission controller is code that intercepts requests to the Kubernetes API server after they are authenticated and authorized, and before the resource is saved. Policy engines such as Kyverno run as admission controllers, and Open Policy Agent (OPA) Gatekeeper enforces policies through admission webhooks. Typical rules allow images only from approved registries or only signed images, so the admission controller is the last gate before a workload runs.
Attack surface reduction is the practice of removing unneeded software from applications and container images so there are fewer places an attacker can exploit. Approaches include starting from hardened base images and removing packages and binaries the application does not use. Doing this safely requires evidence of what actually runs, not just what is installed, so that nothing the application needs is removed.
An attack vector is the path or method an attacker uses to reach a target, such as a vulnerable package, a malicious dependency, or a tampered container image. Attack surface describes where a system can be attacked; an attack vector describes how. In CVSS (the Common Vulnerability Scoring System), Attack Vector is also the name of a base metric that records how remote an attacker can be to exploit a vulnerability (Network, Adjacent, Local, or Physical). RapidFort eliminates attack vectors at the source, before they reach production.
Backporting, in security patching, is taking a fix for a security flaw out of the most recent version of an upstream software package and applying it to an older version that is still in use (Red Hat's definition). It lets a distribution fix a CVE (Common Vulnerabilities and Exposures entry) without forcing an upgrade, but the fix must be integrated, tested, and released for each older version. Scanners that match on version numbers alone can report a backported CVE as unfixed. For end-of-life versions of RapidFort Curated Near-Zero CVE Images, RapidFort makes commercially reasonable efforts to provide patches when backporting a fix is possible.
CIS Benchmarks are prescriptive, consensus-based configuration recommendations from the Center for Internet Security for securing operating systems, containers, cloud services, and other technologies. Organizations use them as a hardening baseline and as audit evidence. RapidFort Curated Near-Zero CVE Images are hardened against their appropriate STIG or CIS Benchmark, when one is available, and RapidFort CART is validated against CIS Benchmarks.
The CISA KEV catalog is the US Cybersecurity and Infrastructure Security Agency's list of vulnerabilities with reliable evidence of active exploitation in the wild. CISA adds a vulnerability when it has a CVE ID, there is reliable evidence of active exploitation, and there is a clear remediation action such as a vendor update. As of October 8, 2026, the catalog held 1,739 entries, 361 of them known to have been used in ransomware campaigns. Federal civilian agencies must fix KEV entries by set due dates under BOD 26-04, and CISA strongly recommends that all organizations monitor the catalog and prioritize remediation of the listed vulnerabilities. RapidFort sets a target resolution time of 1 calendar day for KEV-listed vulnerabilities in the RapidFort Curated Near-Zero CVE Images in a subscription, from the date an applicable patch is available.
A container is an isolated process, or set of processes, created from a container image and sharing the host operating system kernel, which makes it lighter than a virtual machine. NIST describes container technology as operating system virtualization combined with application packaging. Because images are reused widely, any vulnerability in an image travels with every container created from it.
A container image is a standardized, read-only package that includes all of the files, binaries, libraries, and configuration needed to run a container. Images are built in layers, usually starting from a base image, stored in registries, and pulled to create containers. Because images bundle many third-party components, they carry inherited vulnerabilities into every environment where they run.
A container registry is a centralized service for storing and sharing container images, either public or private. Organizations often run internal registries that hold only approved images and enforce registry rules at build time and at admission. RapidFort Curated Near-Zero CVE Images are registry flexible: use the RapidFort registry or your own.
Continuous compliance is maintaining and proving compliance on an ongoing basis instead of through point-in-time audits. NIST describes the underlying practice, continuous monitoring, as maintaining ongoing awareness of information security, vulnerabilities, and threats to support risk decisions. A point-in-time audit captures one day; the record goes out of date as software changes. RapidFort CART continuously evaluates container environments against approved security benchmarks, detects drift, and generates remediation guidance with audit-ready evidence. In addition, RapidFort Continuous Compliance is a BOD 26-04–aligned capability in the RapidFort Platform that gives every container CVE its own live remediation clock to help prioritize your work.
A CVE (Common Vulnerabilities and Exposures entry) is a unique public identifier, in the form CVE-YYYY-NNNN with four or more digits in the sequence number, for a publicly disclosed cybersecurity vulnerability. The CVE Program, sponsored by CISA, identifies, defines, and catalogs disclosed vulnerabilities, with one CVE Record for each. A CVE Record describes the flaw and the affected software; severity is scored separately with CVSS, exploitation likelihood with EPSS (the Exploit Prediction Scoring System), and evidence of active exploitation comes from the CISA KEV catalog. RapidFort eliminates up to 99.9% of CVEs without code changes.
CVSS is an open standard, maintained by FIRST (the Forum of Incident Response and Security Teams), that captures the principal characteristics of a vulnerability and produces a numerical severity score from 0.0 to 10.0. The score maps to qualitative ratings: Low (0.1 to 3.9), Medium (4.0 to 6.9), High (7.0 to 8.9), and Critical (9.0 to 10.0). The CVSS Base Score rates how severe a vulnerability could be, not how likely it is to be exploited; CVSS v4.0, the current version, adds optional Threat metrics for exploit maturity, and teams also pair CVSS with EPSS and the CISA KEV catalog. RapidFort uses CVSS scores from reputable security advisories when available, and sets target resolution times for the RapidFort Curated Near-Zero CVE Images in a subscription by severity tier.
Debloating is removing unused files, packages, and binaries from a container image to reduce its size and attack surface. Tools decide what to remove using static analysis, runtime observation, or both. Done with runtime evidence and consistent metadata, it shrinks the attack surface without changing application behavior. RapidFort Optimizer uses RBOM® runtime intelligence to identify components that never execute and safely remove them while preserving application functionality.
A dependency cooldown is a policy of waiting a set period of time after a package version is published before allowing it into builds. Malicious package versions are usually removed within hours or days of publication (in 2025, PyPI handled 92% of malware reports within 24 hours of the report), so a cooldown gives registries and security tools time to catch them first. One analysis of 2025 attacks found that a 7-day cooldown would have blocked most of them. Package managers and update tools now support it: npm (min-release-age), pnpm (minimumReleaseAge), uv (exclude-newer), Renovate (minimumReleaseAge), and Dependabot (cooldown, with a 3-day default that does not apply to security updates).
A DISA STIG (Security Technical Implementation Guide) is a configuration standard from the US Defense Information Systems Agency, based on Department of Defense policy and security controls, for a specific product and version. Systems used in Department of Defense environments are expected to meet the STIGs that apply to them. RapidFort Curated Near-Zero CVE Images are hardened against their appropriate STIG or CIS Benchmark, when one is available, and RapidFort CART can evaluate workloads against DISA STIGs.
A distroless image contains only the application and its runtime dependencies, with no package manager, shell, or other programs found in a standard Linux distribution. Removing those tools reduces image size and attack surface; the tradeoff is harder debugging. Alternatives include Alpine-based images (built on musl instead of glibc), slim variants of standard distributions, and scratch images that hold only the application binary. In Kubernetes, for debugging a distroless image, “kubectl debug” attaches an ephemeral debug container alongside the target pod without adding a shell to the image. RapidFort Curated Near-Zero CVE Images are available as both distroless and full images, with up to 99.9% CVE elimination across both.
eBPF is a Linux kernel technology that runs small, sandboxed programs in a privileged context such as the operating system kernel, without changing kernel code. The name began as 'extended Berkeley Packet Filter' but is now a standalone term, because eBPF does far more than packet filtering. Security and observability tools use it to see what processes are doing in real time. RapidFort Runtime uses lightweight agents built on BPF and ptrace technology to capture evidence of what software is truly running.
End-of-life software is software whose maintainer no longer provides security updates. When a distribution or application version reaches end of life, new vulnerabilities in it are not patched upstream, so teams that cannot upgrade either accept growing risk, pay for extended support, or move to a source that keeps patching. Container images are especially exposed because old base images stay in registries and keep being reused. End-of-life versions of RapidFort Curated Near-Zero CVE Images can be supported on request: patching and updates apply only to the open source packages, and RapidFort makes commercially reasonable efforts to provide patches when backporting a fix is possible.
EPSS (Exploit Prediction Scoring System) is a data-driven machine-learning model, maintained by FIRST (the Forum of Incident Response and Security Teams), that estimates the probability that a published CVE will be exploited in the wild in the next 30 days. It publishes a score between 0 and 1 for every CVE every day. EPSS complements CVSS, which rates severity, and the CISA KEV catalog, which lists vulnerabilities with evidence of active exploitation.
The exploit window, or time to exploit, is the time between public disclosure of a vulnerability and its active exploitation by attackers. It is shrinking: in the first half of 2026, 23.43% of the 495 vulnerabilities VulnCheck added to its own known exploited vulnerabilities catalog showed evidence of exploitation on or before the day the CVE was published (VulnCheck, State of Exploitation 1H 2026). Remediation cycles measured in weeks leave systems exposed for most of that window, which is why organizations look for ways to remove vulnerable components before they are exploited.
A false positive is an alert that incorrectly indicates that a vulnerability is present (NIST SP 800-115). In container scanning, a common cause is a scanner matching on a package version without recognizing that the distribution backported the fix, so a patched package is reported as vulnerable. False positives are different from vulnerability noise: a CVE in a package that is installed but never runs is a real finding with low exploitability, not a false positive (see Vulnerability Noise).
FedRAMP (Federal Risk and Authorization Management Program) is the US government program, established in 2011, for a risk-based approach to the adoption and use of cloud services by federal agencies. Cloud service providers must document security controls and supporting evidence, and the container images they run are part of that assessment. FedRAMP's 2021 container scanning requirements call for images hardened in accordance with benchmarks in the NIST National Checklist Program (SP 800-70), and allow only containers from images scanned within a 30-day window to be deployed in production. New vulnerability detection and response rules become mandatory on December 7, 2026, and the Consolidated Rules for 2026 on January 1, 2027. RapidFort supports FedRAMP container requirements: RapidFort Curated Near-Zero CVE Images are hardened against their appropriate STIG or CIS Benchmark, when available, and aligned to NIST SP 800-70.
FIPS (Federal Information Processing Standards) 140-3 is the US government standard that sets security requirements for cryptographic modules; FIPS 140-2 is its predecessor. NIST's Cryptographic Module Validation Program (CMVP) validates modules against the standard and issues a certificate number for each, and federal and other regulated systems require cryptography from validated modules. After September 21, 2026, NIST moved all FIPS 140-2 certificates to its Historical list: agencies may keep using those modules in existing systems but should not include them in new systems. In containers, FIPS means the image's cryptographic modules are CMVP-validated modules operated in FIPS mode on a platform covered by their certificate. FIPS and standard variants of RapidFort Curated Near-Zero CVE Images are available, unless an image does not need a FIPS variant or upstream license restrictions prevent one.
glibc and musl are two implementations of the C standard library that Linux software depends on; most distributions use glibc, while Alpine Linux is built around musl. Software compiled against one may behave differently, or fail, on the other, with known differences in DNS resolution, locale handling, and performance. This is why switching a base image between Alpine and a glibc-based distribution can break an application even when its code has not changed. RapidFort Curated Near-Zero CVE Images are built on Ubuntu, Debian, and Red Hat (glibc) as well as Alpine (musl).
A golden image is an intentionally configured, preapproved snapshot of a system used to deploy new instances (Red Hat's definition). In virtual machine and virtual desktop environments it is the master template for new machines. In container environments, golden images are the approved base images that platform teams publish to an internal registry for every development team to build on. Platform teams can publish RapidFort Curated Near-Zero CVE Images to an internal registry as the only approved base images for development teams.
A hardened container image is a container image secured by removing unneeded components and applying security configuration standards such as CIS Benchmarks or DISA STIGs. Hardening shrinks the attack surface (see Container Hardening). RapidFort Curated Near-Zero CVE Images are not just hardened: RapidFort engineers manually patch and rebuild them, and every image is continuously patched to eliminate all CVEs for which a patch is available.
Image signing is attaching a cryptographic signature to a container image so users can verify who produced it and that it has not been changed. Sigstore lets developers sign artifacts and record signatures in a tamper-resistant public log, and its Cosign tool signs Open Container Initiative (OCI) containers. At deployment, admission controllers can verify signatures and block unsigned or tampered images. Signing proves origin and integrity; it does not show whether an image is free of vulnerabilities.
Iron Bank is the US Department of Defense (DoD) secure container image repository within Platform One, providing hardened software containers for DoD use. Iron Bank publishes an assessment of each container, which teams use to obtain their own authorization.
Kubernetes security is protecting Kubernetes clusters and the workloads on them, from the images deployed to runtime behavior. It includes controlling which images can run, verifying signatures and attestations at admission, and enforcing security contexts, resource limits, and network controls across workloads. Much of the risk enters through container images and their open source components, so image supply chain control is a core part of it. RapidFort Analyzer scans container images across CI/CD (continuous integration and delivery) pipelines, registries, and Kubernetes environments, and RapidFort Runtime monitors live production environments.
An LTS (long-term support) distribution is a software release, such as an operating system, that receives security updates over an extended period: Ubuntu LTS releases get 5 years of standard security maintenance, Debian LTS extends each stable release to at least 5 years, and Red Hat Enterprise Linux has a 10-year life cycle. Alpine Linux does not use the LTS label; each release is supported for about 2 years. Enterprises standardize on LTS releases for stability, so switching distributions for security reasons can mean retesting and pipeline changes. RapidFort Curated Near-Zero CVE Images support all major LTS releases of Ubuntu, Debian, and Red Hat, plus Alpine, including minor releases and older versions.
A malicious package is an open source package that, when installed or used, causes harm such as stealing credentials, opening a backdoor, or running a cryptominer (OpenSSF's definition centers on loss of confidentiality, integrity, or availability). Attackers compromise maintainer accounts, publish malicious updates, or typosquat popular names, and some payloads run at install time. In September 2025, CISA warned of a self-replicating compromise affecting more than 500 npm packages. RapidFort Curated Libraries help mitigate supply chain malware in compromised packages and dependencies, including malicious binaries, backdoored dependencies, install-time payloads, typosquatted packages, credential-stealing code, downloaders, cryptominers, rootkits, and ransomware.
Malware scanning for software artifacts is inspecting images, libraries, files, and packages for malicious code or tampering before they are used. Vulnerability scanners look for known flaws; malware scanning looks for code placed deliberately to cause harm, including by comparing a new version against earlier releases to catch malicious changes. RapidFort Supply Chain Risk Analysis scans the open source libraries, files, and packages in RapidFort Curated Near-Zero CVE Images for malware, tampering, and hidden threats, independently powered by ReversingLabs Spectra Assure, and compares new package versions against prior releases.
A near-zero CVE image is a container image delivered with virtually no known vulnerabilities and kept that way by fixing new CVEs on published timelines. A container image inherits every vulnerability in its base image and open source components; a near-zero CVE image removes those inherited vulnerabilities so teams start from a clean baseline. 'Near-zero' reflects that new CVEs are disclosed continuously and that a count of exactly zero depends on which scanner and vulnerability database is used, and on the day of the scan. RapidFort Curated Near-Zero CVE Images are near-zero CVE images, manually patched and rebuilt by RapidFort engineers, with target resolution times for the images in a subscription published in the RapidFort Support and Availability Policy.
NIS2 is Directive (EU) 2022/2555, which establishes a unified legal framework for cybersecurity in 18 critical sectors across the EU. Member States had until October 17, 2024 to transpose it into national law. Covered organizations must manage cybersecurity risk, including supply chain risk, and report significant incidents.
NIST SP 800-190, the Application Container Security Guide (2017), explains the security risks of container technology and recommends countermeasures. It covers risks involving images, registries, orchestrators, containers, and hosts, and recommends container-aware runtime defense tools that can prevent, detect, and respond to threats during runtime. It is a common reference for container security programs.
NIST SP 800-53 is a catalog of security and privacy controls for information systems and organizations, published by the US National Institute of Standards and Technology. Organizations map their systems to these controls and provide evidence that each control is in place; the catalog underpins FedRAMP and other US federal programs. RapidFort CART can evaluate workloads against NIST control frameworks.
The NVD is the US government repository of standards-based vulnerability management data, run by NIST, which enriches published CVE records with severity scores, affected-product data, and references. Many scanners rely on NVD data. On April 15, 2026, NIST began prioritizing enrichment for CVEs in the CISA KEV catalog, CVEs for software used within the federal government, and CVEs for critical software as defined by Executive Order 14028, after CVE submissions rose 263% between 2020 and 2025. Teams increasingly combine NVD with vendor advisories, distribution security trackers, and CISA Vulnrichment.
Open source security is managing the risks of using open source software: known vulnerabilities, malicious code, and tampering. Nearly every modern application depends on it; 98% of codebases audited in Black Duck's 2026 Open Source Security and Risk Analysis contained open source components. Good open source security means knowing what you use, where it came from, and whether it is safe, both before and after it enters your software. RapidFort Curated Near-Zero CVE Images eliminate inherited vulnerabilities before development even begins, and RapidFort Curated Libraries deliver malware-scanned open source libraries with the same versions, interfaces, features, and CLI syntax already in use.
Pin-for-pin compatibility, in software, is the property of a replacement package or image that keeps the same versions, interfaces, features, and command line interface (CLI) syntax as the original, so it can be swapped in without changing code or workflows. The term comes from electronics, where a pin-for-pin replacement chip has the same function and pinout as the part it replaces. Replacing software for security reasons often means new package managers, different distributions, or code changes; a pin-for-pin compatible replacement changes where developers pull from, not how they build. RapidFort Curated Near-Zero CVE Images are pin-for-pin compatible with no re-baselining, and every package in RapidFort Curated Libraries is pin-for-pin compatible.
Policy as code is defining security and compliance rules in machine-readable files so tools can evaluate and enforce them consistently. Open Policy Agent, for example, is a general-purpose policy engine that lets teams specify policy as code and decouples policy decisions from enforcement; Kyverno manages policies as declarative Kubernetes resources. Examples include a rule that allows only approved registries in a Dockerfile or a Kubernetes policy that blocks images from untrusted registries.
Provenance is a verifiable record of where a software artifact came from and how it was built; SLSA defines it as an attestation describing how the outputs were produced, including the build platform and its parameters. Provenance is usually generated and signed during the build and checked before deployment. Unclear provenance, such as images pulled from public registries without verification, is a common weakness in container supply chains.
RapidFort Analyzer is the RapidFort Platform component that generates an SBOM and identifies the origin, packages, CVEs, size, license requirements, and other elements of each image. It enumerates all files, packages, and configurations within container images, not just those reported by package managers; confirms whether a vulnerability truly applies to the image; identifies when vulnerabilities originate from base images and recommends RapidFort Curated Near-Zero CVE Images as drop-in replacements; and exports SBOMs in SPDX, CycloneDX, JSON, and CSV. It delivers validated vulnerability intelligence across images, registries, continuous integration (CI) pipelines, and clusters.
RapidFort CART (Compliance Assessment and Remediation Tool) is the RapidFort Platform component that compiles security benchmarks into audit-ready evidence for ATO, NIST, FedRAMP, CMMC, and more. It uses the OpenSCAP framework, continuously evaluates container environments against approved security benchmarks, detects configuration drift and policy violations, and generates reports in JSON, CSV, HTML, and XML with remediation guidance and generated scripts. It can evaluate workloads against DISA STIGs, NIST control frameworks, CIS Benchmarks, Red Hat security guides, and custom organizational baselines.
RapidFort Curated Libraries are a catalog of malware-scanned and curated open source libraries, delivered through the package and artifact workflows developers already use, with the same versions, interfaces, features, and CLI syntax already in use. They sit early in the software delivery process, before untrusted packages enter the build, artifacts, or production, and cover the npm, PyPI, Maven, RubyGems, and NuGet ecosystems. Every package is pin-for-pin compatible, and security teams set policy on approved packages, versions, and images.
RapidFort Curated Near-Zero CVE Images are drop-in replacement container images with near-zero CVEs from day one. The catalog has tens of thousands of production-grade images, from base OS images to popular open source applications, built on Ubuntu, Debian, Red Hat, and Alpine, and available as distroless and full images with up to 99.9% CVE elimination across both. RapidFort engineers manually patch and rebuild them, and every image is continuously patched to eliminate all CVEs for which a patch is available. The images are pin-for-pin compatible with no re-baselining, registry flexible, and compatible with every major scanner, and target resolution times for new CVEs in the images in a subscription are published in the RapidFort Support and Availability Policy.
RapidFort Optimizer is the RapidFort Platform component that removes excess unused code to minimize attack surface, further reduce CVEs, and optimize runtime execution. It uses RBOM® runtime intelligence to identify components that never execute and safely remove them while preserving application functionality, with Light, Standard, or Aggressive hardening levels. Optimized images are rebuilt every 24 hours and delivered as drop-in replacements without CI/CD (continuous integration and delivery) changes, hardening occurs at the container image layer without modifying code, and the result is up to 90% attack surface reduction.
RapidFort Profiler is the RapidFort Platform component that provides runtime visibility into container behavior, revealing which components actually execute so teams can focus on real attack surface instead of theoretical CVEs. It generates an RBOM®, a continuously updated record of components actually executed during runtime; distinguishes active code paths from dormant layers to reduce vulnerability triage noise; establishes expected runtime behavior and flags unexpected binaries, configurations, or execution patterns; and runs as continuous runtime profiling with no application changes required.
RapidFort Runtime is the RapidFort Platform component that extends software supply chain security beyond build, deployment, and static monitoring into live production environments. It establishes a runtime baseline of approved packages, libraries, binaries, processes, and behaviors; uses lightweight agents built on BPF and ptrace technology to capture evidence of what software is truly running; generates a dynamic RBOM®; continuously correlates new vulnerability disclosures with live production software; identifies modifications that could indicate tampering, drift, or compromise; and provides actionable mitigation recommendations.
An RBOM® (Runtime Bill of Materials) is an inventory of the software components that actually run in an application, as opposed to everything that is installed. RBOM® is a registered trademark of RapidFort, Inc. An SBOM lists every component in an image; an RBOM® is built by observing the application as it runs and recording which packages, libraries, and binaries it uses. Comparing the two shows which components can be removed and which vulnerabilities sit in code that executes. RapidFort Profiler generates an RBOM® as a continuously updated record of executed components, RapidFort Optimizer uses it to remove components that never execute, and RapidFort Runtime generates a dynamic RBOM® for live production environments.
Reachability analysis determines whether vulnerable code in a dependency can actually be reached or executed by an application. Static reachability analysis traces code paths from the application into its direct and transitive dependencies; runtime evidence records what actually loads and executes in a real environment. Both separate exploitable vulnerabilities from those in code that never runs. An RBOM® is runtime evidence: it records what your application actually runs rather than inferring it statically.
Runtime profiling, in security, is observing an application while it runs to record which software components and processes it actually uses; it is distinct from performance profiling, which measures CPU and memory use. The result shows what the application needs, not just what was installed, which guides safe hardening, focuses vulnerability prioritization, and creates a baseline for detecting change. RapidFort Profiler provides continuous runtime profiling with no application changes required and generates an RBOM® (see RapidFort Profiler and RapidFort Runtime).
An SBOM is a formal record of the components in a piece of software and their supply chain relationships: a nested inventory, or list of ingredients, of the packages, libraries, and versions it contains. It helps teams find affected software when a new CVE is disclosed and supports compliance documentation. Common formats are SPDX and CycloneDX. In July 2026, CISA and international partners published the 2026 Minimum Elements for an SBOM, replacing the 2021 NTIA minimum elements and defining data fields (17 in total) such as component name, version, producer, identifiers, hash, license, and dependency relationship. The EU Cyber Resilience Act requires manufacturers to draw up an SBOM covering at least top-level dependencies. An SBOM shows what is installed, not what runs. RapidFort Analyzer generates SBOMs that enumerate all files, packages, and configurations within container images and exports them in SPDX, CycloneDX, JSON, and CSV.
Secure by design means building security into a product from the start as a core business requirement, not a feature added later; secure by default means the product is secure to use out of the box with little or no configuration change and at no extra cost (CISA's definitions). CISA's Secure by Design principles are to take ownership of customer security outcomes, embrace radical transparency and accountability, and lead from the top. The EU Cyber Resilience Act makes security by design and by default a legal requirement for products with digital elements. For containers, secure by design starts with base images that carry few or no known vulnerabilities and ship with hardened defaults.
Shift left is checking for vulnerabilities and security problems in the earlier stages of software development, before software is built and deployed. Practices include scanning code and dependencies in pull requests, linting Dockerfiles, and gating builds on policy. They find problems earlier, but they still depend on developers fixing what is found; starting from a secure base image removes a class of problems before they appear.
SLSA (Supply-chain Levels for Software Artifacts) is a set of incrementally adoptable guidelines for supply chain security, established by industry consensus. Its Build track defines three levels: Build L1, provenance showing how the package was built; Build L2, signed provenance generated by a hosted build platform; and Build L3, a hardened build platform that resists tampering.
Software composition analysis is the process of identifying the third-party and open source components in an application and the risk they carry, such as known vulnerabilities and license issues (OWASP describes SCA as the software-only subset of component analysis). SCA tools read manifests, lock files, and binaries to build an inventory, often exported as an SBOM, and match it against vulnerability databases. They show what is present; deciding what to fix, and fixing it, is a separate step.
A software supply chain is everything involved in building and delivering software: source code, open source dependencies, container images, build tools, pipelines, and the people and processes behind them. NIST describes it as the collection of steps that create, transform, and assess the quality and policy conformance of software artifacts. Modern software is assembled largely from components the organization did not build, so a weakness anywhere in the chain can affect everything downstream.
A software supply chain attack compromises software by targeting a component, tool, or process it depends on rather than the target system directly; CISA describes it as a threat actor infiltrating a vendor's network and using malicious code to compromise software before it reaches customers. Examples include malicious packages, hijacked maintainer accounts, typosquatting, backdoored dependencies, compromised build systems, and tampered container images. These attacks are hard to catch because the malicious code arrives through trusted channels.
Software supply chain security is protecting every component and process involved in building and delivering software, from the open source you consume and the systems you build with to what runs in production. It covers vetting what enters (packages and images), securing how software is built (hardening, signing, and provenance), and protecting what runs (monitoring, drift detection, and tamper detection). The RapidFort Platform covers software supply chain security end to end: Intake, Build, and Runtime in one platform.
SPDX and CycloneDX are the two widely used standard formats for SBOMs. SPDX, hosted by the Linux Foundation, is recognized as the international open standard ISO/IEC 5962:2021 and covers provenance, license, security, and related information. CycloneDX, an OWASP project, is a full-stack bill of materials standard published as ECMA-424 and supports VEX (Vulnerability Exploitability eXchange) statements in the same document. Standard formats let teams share component data with customers, auditors, and tools. RapidFort Analyzer exports SBOMs in SPDX and CycloneDX; with a RapidFort Full Catalog subscription, SBOM export includes CycloneDX with VEX support.
The SSDF is NIST SP 800-218, a framework of practices for developing software securely, grouped into preparing the organization, protecting software, producing well-secured software, and responding to vulnerabilities. Version 1.1 (2022) is current; a revision (SSDF 1.2) is in draft. US federal agencies formerly required software producers to attest to SSDF practices under Office of Management and Budget (OMB) memorandum M-22-18; OMB M-26-05 (January 23, 2026) rescinded that memo, and agencies may still choose to use the CISA Secure Software Development Attestation Form.
Tamper detection is identifying unauthorized changes to software, such as modified binaries, repackaged artifacts, or unexpected behavior at runtime; NIST defines tampering as an intentional but unauthorized act that modifies a system, its components, its intended behavior, or its data. Tampering can happen before delivery, when an artifact is modified, or after deployment, when a running system is changed. Detection compares artifacts or behavior against a trusted baseline. RapidFort Runtime detects runtime tampering, and RapidFort Supply Chain Risk Analysis scans the libraries, files, and packages in RapidFort Curated Near-Zero CVE Images for tampering.
Technical security debt is the growing backlog of known vulnerabilities and security fixes an organization has not yet addressed. When vulnerabilities are introduced faster than engineers can fix them, each unfixed one adds risk and future work and pulls engineers away from building features.
A transitive dependency is a package your software depends on indirectly, through one of its direct dependencies. Most of the code in a modern application arrives this way: a project may declare a few dozen direct dependencies that pull in hundreds more. OWASP's guidance on vulnerable components covers both the components you use directly and these nested dependencies, which are easy to miss because no one on the team chose them.
Typosquatting, in software packages, is publishing a malicious package under a name very close to a popular one so developers install it by mistake; OpenSSF describes it as an attacker creating an official-looking package name to trick users into installing rogue packages. A single typo in an install command can bring malicious code into a project, and some payloads run as soon as the package is installed. The same word also describes look-alike web domains.
VEX is a machine-readable statement that indicates the status of a software product or component with respect to a vulnerability (CISA's definition). A VEX statement assigns one of four statuses to a CVE for a product: not affected, affected, fixed, or under investigation, and a not-affected status should include a justification. Common formats are OpenVEX, CSAF VEX, and CycloneDX VEX. VEX lets suppliers tell customers which scanner findings do not apply, which reduces triage work; its value depends on how much the reader trusts the supplier's evidence. With a RapidFort Full Catalog subscription, SBOM export includes CycloneDX with VEX support.
Vulnerability management is the ongoing process of finding, assessing, prioritizing, and addressing security vulnerabilities across software and systems; NIST describes it as a continuous monitoring capability that identifies CVEs likely to be used by attackers. A typical program scans assets, maps findings to CVEs, ranks them, assigns fixes, and tracks progress. More vulnerabilities are introduced than engineers can reasonably fix, so the backlog grows. RapidFort eliminates risk instead of only ranking it: CVEs are removed from your stack, not added to a backlog.
Vulnerability noise is the volume of vulnerability findings that do not reflect real, exploitable risk, which makes it hard to see what matters. Much of it comes from CVEs reported in components that are installed but never run: real findings with little exploitability (a false positive, by contrast, is a finding that is wrong). RapidFort Analyzer confirms whether a vulnerability truly applies to the image, and RapidFort Profiler distinguishes active code paths from dormant layers to reduce vulnerability triage noise.
Vulnerability prioritization is ranking vulnerabilities so teams address the most dangerous ones first. Common signals are CVSS for severity, EPSS for exploitation likelihood, the CISA KEV catalog for confirmed exploitation, and runtime evidence of whether the vulnerable code executes. In addition, CISA BOD 26-04 evaluates vulnerabilities using four input signals to establish remediation timelines for them to help your teams prioritize vulnerabilities. Prioritization focuses effort, but the vulnerabilities still have to be fixed or removed. RapidFort eliminates risk rather than only prioritizing it: near-zero CVE base images and removal of unused components shrink the list, and RapidFort Profiler identifies CVEs tied to executed binaries and services so teams focus on vulnerabilities that represent real exposure.
A vulnerability remediation SLA is a supplier's published target or commitment for how quickly it fixes vulnerabilities in its software, usually by severity and measured from a defined starting point. A clear SLA states the severity tiers, the time unit (calendar or business days), when the clock starts (for example when a CVE is published, when it is added to the CISA KEV catalog, or when an upstream fix exists), which products are covered, and whether it is contractual. Some suppliers publish a separate, shorter window for CISA KEV vulnerabilities because those are being actively exploited. The RapidFort Support and Availability Policy, part of the RapidFort Master Subscription Agreement, sets target resolution times for the RapidFort Curated Near-Zero CVE Images in a subscription. For CISA KEV vulnerabilities the target is 1 calendar day from the date an applicable patch is available. For other CVEs, measured from the date an applicable patch is publicly available, the targets are 7 calendar days for Critical and High, 21 for Moderate (CVSS Medium), and 28 for Low. RapidFort uses commercially reasonable efforts to meet them. An applicable patch is a complete upstream fix that can be applied without breaking the image's material functionality or introducing material regression issues.
A zero-day vulnerability is a security flaw that attackers know about or exploit before the maintainer has released a fix; NIST defines a zero-day attack as one that exploits a previously unknown hardware, firmware, or software vulnerability. Because no patch exists at first, defenses rely on reducing the attack surface so less code is exposed and on monitoring runtime behavior for signs of compromise. RapidFort Optimizer removes components that never execute, and RapidFort Runtime monitors deployed software for tampering, drift, or compromise.
Continuously eliminate up to 99.9% of CVEs without code changes
