Showing

results

April 15, 2026

US Cyber Strategy & Software Supply Chain Security

RapidFort supports the PTCA by informing decisions on adversary behavior, consulting on regulation and emerging technology, and securing federal networks with 35,000+ near-zero CVE container images.

Compliance & Governance

Software Supply Chain Security

In our position as the global leader in containerized software supply chain security, RapidFort supports the 6 March 2026 publication of "President Trump's Cyber Strategy for America" (PTCA). This document establishes clear linkage between our mission and U.S. objectives. The PTCA provides a strategy with the six pillars below, highlighted with our connection to each:

Informed

Shape Adversary Behavior

Consulted

Promote Common Sense Regulation

Responsible

Modernize and Secure Federal Networks

Responsible

Secure Critical Infrastructure

Consulted

Sustain Superiority in Critical and Emerging Technologies

Responsible

Build Talent and Capacity

Each uses a RACI matrix verb with one informed area, two consulted, and three responsible. Our team expects these areas will evolve during strategy implementation and will continue to adapt.

Informed

Shape Adversary Behavior

RapidFort maintains informational awareness about national security missions to shape adversary behavior. Our team maintains supply chain security for deployed capabilities and troops, supporting wide-spread observability and countering surveillance state growth. These actions help the community maintain a competitive market through protecting intellectual property.

Consulted

Promote Common Sense Regulation

Our teams consult to help federal regulators deliver common sense regulation across emerging technology. Modern software environments, especially AI-driven ones, demand rapid acquisition, expedited deployment, and continuous monitoring. This remains difficult with current bloated, manual-process focused, legacy legislation.

Human-in-the-loop solutions maintain system integrity for AI deliveries but compliance and acquisition actions demanding multiple manual reviews require deprecation, sooner rather than later. Our teams maintain regular education cohorts for commercial partners to expedite federal compliance practices.

Sustain Superiority in Critical and Emerging Technologies

RapidFort also consults on sustaining superiority across critical, emerging technologies. RapidFort delivers hardening and curating solutions for 96%+ of all software derived from Open Source code. Despite new technology, the more complicated the deployment, the more likely an Open Source foundation or components exists.

RapidFort hardens and curates those libraries through minimizing distributing vulnerabilities in the supply chain, eliminating critical vulnerabilities, and removing excess and unused code from containers.

RapidFort delivers hardening and curating solutions for 96%+ of all software derived from Open Source code.

Responsible

Modernize and Secure Federal Networks

The core mission of RapidFort is to deliver the world's most secure containerized software supply chain to support modernizing and protecting federal networks, infrastructure, and operations. Our solution shifts security left, minimizing both legacy and new vulnerabilities enabling the prioritization of National Security systems.

Modernizing networks requires constant adaptation and our library of 30,000+ near-zero CVE images leads the market. Our technology accelerates government modernization by offering one for one container and image swaps without recoding, with minimal downtime, and with no lost functionality. These practices secure federal workspaces without impacting federal functions whether in the DoW, DoT, or DoE.

Secure Critical Infrastructure

We hope to continue focused success by continuing to partner with the government to secure critical infrastructure improvement as an extension of modernizing government networks. Modernizing CISA's 16 critical infrastructure areas such as manufacturing, communications, energy and others depends on being able to swap vulnerable containers for our curated solutions without losing functionality. Our design supports wide integration and massive scalings, areas we see as guaranteed to bring improvements to infrastructure.

Build Talent and Capacity

These improvements are only possible when the security community contributes to develop strong, educated, and U.S. based work forces. Our success depends on technical understanding. We enhance our customers, and the U.S. workforce by offering basic learning, thought leadership, and use-case solutions on improving software supply chain security. Advancement is not possible without smart people, and our responsibility to this plan includes continuing to develop smart people.

Summary

RapidFort supports the PTCA in identifying critical pillars to grow U.S. cyber capabilities. We inform decisions about adversary behavior, consult on common sense regulation and emerging technology, and are responsible for improving outcomes for modernizing networks, securing infrastructure and improving workforces. Strategies are the first step in developing the implementation to create success across these pillars. Join with us, secure your supply chain, and help advance the strategy.

EU CRA for Containers & Kubernetes: Scope, Deadlines & Steps

blog

April 15, 2026

EU CRA for Containers & Kubernetes: Scope, Deadlines & Steps

The EU CRA requires hardened container images, SBOMs, and 24-hour vulnerability reporting. Learn scope, deadlines, and compliance steps for Kubernetes teams.

Compliance & Governance

Container Security

The EU Cyber Resilience Act (CRA) is a regulation (EU 2024/2847) that introduces mandatory cybersecurity requirements for all products with digital elements sold in EU markets. It entered into force on December 10, 2024, with reporting obligations beginning September 11, 2026, and full enforcement on December 11, 2027. For teams working with containers and Kubernetes, the CRA brings new requirements around how cloud native applications are built, distributed, and maintained throughout their lifecycle.

What Does the CRA Apply to in Cloud Native Environments?

The CRA applies to all container images, Kubernetes operators, and Helm charts with commercial support that are available to EU customers, regardless of where the distributing organization is based. The regulation defines its scope as "products with digital elements" available in EU markets, which includes much of the cloud native stack.

Within CRA Scope

Container images distributed publicly

Commercial Kubernetes operators

Helm charts with commercial support

Open source with commercial backing

Key Nuances

Applies to the product, not the organization's location

EU customer access triggers applicability

Compliance chain required across the full supply chain

Commercial support contracts increase obligation

Open source projects may also be affected, particularly those with commercial backing or support contracts. The regulation necessitates a compliance chain throughout the cloud native supply chain.

What Are the Three Key CRA Requirements for Container Teams?

The CRA introduces three categories of requirements that directly affect how teams build and operate container infrastructure: security by design, vulnerability management, and long-term security commitments.

Security by Design and Default

Hardened base images, minimal attack surfaces, and secure defaults as regulatory requirements.

Vulnerability Management

SBOM data, continuous monitoring, and 24-hour ENISA reporting for exploited vulnerabilities.

Long-Term Security (5+ Years)

Ongoing security updates, rebuild pipelines, and backward-compatible patching for product lifetime.

What does security by design mean under the CRA?

The CRA requires that base images are hardened with unnecessary components removed and secure configurations applied before products are placed on the market. The regulation codifies what many in the cloud native community have long advocated: minimal attack surfaces and secure defaults become regulatory requirements rather than recommendations.

What are the CRA vulnerability reporting requirements?

Organizations must maintain Software Bill of Materials (SBOM) data, continuously monitor for vulnerabilities, and remediate within defined timeframes. Under Article 14 of the CRA, actively exploited vulnerabilities require an early warning notification to The European Union Agency for Cybersecurity (ENISA) within 24 hours of becoming aware, followed by a full notification within 72 hours. This means detection and incident response processes need to operate at scale across clusters.

Under CRA Article 14, actively exploited vulnerabilities must be reported to ENISA within 24 hours. Detection and incident response processes need to operate at scale across clusters.

How long must security updates be maintained under the CRA?

Under CRA Article 13, products require security updates for a minimum of five years from the date of placing on the market, or throughout the expected product lifetime if that period is shorter. For container teams, this means tracking container versions deployed in customer environments, maintaining rebuild pipelines for older images, and ensuring backward compatibility while addressing security issues discovered years after release.

How Does the CRA Affect Kubernetes Deployments?

Kubernetes environments are affected by the CRA because a typical production deployment involves numerous container images from different sources, each with varying security practices and update mechanisms. This includes applications, init containers, sidecars, monitoring agents, and operators.

Multiple image sources per deployment

Varying security practices per component

Different update mechanisms and cadences

When deploying third-party controllers or operators, teams inherit potential CRA obligations. The regulation's supply chain requirements mean that understanding the security posture and update mechanisms for dependencies becomes increasingly important.

How Can Cloud Native Teams Prepare for CRA Compliance?

Teams can prepare for CRA compliance by adopting practices in the Cloud Native Computing Foundation (CNCF) ecosystem that align with CRA requirements. The following four areas provide a practical starting point:

Minimal Containers

Start from secure base images that do not carry inherited vulnerabilities, then harden your application by removing unnecessary software and reducing the overall attack surface.

SBOM Complemented with RBOM

Go beyond static inventory. Integrate automated SBOM and RBOM generation into CI/CD pipelines to distinguish installed components from those actually executed at runtime.

Image Distribution Strategies

Review how security updates reach users, which versions are deployed where, and how registries enforce policies across environments.

Supply Chain Visibility

Understand who maintains the images you depend on, what their security update cadence looks like, and whether alternative strategies might be needed for critical dependencies.

What Does the CRA Mean for the Future of Cloud Native Security?

The CRA represents a regulatory shift toward treating software security as a fundamental product requirement rather than a best practice. For the cloud native ecosystem, this creates challenges around operationalizing security practices at scale, but also validates approaches the community has developed around minimal containers, supply chain security, and automated vulnerability management.

Organizations distributing containerized products to EU markets have time to adapt, but the architectural and operational patterns needed for compliance often take time to implement effectively. Starting the conversation now about container security posture, SBOM generation, and vulnerability response processes helps teams make informed decisions as they build and evolve their cloud native platforms.

How Does RapidFort Help Organizations Meet CRA Requirements?

RapidFort is a software supply chain security platform built to address the CRA's core expectations for containers. It delivers CVE-free base images that are hardened and manually patched, generates SBOMs and Runtime Bills of Materials (RBOMs) for documentation and runtime visibility, and automatically removes unused code from container images to reduce exploitable CVEs by up to 99.9%. The following table shows how specific CRA requirements map to RapidFort capabilities:

CRA Requirement

Security by design with minimal attack surfaces

SBOM documentation for all components

Risk-based vulnerability handling

Products designed and produced to limit attack surfaces

Ongoing vulnerability management during support period

How RapidFort Addresses It

CVE-free base images, hardened and manually patched

Automated SBOM generation with reduced false positives

RBOMs that show what actually executes in production

Automated removal of unused code, up to 99.9% CVE reduction

Audit-ready reports and security baseline validation

If your organization is preparing for CRA compliance and you want to understand how RapidFort can help you meet these requirements, schedule a 30-minute call with our team.

PyPI, npm, and the New Frontline of Software Supply Chain Attacks

blog

April 3, 2026

PyPI, npm, and the New Frontline of Software Supply Chain Attacks

Four software supply chain attacks in early 2026, targeting Trivy, LiteLLM, Telnyx, and Axios, share a pattern every security team should understand. Here is what happened and what to do about it.

Software Supply Chain Security

Threats

Three months into 2026, four significant software supply chain attacks have already been disclosed.

The targets: Trivy, a widely used container scanner. LiteLLM, a PyPI package. Telnyx, with over one million monthly downloads. And Axios, a widely used npm package.

These are not obscure packages. They sit inside CI/CD pipelines, developer environments, and production systems across the open-source ecosystem.

Software supply chain attacks continue to increase in frequency and impact, targeting widely used open-source packages and developer tooling. The early months of 2026 show exactly how that plays out in practice.

The Pattern Across All Four

In each case, attackers did not create fake packages. They gained unauthorized access to trusted projects or maintainer accounts and introduced malicious code into official releases. The malicious versions appeared authentic because they moved through the same registries, GitHub releases, and CI/CD integrations that teams rely on every day.

Once distributed, the injected payloads executed automatically. They ran during installation, import, or pipeline execution. No unusual behavior. No user interaction required.

The objective in every case: credential theft. Cloud keys, SSH keys, Kubernetes secrets, and environment variables were consistently targeted.

In the LiteLLM compromise, cryptocurrency wallet files were also collected. In multiple incidents, stolen credentials were then used to publish additional malicious packages, propagating the attack further across ecosystems.

Four Incidents, One Underlying Problem

Trivy

v0.69.4 — GitHub Actions

CVE-2026-33634

Multi-phase attack by a threat actor. Incomplete credential rotation allowed unauthorized access to persist. More than 60 npm packages affected.

LiteLLM

1.82.7 / 1.82.8 — PyPI

PyPI

Malicious .pth file executed automatically at Python interpreter startup. No explicit import required.

Telnyx

4.87.1 / 4.87.2 — PyPI

PyPI

Payload hidden inside WAV audio files using steganography. AES-256-CBC and RSA-4096 encryption. Exfiltrated via HTTP.

Axios

1.14.1 / 0.30.4 — npm

State actor

Maintainer account takeover. Cross-platform RAT deployed at install time. Attributed to a North Korean state-linked threat actor.

Trivy v0.69.4 — CVE-2026-33634 · CISA KEV

Between February 27 and March 22, 2026, a threat group carried out a multi-phase attack that also affected more than 60 npm packages. It began with unauthorized repository access that persisted due to incomplete credential rotation. Attackers pushed a malicious release through official channels, then force-pushed tags on trivy-action and setup-trivy. Existing version references in thousands of workflows silently resolved to attacker-controlled code. The compromise has since been formally assigned CVE-2026-33634 and added to CISA's Known Exploited Vulnerabilities catalog.

LiteLLM 1.82.7 / 1.82.8

Compromised across two consecutive PyPI versions. The first embedded malicious code in the proxy server module, executing on import. The second introduced a malicious .pth file that executed automatically at Python interpreter startup, requiring no explicit import. Both versions matched the real project's metadata and did not correspond to any official GitHub release.

Telnyx 4.87.1 / 4.87.2

Delivered payloads hidden inside WAV audio files using steganography. On Windows, the payload installed a persistent executable in the Startup folder. On Linux and macOS, it collected sensitive data, encrypted it using AES-256-CBC and RSA-4096, and exfiltrated it via HTTP. With over one million monthly downloads, this was a high-impact compromise.

Axios 1.14.1 / 0.30.4

Compromised through a maintainer account takeover. Attackers pushed two unauthorized releases directly to npm. Those releases introduced a malicious dependency that connected to an external command-and-control server during installation. It then deployed a cross-platform remote access trojan across macOS, Windows, and Linux. Any environment that ran a standard install while those versions were live executed the payload automatically. Google Cloud Threat Intelligence, Microsoft, and Mandiant have since attributed this attack to a North Korean state-linked threat actor.

Why Security Tooling Is Now a Target

The Trivy compromise stands out for one specific reason.

Trivy is a security scanner. It runs inside CI pipelines specifically to find vulnerabilities. In early 2026, it was used as the delivery mechanism for credential-stealing malware across thousands of workflows.

The tools teams use to check for risk are not automatically exempt from it.

A scanner running with access to CI secrets is a high-value target. If it is not version-pinned, not monitored, and not isolated from production credentials, it is an exposure. Scanners should be treated like any other software dependency in the pipeline.

What These Incidents Require

These incidents highlight that preventing supply chain attacks requires both dependency hygiene and strong CI/CD security controls. The following practices help reduce exposure and limit the impact of compromised packages.

Prevention framework

Pin package versions and use immutable references

Use lockfiles everywhere. Never run pip install or npm install without a pinned version in CI. Most of these attacks succeeded because pipelines pulled the latest version. Where possible, reference SHAs rather than tags. Tags can be mutable. SHAs are immutable.

Rotate credentials atomically

When rotating after a breach, revoke all credentials simultaneously. Sequential rotation leaves a window attackers can capture. The Trivy attack persisted specifically because of incomplete credential rotation.

Restrict egress from CI/CD runners

Every attack in this set exfiltrated data over the network. Restricting outbound connections from runners to an allowlist stops data from leaving even if a malicious payload executes.

Apply least privilege to service account tokens

Scope service account PATs to the minimum repositories and permissions required.

Treat security tooling as attack surface

Scanners should be version-pinned and monitored like any other software. Their steps should be isolated from production credentials.

How RapidFort Is Addressing This

For over five years, RapidFort has focused on delivering clean, production-ready container images built on well-known Linux distributions, reducing risk across both OS and application layers. By building from source, RapidFort is able to remediate vulnerabilities not only in base OS packages but also in embedded language dependencies within third-party images, providing a more comprehensive approach to CVE reduction.

Beyond images, RapidFort provides a platform that enables organizations to scan, profile, and harden their workloads, helping teams understand and minimize their attack surface without disrupting existing development workflows.

As supply chain attacks increasingly target language ecosystems such as npm, PyPI, and Maven, RapidFort is expanding its approach to address this growing risk. Upcoming capabilities will extend package-level support, enabling customers to consume vetted and scanned language dependencies through RapidFort rather than pulling directly from a package repository. This adds an additional layer of trust and control to the software supply chain.

GitHub Actions Security Audit: CI/CD Risk & Shell Injection

blog

March 2, 2026

GitHub Actions Security Audit: CI/CD Risk & Shell Injection

GitHub Actions workflows are a frequent target when misconfigurations enable untrusted pull request code execution, unsafe comment triggers, or shell injection via event fields. This guide explains the highest-risk patterns to audit and shares RapidFort’s open-source org-wide GitHub Actions security audit tool to assess repositories at scale and prioritize remediation.

DevSecOps & Best Practices

Software Supply Chain Security

Recent public analysis has highlighted an active effort to compromise GitHub Actions workflows by exploiting repeatable workflow misconfigurations. The most common patterns include unsafe use of pull_request_target, comment-triggered automation without strong authorization controls, and command injection risk created when attacker-controlled event fields are embedded into shell steps. This post also reflects review feedback from Aaron Lippold that helped improve clarity and technical precision.

This post summarizes the workflow patterns worth auditing and shares an open-source, organization-wide audit tool RapidFort published so maintainers can quickly assess exposure across many repositories.

The Workflow Patterns to Audit

1) pull_request_target combined with untrusted checkout and execution

The pull_request_target event runs in the context of the base repository. Risk increases when a workflow checks out pull request-controlled code and then executes it in that privileged context. The issue is the combination of elevated context with untrusted code execution.

Review any workflow triggered by pull_request_target and confirm whether it checks out the pull request head ref, including from forks, and runs scripts, build steps, or actions sourced from that checkout. Treat any workflow that does so as a high-priority hardening candidate, especially if secrets or elevated token permissions are available in the same job.

2) Comment-triggered workflows without strict authorization gates (issue_comment)

Workflows triggered by issue_comment can be useful for maintainers, but they require strong authorization checks to avoid turning public comments into an execution mechanism. Risk arises when a workflow reacts to a comment string and performs meaningful actions without confirming that the commenter is trusted.

Review comment-triggered workflows and ensure privileged behavior is gated to trusted actors through clear, enforceable checks. This is particularly important for workflows that publish artifacts, create releases, modify repository state, access protected environments, or use secrets.

3) Shell injection via unsafe use of GitHub event fields in run steps

Many GitHub Actions context fields can be influenced by pull request authors, including branch names, pull request titles, commit messages, and file paths. If these values are inserted into shell commands without safe handling, they can alter command behavior and, in some cases, enable command injection.

Review run: steps for direct usage of ${{ github.event.* }} and related context values inside shell commands, especially in scripts that perform parsing, loops, string concatenation, or dynamic command construction. Pay close attention to unquoted variables, ad hoc string manipulation, and any command built from event fields.

4) Filename injection in shell processing of pull request changes

Workflows frequently enumerate changed files using diff output, git commands, or filesystem discovery, then process those filenames in shell loops. When filenames originate from pull request content, treat them as untrusted input. Risk increases when filenames are expanded without strict quoting or used to construct commands.

Identify workflows that consume pull request-derived filenames and confirm that variables are consistently quoted, that scripts avoid unsafe word splitting, and that filenames do not influence command execution paths.

5) Automation and instruction poisoning in privileged workflows

As organizations add automation agents, including AI-assisted workflows, a newer class of risk is emerging: instruction or configuration poisoning. If an automated workflow reads instructions, configuration, or directives from pull request-controlled content while running with elevated permissions or secrets access, a contributor can attempt to influence what the automation executes.

Review any workflow that consumes pull request-provided instruction or configuration files and confirm that privileged operations are isolated from untrusted inputs. Ensure pull request content cannot change what privileged steps execute.

RapidFort’s Open-Source Organization-Wide Audit Tool

To make this audit practical at scale, RapidFort published an open-source tool that scans GitHub Actions workflows across an entire organization and generates a report focused on high-signal findings:

https://github.com/rapidfort/gh-action-security-audit

The tool helps identify workflows that lack explicit permissions: blocks, usage of pull_request_target with higher-risk characteristics, comment-triggered workflows that may be missing guardrails, and secret names referenced in workflow files (not secret values). It also supports organization-level review of default workflow token posture and the relationship between secret visibility and actual workflow usage, so access can be reduced where appropriate.

How to Triage Findings

When prioritizing remediation, start with workflows that can execute pull request-controlled code in a privileged context. Next, focus on comment-triggered workflows that can reach privileged actions without strict authorization gates. Then address workflows where event fields are embedded into shell commands, followed by workflows that rely on broad defaults instead of explicit permissions. Finally, tighten secrets visibility so secrets are accessible only where they are required.

What Is RBOM®? Runtime Bill of Materials vs SBOM Explained

blog

February 27, 2026

What Is RBOM®? Runtime Bill of Materials vs SBOM Explained

Learn what a Runtime Bill of Materials (RBOM) is, how it differs from an SBOM, and how runtime profiling reduces container attack surface. Discover how RapidFort uses RBOM alongside curated hardened images to prioritize exploitable risk in modern DevSecOps and Kubernetes environments.

Runtime Security

RapidFort Platform

An RBOM, or Runtime Bill of Materials, is not an explosive, but it can reduce vulnerable code in similarly decisive ways. An RBOM operates as a dynamic, execution-aware refinement of the Software Bill of Materials (SBOM). SBOMs record all software artifacts associated with a build, whereas RBOMs capture only the components that are actually executed or loaded into memory at runtime. Thinking about how RBOM improves compliance requires deeply analyzing large codebases, identifying unused components, isolating what is truly essential, and reducing SBOM elements that unnecessarily expand the attack surface.

One of the best ways to think about RBOM is in terms of risk reduction. In many DevSecOps pipelines, teams believe security has been fully integrated once scanning is enabled and builds are passing. However, if a scanner is configured too permissively or lacks meaningful baselining, there may be no effective comparison between versions or visibility into what truly changed. Simply comparing one build to the next does not always provide actionable insight. RBOM goes further by establishing a runtime baseline and evaluating which libraries, binaries, dependencies, and other code elements are actually executed. This approach ensures that organizations do not spend time managing vulnerabilities in code their product does not use.

FedRAMP, under CM-8 guidance, requires a complete and up-to-date inventory of all system components. This process often begins with an SBOM. However, just because you can bring every possible item does not mean you should - bringing six bathing suits to a ski vacation is unnecessary. Returning to RBOM, the first step is analyzing all components within the codebase. Comparing the SBOM to the RBOM brings clarity to what is actually required versus what merely exists.

The rise of open-source usage, AI-assisted development, and rapid coding practices has significantly expanded dependency trees. Many projects include just-in-case libraries that are never used at runtime. RBOM comparison identifies unused components within the overall package, uncovering what might otherwise take engineers hundreds of hours to manually analyze and resolve.

The next RBOM step highlights unused components for further evaluation and potential removal. These elements are flagged for deeper analysis within the platform. For example, one Python graphics library used by a RapidFort customer had over 3,200 packages installed, yet only 200 were actually used at runtime. This does not imply that the remaining packages were malicious or without value - only that they were not used in that deployment. Many production environments lack a systematic way to surface these inactive components.

Highlighting which packages are actually used can significantly reduce security vulnerabilities. In this case, eliminating unused packages reduced Common Vulnerabilities and Exposures (CVEs) associated with dormant code while shrinking the overall attack surface. Beyond lowering security risk, this reduction also improved build times and increased efficiency within production pipelines.

RBOM supports two primary approaches for eliminating excess SBOM components. The first is less of a removal and more of a swap - using RapidFort’s curated library to replace open-source images with hardened, near-zero-CVE equivalents in a one-for-one exchange. Think of this as a washing-machine approach: vulnerable open-source images go in, and hardened images come out. The second approach removes unused code - such as the 3,000 dormant Python packages - to streamline the artifact down to essential runtime components. Ultimately, the RBOM should closely align with the SBOM. This means no explaining discrepancies to auditors, no securing unused code, and no engineering time wasted on non-essential remediation efforts.

Overall, RBOM is an efficient tool for evaluating the SBOM at runtime, ensuring that everything listed in the inventory is actually being used. One final metaphor: if you run a retail store, you stock items that sell. If 90% of your inventory never moves, it occupies valuable space. If your platform or product uses 80% of its footprint for unused components - and 95% of your vulnerabilities reside there - it may be time to deploy an RBOM. Break down large codebases, identify unused components, isolate essential runtime elements, and eliminate unnecessary vulnerabilities. If you want to dramatically reduce CVEs and strengthen your compliance posture, contact the RapidFort team for a demo.

EU Cyber Resilience Act & Open Source Risk

blog

February 10, 2026

EU Cyber Resilience Act & Open Source Risk

The EU CRA shifts open source accountability to software manufacturers. RapidFort helps teams meet these new standards by reducing inherited risk, shrinking attack surfaces by up to 95%, and generating auditable evidence without code changes.

Compliance & Governance

Software Supply Chain Security

What Changes When You Sell Software into the EU

Open source software is foundational to modern applications. Containerized workloads routinely inherit thousands of packages from upstream libraries and base images, typically consumed under permissive “AS IS” licenses that disclaim warranty and liability.

The EU Cyber Resilience Act (CRA) changes how this risk is treated for any organization placing or selling products with digital elements on the EU market, regardless of where the company is headquartered.

Once open source components are embedded into a commercial product sold in the EU, the manufacturer is responsible for demonstrating ongoing cybersecurity risk management across the supported lifetime of that product. This includes how third-party components are selected, secured, maintained, and documented.

The CRA does not prohibit open source or containers. It formalizes accountability.

RapidFort helps software manufacturers operationalize this accountability at the container layer by reducing inherited risk, shrinking shipped attack surface, and producing high-quality technical evidence that supports CRA-aligned due diligence, without requiring application code changes.

Who the CRA Applies To

The CRA regulates commercial products placed on the EU market, not open source projects themselves.

CRA obligations apply if you are:

A software vendor selling SaaS, on-prem, or embedded software to EU customers

A non-EU company distributing software into the EU
A vendor whose software is bundled, resold, or deployed by EU-based customers

For many organizations, CRA readiness is becoming a market access requirement, influencing procurement reviews, customer security assessments, and contractual discussions.

What the CRA Requires in Practice

CRA expectations translate into three concrete outcomes that software organizations must be able to demonstrate consistently.

1. Know what you ship

Manufacturers must maintain accurate, version-specific visibility into operating system packages, libraries, and components embedded in each release.

2. Reduce and manage risk over time

Vulnerability handling must extend beyond detection. Organizations are expected to assess relevance, prioritize remediation, and reduce exposure throughout the supported lifetime of the product.

3. Produce defensible technical evidence

Documentation must demonstrate how secure baselines were applied, how vulnerabilities were addressed, and how the security posture was maintained over time.

These requirements are difficult to meet when container programs rely on unmanaged upstream images and scan-only workflows that generate volume without control.

Why Base Images Are a CRA Risk Multiplier

Most container images include far more software than applications actually require. Utilities and libraries accumulate without regard to runtime behavior.

Under the CRA, this matters because:

Every shipped component expands the attack surface
Every shipped component increases long-term maintenance obligations
Every shipped component must be tracked, assessed, and documented

Unvetted community images often include unnecessary packages and latent vulnerabilities, increasing both exposure and documentation burden.

Raw LTS distributions such as Ubuntu, Debian, Alpine, and Red Hat UBI provide transparency and ecosystem maturity, but they are not hardened or continuously maintained to regulatory expectations by default. The burden of hardening, patching, and documentation remains with the manufacturer.

CRA-aligned software delivery requires container foundations that are maintained, hardened, and auditable by design.

RapidFort’s Role in CRA-Aligned Software Delivery

RapidFort is a software supply chain security platform focused on securing container images and reducing exploitable vulnerabilities at scale.

RapidFort does not certify CRA compliance and does not replace legal or governance processes. It provides the technical capabilities that enable organizations to meet CRA expectations in a practical, repeatable way.

Accurate Visibility as the Foundation

CRA-aligned due diligence begins with knowing exactly what is inside the software you ship.

RapidFort performs deep analysis of container images to identify operating system packages, libraries, and configurations, generating high-quality SBOMs and vulnerability data with reduced false positives. This establishes a reliable baseline that can be referenced across engineering, security, legal, and compliance teams.

Reducing Inherited Risk with Curated Near-Zero CVE Images

One of the most effective ways to improve CRA posture is to reduce inherited vulnerabilities before application code is introduced.

RapidFort maintains 35,000+ Curated Near-Zero CVE Images built on widely adopted LTS Linux distributions, including Ubuntu, Debian, Alpine, and Red Hat UBI.

These images are:

Continuously patched and rebuilt to address known CVEs
Hardened using CIS and STIG benchmarks aligned with NIST SP 800-70
Designed to reduce baseline vulnerability exposure by default

By starting from a RapidFort Curated Image, organizations materially reduce the number of vulnerabilities that must be tracked, justified, and remediated over the product lifecycle, while preserving compatibility with standard ecosystems and avoiding vendor lock-in.

Shrinking the Attack Surface You Ship

Under the CRA, manufacturers are accountable for everything they ship, not just what they intend to use.

RapidFort applies Software Attack Surface Management (SASM) by identifying which packages, binaries, and libraries actually execute in production and removing those that do not.

This typically results in:

60–90% attack surface reduction
Up to 99.9% CVE remediation

This approach preserves application functionality while significantly reducing remediation workload, documentation scope, and long-term security obligations.

From Static Inventories to Runtime-Aware Evidence

The CRA emphasizes documentation and vulnerability handling over time.

RapidFort complements SBOMs with Runtime Bills of Materials (RBOMs) that reflect which components are actually executed. SBOMs establish composition. RBOMs establish relevance.

Together, they support proportionate, evidence-backed vulnerability handling and strengthen the credibility of technical documentation required under the CRA.

CRA Readiness as a Business Enabler

The EU Cyber Resilience Act is increasingly shaping how software is evaluated, purchased, and deployed in the EU market.

Organizations that can clearly demonstrate control over container foundations, open-source usage, and vulnerability management move faster through security reviews and procurement processes.

RapidFort helps turn CRA readiness into an operational and commercial advantage by making secure-by-design container practices measurable, explainable, and scalable.

Build with Confidence for the EU Market

The CRA does not ban open source or containers. It raises expectations for how they are managed in commercial software.

Organizations that succeed under the CRA will be able to demonstrate three things with confidence:

They know exactly what is in their software
They actively reduce attack surface and vulnerability exposure
They maintain clear, time-stamped evidence of how vulnerabilities are handled

RapidFort enables this by combining accurate visibility, hardened container foundations, attack surface reduction, and runtime-aware evidence into a single, cohesive platform.

If you are selling software into the EU, preparing for CRA obligations, or reassessing how container security impacts your go-to-market strategy, we invite you to connect with the RapidFort team.

You can request access to the platform to evaluate its capabilities in your environment, or schedule a conversation with our experts to discuss how CRA-aligned software delivery fits into your product roadmap: https://www.rapidfort.com/contact-us

‍

RapidFort Raises $42M Series A for Software Supply Chain Security

blog

February 3, 2026

RapidFort Raises $42M Series A for Software Supply Chain Security

RapidFort advances software supply chain security with a $42M Series A, scaling continuous, runtime-aware vulnerability remediation, near-zero CVE images, and attack surface reduction from build through runtime.

RapidFort Platform

Software Supply Chain Security

The pace of modern software delivery has significantly changed. AI-driven development, cloud-native architectures, and increasingly complex dependency chains have compressed the time between vulnerability disclosure and real-world exploitation. In this environment, traditional vulnerability management approaches that rely on periodic scanning, manual triage, and delayed patch cycles are no longer sufficient.

To address this shift, RapidFort has raised $42 million in Series A funding, led by Blue Cloud Ventures and Forgepoint Capital, with participation from Felicis Ventures and additional investors. This funding supports RapidFort’s mission to advance software supply chain security by moving the industry from reactive detection toward continuous, automated vulnerability elimination.

Read the full funding announcement.

As software delivery accelerates, security must operate with the same speed and context. This requires a shift away from static vulnerability reporting toward continuous, execution-aware remediation embedded directly into the software delivery lifecycle.
‍

Why Software Supply Chain Security Must Evolve

Most organizations today are not struggling to identify vulnerabilities. They are struggling to remediate them fast enough and to determine which vulnerabilities are truly exploitable in production environments.

As software delivery accelerates, three structural challenges have emerged:

Vulnerability volume continues to increase due to inherited dependencies and bloated base images.
The window between vulnerability disclosure and exploitation has narrowed significantly, leaving little time for manual response.
Security teams lack runtime context to distinguish theoretical risk from operational risk in production environments.

These challenges require a fundamentally different security model, one that is execution-aware, continuously enforced, and embedded directly into the delivery lifecycle.
‍

RapidFort’s Platform Approach: From Detection to Continuous Elimination

RapidFort is designed to secure the software supply chain from build through runtime by continuously analyzing, remediating, hardening, and validating software artifacts. The platform focuses on reducing risk at its source while ensuring that security decisions are informed by real execution behavior in production environments.

Execution-Aware Vulnerability Analysis and Runtime Context

RapidFort extends beyond static analysis by incorporating runtime profiling and execution-path analysis. Through the Runtime Bill of Materials (RBOM) and execution-aware profiling, RapidFort identifies which components are actually loaded into memory and executed in production. This allows teams to prioritize remediation based on real exploitability rather than theoretical presence.

This execution-aware approach helps eliminate noise, reduce false positives, and focus security efforts where they have the greatest operational impact.

Curated Near-Zero CVE Images as a Secure Foundation

RapidFort provides Curated Near-Zero CVE Images, production-grade base images that are continuously patched and hardened across major LTS Linux distributions, including Alpine, Debian, Ubuntu, and Red Hat. With a catalog exceeding 35,000 curated images, RapidFort enables organizations to significantly reduce inherited vulnerabilities without requiring code changes.

Starting from a clean, continuously maintained foundation reduces security debt early in the lifecycle and limits the volume of vulnerabilities that propagate downstream into production environments.

Attack Surface Reduction Through Automated Container Optimization

RapidFort includes automated optimization capabilities designed to remove unused packages, libraries, and binaries without altering application functionality. By removing unnecessary components, organizations can significantly reduce their software attack surface by up to 90% while maintaining operational stability.

This continuous optimization ensures that container images remain lean, secure, and aligned with real production behavior over time.

Continuous Compliance Alignment for Regulated Environments

RapidFort supports organizations operating in regulated environments by aligning security controls with established benchmarks such as CIS, DISA STIGs, and NIST-based frameworks. Built-in compliance assessment and reporting capabilities help teams maintain audit readiness while continuously reducing vulnerability exposure across both containerized and non-containerized workloads.

‍

What the Series A Enables

This Series A funding accelerates RapidFort’s next phase of growth across several strategic areas:

Platform Innovation: Advancing automated remediation, execution-aware analysis, and continuous attack surface reduction.
Enterprise Adoption: Supporting large-scale deployments with deeper integrations, smoother onboarding, and operational scalability.
Go-to-Market Expansion: Scaling sales, partnerships, and customer enablement to meet growing demand.
End-to-End Assurance: Extending lifecycle security from build through runtime with continuous validation.

‍

Looking Ahead

The future of software security will be defined by speed, applicability, and continuous enforcement. As AI accelerates both development velocity and attacker capabilities, security platforms must operate with execution-level context and continuously remediate vulnerabilities as software changes.

RapidFort is investing to lead this transition by delivering a runtime-aware, continuously enforced software supply chain security platform designed for modern software delivery.

Organizations evaluating a shift from detection-driven security to continuous, runtime-aware remediation can request a technical evaluation or platform walkthrough with the RapidFort team 👉 https://www.rapidfort.com/contact-us

Fintech Container Security 2026: SASM & RBOM®

blog

January 23, 2026

Fintech Container Security 2026: SASM & RBOM®

Explore the critical security challenges facing fintech platforms in 2026, specifically the risks posed by unused software in containerized environments. RapidFort’s Software Attack Surface Management (SASM) platform empowers fintech security teams to move beyond static reporting by utilizing Runtime Bill of Materials (RBOM) and Curated Near-Zero CVE Images. By focusing on execution-aware security, organizations can reduce their software attack surface by up to 90% and CVEs by up to 99.9% without modifying source code, ensuring defensible compliance for frameworks like PCI DSS v4.0 and SOC 2.

Container Security

Compliance & Governance

Fintech platforms operate in one of the most regulated and risk-sensitive software environments. Payment processing, digital lending, fraud detection, and embedded finance systems must remain secure and compliant as software evolves.

Frameworks such as PCI DSS v4.0 and SOC 2 increasingly expect organizations to demonstrate, during audits and assessments, how vulnerabilities are identified, prioritized, and remediated in real production environments. For fintech security teams, the challenge is no longer producing reports. The challenge is producing accurate, defensible evidence that software risk is being reduced.

The Core Challenge in Fintech Software Security

Modern fintech applications are built using containers and open source components. Base images and language runtimes introduce large numbers of packages into production environments.

In practice, only a subset of this software is required for application execution. The remaining components are present but unused.

Unused software creates measurable security and compliance friction:

It expands the software attack surface without improving functionality
It increases reported vulnerabilities that must still be reviewed during audits
It diverts engineering effort away from vulnerabilities that affect runtime behavior

Traditional vulnerability scanners report what is installed, not what executes. This lack of context makes it difficult for fintech teams to focus remediation on real operational risk.

Why Static Evidence Is Insufficient for Fintech Environments

Static scans and SBOMs provide a complete inventory of installed components. They do not show which components are actually loaded or executed at runtime.

As a result:

Security teams must justify vulnerabilities that do not affect production behavior
Auditors receive large volumes of findings with limited execution context
Engineering teams are asked to patch components that are never used

Static evidence alone cannot answer a critical question for regulated financial systems: which vulnerabilities matter in production.

How RapidFort Secures Fintech Software

RapidFort applies Software Attack Surface Management to reduce software risk with accuracy and relevance across the fintech software lifecycle.

Secure Foundations with Curated Near-Zero CVE Images

RapidFort provides Curated Near-Zero CVE Images built on trusted, long-term-supported Linux distributions, including Alpine, Debian, Red Hat, and Ubuntu. These images are continuously maintained and hardened using CIS Benchmarks and DISA STIG guidance aligned to NIST SP 800-70.

Starting with a minimal and well-maintained base image reduces inherited risk before application code is introduced.

Runtime Bill of Materials for Execution Context

RapidFort generates a Runtime Bill of Materials (RBOM) by profiling containers in running environments. RBOM identifies which files, libraries, and components are actually loaded into memory.

This allows fintech teams to:

Separate installed software from executed software
Prioritize vulnerabilities that affect runtime behavior
Provide auditors with execution-aware, defensible evidence

RBOM complements SBOMs by adding runtime context rather than replacing them.

Automated Attack Surface Reduction Without Code Changes

Using runtime profiling and dependency analysis, RapidFort removes unused components from container images without modifying application source code.

This approach typically:

Reduces software attack surface by up to 90% and CVEs by up to 99.9%
Eliminates large volumes of irrelevant vulnerability findings
Produces leaner runtime images suitable for regulated environments

What This Means for Fintech Security Teams

Reducing unused software, understanding runtime behavior, and focusing remediation on what actually executes allows teams to improve security posture while simplifying audit workflows.

RapidFort enables fintech organizations to align software security with how modern financial systems are built, deployed, and evaluated.

Conclusion

Static vulnerability reporting is not sufficient for securing fintech software at scale. Security teams need context, relevance, and measurable reduction of the attack surface.

RapidFort helps fintech organizations secure their software supply chain by focusing on execution, not assumptions.

To learn more about how RapidFort supports fintech security, contact us to see the platform live or sign up for a free trial and experience execution-aware security in practice: https://www.rapidfort.com/contact-us

‍

RF Analyzer: Precision Container CVE Intelligence

blog

January 12, 2026

RF Analyzer: Precision Container CVE Intelligence

RapidFort Analyzer delivers precise, context-aware container vulnerability analysis by validating CVE applicability, reducing noise, and prioritizing real risk.

RapidFort Platform

Container Security

Vulnerability scanning has become a routine part of container security, but accuracy remains a persistent challenge. Many teams collect large volumes of findings without clear insight into which vulnerabilities actually matter in their environment.

This gap between detection and action creates operational drag, slows remediation, and increases risk exposure. Solving it requires moving beyond surface-level scanning toward vulnerability analysis that understands what is present, what is applicable, and what represents real risk.

The accuracy problem in container vulnerability analysis

Most container scanners rely heavily on package manager metadata. While fast, this approach often fails to capture the full reality of modern container images.

Common challenges include:

missed binaries and custom-built components,
inflated CVE counts driven by distribution advisories, and
findings reported without configuration or execution context.

The result is vulnerability data that lacks precision. Security teams are left validating results manually, while engineering teams struggle to prioritize remediation effectively.

Introducing RapidFort Analyzer

RapidFort Analyzer is a container-native vulnerability analysis platform built to deliver accurate, context-aware results across Docker, Podman, and Kubernetes workloads. It is designed to replace noisy vulnerability outputs with results teams can trust.

Rather than producing long, unfiltered CVE lists, RapidFort Analyzer focuses on understanding container images in depth and validating findings before they reach security and engineering teams.

Deep inspection beyond package metadata

Container images frequently contain more than what package managers report. Embedded binaries, custom layers, and bundled libraries often introduce risk that traditional scanning methods miss.

RapidFort Analyzer performs deep inspection across the entire image, enumerating packages, binaries, and configurations. This approach ensures that all components that could impact security posture are accounted for, reducing blind spots and improving overall scan fidelity.

CVE applicability grounded in real context

Not every reported vulnerability represents exploitable risk. In many cases, CVEs may not apply due to distribution-specific fixes, configuration state, or component absence.

RapidFort Analyzer evaluates CVE applicability using advisory-backed intelligence and distribution-level context. This allows teams to exclude vulnerabilities that are not relevant and focus on findings that require attention, significantly reducing false positives.

RapidFort Analyzer has also been validated through Red Hat Vulnerability Scanner Certification, reinforcing confidence in its accuracy and interoperability within Red Hat environments.

Prioritization that aligns with operational reality

Volume alone does not improve security. Effective vulnerability management depends on knowing what to address first.

RapidFort Analyzer prioritizes findings using the RapidRisk Score, helping teams identify vulnerabilities that are more likely to pose real risk in production environments. This enables focused remediation, shorter patch cycles, and better alignment between security and engineering teams.

Built for modern container workflows

RapidFort Analyzer integrates across container registries, CI/CD pipelines, and Kubernetes clusters, providing consistent visibility from build through deployment.

Key capabilities include:

registry and pipeline scanning,
SBOM generation and multi-format reporting, and
unified visibility across environments.

This approach supports software supply chain security initiatives while minimizing operational overhead.

How RapidFort Analyzer fits into the broader platform

RapidFort Analyzer is part of RapidFort’s software supply chain security platform, which combines vulnerability analysis with proactive risk reduction. By pairing accurate analysis with proactive attack surface reduction, the platform enables organizations to strengthen their security posture and reduce vulnerabilities by up to 95% in minutes, without code changes.

Learn more

For further information on RapidFort Analyzer and its approach to precise container vulnerability analysis, please contact us at: https://www.rapidfort.com/contact-us

Kimia: Secure Kaniko Alternative for Kubernetes Builds

blog

December 2, 2025

Kimia: Secure Kaniko Alternative for Kubernetes Builds

Kimia is RapidFort’s modern alternative to Kaniko, offering secure, non-root container image building with BuildKit and Buildah. Learn how teams can improve Kubernetes-based builds, enable multi-architecture support, strengthen supply chain security, and streamline CI/CD pipelines.

Software Supply Chain Security

DevSecOps & Best Practices

The landscape of container image building has undergone significant changes in 2025. With Google's archival of Kaniko in June 2025, organizations that relied on building container images inside Kubernetes clusters found themselves searching for alternatives that could deliver both security and performance. Enter Kimia: RapidFort's answer to the evolving needs of secure, non-root container image building.

RapidFort, a company deeply rooted in open-source principles and container security, released Kimia as an open-source project designed to address the limitations teams encountered with Kaniko. Rather than building yet another image builder from scratch, RapidFort took a pragmatic approach: Kimia provides a unified, Kubernetes-native interface that leverages two proven build engines - Buildah and BuildKit - giving teams the flexibility to choose the backend that best fits their requirements.

In this post, we'll explore how Kimia works, walk through a practical example of building a Python FastAPI application with nightly builds and multi-architecture support, and demonstrate built-in image signing capabilities.

The State of Container Image Building in 2025

Kaniko's Legacy and Transition

When Google introduced Kaniko in 2018, it solved a critical problem: how to build container images inside Kubernetes without requiring privileged access to the Docker daemon. For years, Kaniko became the de facto standard for secure CI/CD pipelines, particularly in regulated industries like finance and defense.

In June, Google officially archived the Kaniko project. While community forks have emerged to provide maintenance patches, the lack of Google's backing and ongoing feature development prompted many organizations to evaluate modern alternatives that offered active development, enhanced security features, and long-term sustainability.

The Rise of Modern Alternatives

Two tools emerged as the primary successors to Kaniko:

BuildKit - Docker's modern build backend that powers docker build commands since Docker 18.09. BuildKit introduces intelligent build optimizations like parallel execution through directed acyclic graphs (DAGs), advanced caching strategies, and native multi-platform build support. It's actively developed and represents the current state-of-the-art in container image building.
Buildah - Red Hat's daemonless OCI image builder that specializes in rootless container operations. Buildah offers fine-grained control over the build process, excellent security posture through user namespace isolation, and a command set that mirrors Dockerfile instructions while also supporting scriptable builds.

Both tools offer compelling advantages, but each has its own operational characteristics and trade-offs. Organizations often find themselves choosing based on factors like existing infrastructure, team expertise, and specific security requirements.

Introducing Kimia: The Best of Both Worlds

RapidFort recognized that different teams have different needs. Rather than forcing a single approach, Kimia provides a Kubernetes-native interface with two flavors:

Kimia with Buildah backend - Optimized for teams requiring strict rootless operations and fine-grained control
Kimia with BuildKit backend - Optimized for teams prioritizing build speed and advanced caching features

By default, Kimia uses BuildKit as its build engine, but teams can easily switch to Buildah when their security posture or operational requirements demand it. This flexibility means organizations can standardize on Kimia while still choosing the best backend for each specific use case.

Key Features

Key features that Kimia brings to the table:

Kubernetes-native design: Runs as standard Kubernetes workloads without special privileges
User namespace isolation: Leverages kernel features for enhanced security
Unified interface: Consistent API regardless of backend choice
Built-in signing support: Native integration with Cosign for supply chain security
Multi-architecture builds: Support for linux/amd64, linux/arm64, and other platforms
Familiar syntax: Compatible with existing Kaniko workflows for easy migration

Building Images with Kimia: A Practical Example

Let's walk through a real-world scenario: setting up a Kubernetes CronJob that automatically builds a Python FastAPI application every morning at 2 AM, incorporating the latest code from the main branch.

Basic Build Configuration

Here's a complete Kubernetes CronJob manifest that demonstrates Kimia's core capabilities:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: kimia-python-fastapi-build
  namespace: builds
spec:
  schedule: "0 2 * * *"  # Daily at 2 AM UTC
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: Never
          securityContext:
            runAsNonRoot: true
            runAsUser: 1000
            fsGroup: 1000
          containers:
          - name: kimia
            image: ghcr.io/rapidfort/kimia:latest
            args:
            - --context=https://github.com/rapidfort/rapidfort-samples.git
            - --context-sub-path=python-fastapi
            - --dockerfile=Dockerfile
            - --destination=ghcr.io/myorg/python-fastapi:$(date +%Y%m%d)
            securityContext:
              allowPrivilegeEscalation: true
              capabilities:
                drop: [ALL]
                add: [SETUID, SETGID]
              appArmorProfile:
                type: Unconfined
              seccompProfile:
                type: Unconfined
            volumeMounts:
            - name: docker-config
              mountPath: /home/kimia/.docker
              readOnly: true
          volumes:
          - name: docker-config
            secret:
              secretName: ghcr-credentials
              items:
              - key: .dockerconfigjson
                path: config.json

Understanding the Security Context

Let's break down the security configuration, which is critical for understanding how Kimia achieves secure builds:

Pod-level security:

runAsNonRoot: true - Ensures the entire pod runs without root privileges
runAsUser: 1000 - Explicitly sets the user ID for all containers
fsGroup: 1000 - Sets the filesystem group for volume permissions

Container-level security:

allowPrivilegeEscalation: true - Required for user namespace operations
capabilities: drop: [ALL] - Removes all Linux capabilities by default
capabilities: add: [SETUID, SETGID] - Adds only the minimal capabilities needed for user namespace mapping
appArmorProfile: Unconfined - Allows user namespace creation (some clusters may need custom profiles)
seccompProfile: Unconfined - Permits the syscalls required for containerized builds

This configuration represents a security-conscious middle ground: it avoids running as root while still enabling the kernel features necessary for isolated container image building.

Multi-Architecture Build Support

Modern applications often need to run on diverse hardware - from x86 servers in traditional data centers to ARM-based instances on AWS Graviton or Azure Ampere. Kimia makes multi-architecture builds straightforward:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: kimia-multiarch-build
  namespace: builds
spec:
  schedule: "0 2 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: Never
          securityContext:
            runAsNonRoot: true
            runAsUser: 1000
            fsGroup: 1000
          containers:
          - name: kimia
            image: ghcr.io/rapidfort/kimia:latest
            args:
            - --context=https://github.com/rapidfort/rapidfort-samples.git
            - --context-sub-path=python-fastapi
            - --dockerfile=Dockerfile
            - --destination=ghcr.io/myorg/python-fastapi:$(date +%Y%m%d)
            - --custom-platform=linux/amd64,linux/arm64
            securityContext:
              allowPrivilegeEscalation: true
              capabilities:
                drop: [ALL]
                add: [SETUID, SETGID]
              appArmorProfile:
                type: Unconfined
              seccompProfile:
                type: Unconfined
            volumeMounts:
            - name: docker-config
              mountPath: /home/kimia/.docker
              readOnly: true
          volumes:
          - name: docker-config
            secret:
              secretName: ghcr-credentials
              items:
              - key: .dockerconfigjson
                path: config.json

The --custom-platform flag tells Kimia to build for both amd64 and arm64 architectures. The resulting image manifest will contain variants for each platform, and container runtimes will automatically select the appropriate architecture when pulling the image.

Built-in Image Signing and Attestation

Supply chain security has become paramount in 2025. High-profile incidents like SolarWinds and the Log4Shell vulnerability demonstrated how attackers target not just applications but the entire build and delivery pipeline. Image signing provides cryptographic proof that an image came from a trusted source and hasn't been tampered with.

Kimia integrates natively with Cosign, the CNCF project for signing and verifying container images. Here's how to add signing to your build:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: kimia-signed-build
  namespace: builds
spec:
  schedule: "0 2 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: Never
          securityContext:
            runAsNonRoot: true
            runAsUser: 1000
            fsGroup: 1000
          containers:
          - name: kimia
            image: ghcr.io/rapidfort/kimia:latest
            args:
            - --context=https://github.com/rapidfort/rapidfort-samples.git
            - --context-sub-path=python-fastapi
            - --dockerfile=Dockerfile
            - --destination=ghcr.io/rapidfort/python-fastapi:$(date +%Y%m%d)
            - --custom-platform=linux/amd64,linux/arm64
            - --sign
            - --attestation=max
            - --cosign-key=/secrets/cosign.key
            - --cosign-password-env=COSIGN_PASSWORD
            env:
            - name: COSIGN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: cosign-credentials
                  key: password
            securityContext:
              allowPrivilegeEscalation: true
              capabilities:
                drop: [ALL]
                add: [SETUID, SETGID]
              appArmorProfile:
                type: Unconfined
              seccompProfile:
                type: Unconfined
            volumeMounts:
            - name: cosign-key
              mountPath: /secrets
              readOnly: true
            - name: docker-config
              mountPath: /home/kimia/.docker
              readOnly: true
          volumes:
          - name: cosign-key
            secret:
              secretName: cosign-credentials
              items:
              - key: cosign.key
                path: cosign.key
          - name: docker-config
            secret:
              secretName: ghcr-credentials
              items:
              - key: .dockerconfigjson
                path: config.json

Understanding the Signing Parameters

--sign - Enables image signing after the build completes
--attestation=max - Generates a full SBOM and detailed provenance
--cosign-key - Points to your Cosign private key
--cosign-password-env - References an environment variable containing the key password, sourced from a Kubernetes secret

Best Practices for Production Deployments

Based on real-world deployments, here are key recommendations:

Security

Always run with user namespaces enabled - This provides an additional isolation layer
Use short-lived credentials - Rotate registry credentials regularly and consider OIDC-based authentication where possible
Implement network policies - Restrict build pods to only necessary egress destinations
Scan images post-build - Integrate vulnerability scanning into your pipeline before promotion

Reliability

Set appropriate resource requests and limits - Build workloads can be resource-intensive
Use PersistentVolumeClaims for cache - When building frequently, persistent cache storage significantly improves performance
Implement retry logic - Network issues and transient failures happen; build your automation to handle them gracefully
Monitor build metrics - Track build times, success rates, and resource utilization

Maintainability

Standardize on base images - Use a curated set of base images to improve caching and security posture
Version your build configurations - Store CronJob and Job manifests in version control
Document architecture decisions - Clearly document why you chose specific backends or configurations

Looking Forward

The container image building landscape continues to evolve. With Kaniko's transition to community maintenance and the maturation of tools like BuildKit and Buildah, we're seeing a consolidation around more secure, performant, and flexible approaches.

Kimia represents this new generation of build tools: secure by default, flexible by design, and built with real-world Kubernetes deployments in mind. By providing a unified interface to multiple backends, it gives teams the freedom to choose the best tool for each job without sacrificing operational consistency.

Whether you're migrating from Kaniko, building a new CI/CD pipeline, or looking to improve your supply chain security posture, Kimia offers a production-ready solution that balances security, performance, and developer experience.

Getting Started

Ready to try Kimia in your environment? Visit the project's GitHub repository: https://github.com/rapidfort/kimia

The Kimia project welcomes contributions, bug reports, and feature requests. As an open-source project maintained by RapidFort, it benefits from both community involvement and professional support options for enterprises that need them.

Conclusion

Building container images securely in Kubernetes doesn't have to be complicated. With Kimia, you get the benefits of modern build engines like BuildKit and Buildah wrapped in a Kubernetes-native interface that prioritizes security without sacrificing functionality.

As we move further into the end of 2025 and into 2026, supply chain security will only become more critical. Tools like Kimia that bake signing, attestation, and rootless operation into their core design will be essential building blocks for secure software delivery pipelines.

Whether you're running a handful of services or orchestrating builds for hundreds of microservices, Kimia provides the flexibility, security, and performance needed for production container image building in modern Kubernetes environments.

AI-Powered Cyberattacks: How Defenders Must Adapt

blog

December 1, 2025

AI-Powered Cyberattacks: How Defenders Must Adapt

AI is now accelerating every phase of the attack lifecycle – not just vulnerability discovery. Recent nation-state activity shows exploit creation, reconnaissance, and lateral movement all becoming automated. This post explores what changed, why it matters, and the practical steps defenders can take now.

Threats

Container Security

We have been predicting a wave of AI-generated software vulnerability exploits for some time. Last week, we began to see the first outline of that wave forming. According to recent reporting, nation-state actors used Anthropic to help execute a sophisticated breach. The incident is an early indicator of the direction this is headed.

This was not a routine exploit. It demonstrated how AI is now being applied across the entire attack lifecycle rather than in isolated stages.

How AI Is Changing the Modern Breach Lifecycle

A typical system breach follows a series of steps:

Target selection
Reconnaissance and attack surface mapping
Vulnerability discovery and validation
Credential harvesting and lateral movement
Data collection and intelligence extraction
Ransom, espionage, or follow-on actions

Historically, AI was used primarily in step 3 - identifying and understanding vulnerabilities.

In this most recent case, AI was used at every stage, which marks a significant shift.

The Old Workflow (Manual)

Attackers previously had to:

Read a vulnerability description
Review a proof-of-concept exploit
Weaponize it manually
Add it to their toolchain
Begin searching for victims

The New Workflow (AI-Driven)

Now, the entire process is automated:

No POC required
No manual adaptation
No lengthy analysis cycle
AI generates the exploit path directly

Attackers just became faster, cheaper, and far more scalable.

So How Do We Respond?

Several ideas are being discussed across the industry. Some are appealing but unrealistic. Some are technically constrained. A few have practical promise.

1. Hold LLM model providers responsible

A commonly suggested path, but easily bypassed.

Even if commercial models were locked down perfectly, open-source versions running locally would still enable misuse.

2. Use defensive AI agents

This concept surfaced again at a Microsoft security conference I attended - the idea that we will counter offensive AI with a swarm of defensive agents.

The flaw is structural:

Offensive AI doesn’t need perfect fidelity. Moderate accuracy is enough to cause real damage.
Defensive AI needs near-perfect precision. One incorrect autonomous remediation action can break production.

We are nowhere close to the fidelity required for safe automated defensive action.

3. Use AI to detect breaches

There is real potential here, but false positives remain too high for this to serve as a dependable primary mechanism.

4. Build better software

A far more durable strategy is to reduce the underlying attack surface and eliminate unnecessary components.

This is the direction RapidFort focuses on - using analysis and automation to help teams build software that is smaller, cleaner, and less exposed.

5. Use AI to strengthen existing security frameworks

Rather than replacing what works, we can use AI to:

Improve prioritization
Enhance visibility
Streamline remediation
Increase consistency in existing practices

6. Increase deterrence

A policy-driven option: raise penalties for cyber breaches.

This will eventually happen, but it will not close the underlying technical gap attackers are now exploiting.

What Actually Works Today

When we examine these options realistically:

Holding model providers accountable is not practical.
Swarm-style defensive AI is not feasible for a long time.
Policy changes help indirectly but don’t solve the technical challenge.

The viable path forward lies in:

Better detection capabilities, and
Building fundamentally stronger software from the start

This means:

Smaller attack surfaces
Fewer unnecessary components
Less exposed code
Automated hardening
Continuous visibility into what software actually contains and uses

AI has accelerated attackers. Our response must be to ensure software is harder to exploit, not easier.

Conclusion: Where RapidFort Fits Into This Future

As attackers become faster and more automated, the only sustainable defense is to reduce the opportunities they can exploit. That means building software that begins secure and remains secure throughout its lifecycle. Achieving this requires understanding what components are truly needed, removing the ones that are not, and continuously maintaining an accurate picture of what is running in production.

This is where RapidFort’s approach fits naturally. By analyzing software deeply, identifying unused components, and reducing exposure, RapidFort helps teams shrink their vulnerability footprint and maintain a more defensible posture over time. The goal isn’t to out-automate attackers, but to give them less to work with in the first place - a practical path in a world where AI has fundamentally changed the economics of exploitation.

RapidFort Pioneered DoD Container Hardening | Industry Standard

blog

November 20, 2025

RapidFort Pioneered DoD Container Hardening | Industry Standard

RapidFort pioneered automated container hardening for the DoD, removing unused code and eliminating CVEs to deliver secure, compliant, near-zero-vulnerability images. This innovation set the industry standard and still leads modern container security.

RapidFort Platform

Image Hardening & Optimization

For years, organizations lived with an uncomfortable truth: containers were bloated, vulnerable, and nearly impossible to secure at scale. Traditional “scan and patch” cycles produced endless vulnerability reports but delivered little real risk reduction - especially in environments like the Department of Defense (DoD), where stakes are higher, timelines are rigid, and compliance expectations leave no room for error.

RapidFort changed that.

Before container hardening became a market trend, RapidFort introduced and industrialized a new model: continuous vulnerability removal through automated software reduction. What began as a breakthrough capability for DoD programs has now reshaped expectations across the software industry, prompting vendors to adopt concepts RapidFort brought to life years earlier.

The Problem: Containers Were Never Built for Zero-Trust Environments

DoD programs required a level of security and predictability the commercial ecosystem was not built to deliver. They needed:

Near zero CVEs in deployed workloads

Verified removal of unused libraries, dormant code, and unnecessary attack surface

Continuous compliance with STIG, NIST 800-53, FedRAMP, CMMC, and related frameworks

Defense-grade supply chain integrity backed by runtime evidence

Traditional scanners could identify vulnerabilities, but they couldn’t fix them. They surfaced thousands of issues without providing a path to remediation, leaving engineering teams to manually patch, rebuild, and re-validate under tight mission timelines.

DoD teams needed more than visibility. They needed trusted, hardened, deployable software artifacts - automatically produced and continuously verified.

The Breakthrough: RapidFort’s Automated Container Hardening

RapidFort pioneered the technology that changed the game.

RapidFort pioneered a method that fundamentally changed how software is secured.

1. Software Reduction (De-bloating)

RapidFort introduced behavior-driven reduction - analyzing how applications execute and automatically removing the software that never runs. Containers shrink by 60 to 90 percent, eliminating large volumes of latent, vulnerable code.

2. Continuous Vulnerability Removal

Instead of patching vulnerabilities one-by-one, RapidFort regenerates images with unnecessary software removed and inherited CVEs eliminated - producing containers that trend toward near-zero vulnerability states without manual patching.

3. Hardened, Continuously Maintained Base Images

RapidFort also pioneered the concept of delivering pre-hardened, continuously rebuilt base images that:

include only essential components

are aligned with STIG and CIS benchmarks

ship with FIPS-validated crypto modules

span all major LTS Linux distributions

This gave defense teams a secure starting point years before it became an industry expectation.

4. Compliance Built Into the Hardening Process

Instead of treating compliance as a documentation exercise, RapidFort embedded technical controls (STIG, NIST, CMMC, FedRAMP) into the hardening process so software is born aligned with requirements - not retrofitted months later.

This combination delivered what DoD teams needed most: hardened artifacts, continuous risk reduction, and verifiable security evidence that stands up to audit scrutiny.

Adoption Within the DoD: From Cutting Edge to Expected Standard

As hardened containers were deployed across sensitive DoD systems, the operational impact became undeniable:

Mission environments became more resilient

ATO timelines shortened

Vulnerability backlogs collapsed

Patch cycles became manageable

Attack surface dropped across entire software portfolios

Engineering teams no longer had to perform manual hardening

For many programs, RapidFort eliminated years of accumulated CVE debt in weeks - something no scanning-based approach had achieved before.

Hardening didn’t just fix a technical problem. It solved a systemic operational bottleneck across nearly every containerized DoD program.

The Industry Follows: Hardening Becomes the New Normal

Only after RapidFort demonstrated that hardened, reduced, near-zero CVE containers could be produced reliably did the broader industry recognize the significance of this model.

Over the last 18 months, the market has shifted rapidly:

Security vendors have introduced hardening “add-ons”

Platform providers now build reduced or minimal images

DevSecOps teams increasingly require hardened artifacts as policy

Cloud providers are prioritizing secure-by-default images

Compliance frameworks emphasize least functionality and minimized attack surface

The methodology RapidFort pioneered - automated hardening through reduction, regeneration, and continuous vulnerability removal - is now viewed as essential to modern software delivery.

But while others are attempting to emulate these concepts, none match the maturity, completeness, or automation depth of RapidFort’s platform.

Most alternatives patch. Some publish occasional low-CVE images.RapidFort continuously regenerates, verifies, and hardens software across the entire supply chain.

Why RapidFort Remains the Leader

Even as new entrants appear, RapidFort maintains a generational lead because:

It invented and industrialized the reduction-based hardening approach

It operates the industry’s largest continuously rebuilt library of near-zero CVE images

It integrates reduction, vulnerability intelligence, runtime validation, and compliance evidence into one workflow

It removes vulnerabilities at their source instead of naming them

It is proven at scale across DoD, public sector, and highly regulated industries

Its hardening methodology is embedded throughout the SDLC, not applied as a post-processing step

RapidFort didn’t just predict the future of secure software delivery - it built it.

The Future: Hardened Software as a Requirement, Not an Option

As threat actors advance and regulatory pressures increase, organizations across government and commercial sectors are converging on a new reality:

All containers must be hardened

All software must be secure-by-design

Vulnerabilities must be removed before deployment

Continuous compliance must be built into delivery pipelines

SBOMs must reflect real risk reduction, not static inventories

Runtime evidence must validate what actually executes

In this environment, the approach RapidFort pioneered is not simply helpful - it is foundational.

Conclusion: What RapidFort Started Is Now Redefining the Industry

RapidFort pioneered automated container hardening because the industry needed it - urgently, especially within the DoD. Today, that innovation has evolved into a core expectation for secure software delivery across sectors.

While others attempt to replicate parts of this model, RapidFort remains the original architect of the technology, the methodology, and the discipline that is reshaping modern container security.

The future of software security is hardened, intelligence-driven, and automated - exactly the direction RapidFort set into motion from the beginning.

‍Explore RapidFort’s Hardening Platform

Turn Scanner Output into Verified CVE Elimination

blog

November 14, 2025

Turn Scanner Output into Verified CVE Elimination

See how RapidFort turns scanner output into verified remediation, shrinking attack surface and accelerating FedRAMP, SOC 2, CMMC, and PCI DSS readiness.

No items found.

In today’s software landscape, vulnerability scanning is a foundational security practice. Every team is doing it, or says they are. But here’s the hard truth: traditional scanners may be giving you a false sense of security.

That’s not because they’re broken. They were built for a world that no longer exists.

Today’s world is different:

Containers change daily
Dependencies shift hourly
Third-party packages explode in complexity
CI/CD pushes code continuously

A static scanner simply cannot keep pace with dynamic software.

This article explains why traditional scanners fall short and how RapidFort is redefining vulnerability remediation with a runtime-accurate, automated, and highly effective approach.

Where Traditional Scanners Fall Short

Traditional scanners, including SCA tools, static analyzers, and container image scanners, generally follow a predictable pattern:

Inventory components in your codebase or container image
Match those components to known CVEs from databases such as NVD
Generate long lists of vulnerabilities, often without meaningful context

Useful? Yes. Sufficient? Not anymore. Here are the structural limitations that make traditional scanning incomplete:

1. Static analysis only

Conventional scanners evaluate what is present in an image, not what actually loads or executes at runtime. As a result, they treat every component as equally important, even when large portions of the code are never invoked.

2. Excessive noise

These tools flag every vulnerable package, whether it is used or unused. This results in inflated CVE counts, significant false positives, and dashboards filled with issues that pose little to no real-world risk.

3. No remediation path

Traditional scanners stop at reporting. Teams are left to remediate issues manually, which requires patching, code modifications, or complete image rebuilds. This creates delays in development cycles and contributes to growing patch backlogs.

The consequence

Organizations experience alert fatigue, slow remediation workflows, and persistent compliance challenges, all while struggling to determine which vulnerabilities truly pose a risk.

RapidFort: A Modern, Runtime-Aware Model for Vulnerability Remediation

RapidFort doesn’t replace scanners - it transforms what happens after scanning, using a unified approach built around:

Unified, Context-Aware Scanning

RapidFort combines SCA, image scanning, deep binary inspection, runtime profiling, and behavioral instrumentation to produce a complete, runtime-accurate view of your software.

Execution-Path Awareness

RapidFort identifies which components actually execute, filtering out CVEs tied to unused code paths.

RBOM™ Generation

Unlike static SBOMs, the Runtime Bill of Materials™ lists only the components loaded at runtime. This eliminates noise and aligns findings with real-world behavior.

Less Noise, More Signal

Your teams stop chasing vulnerabilities that live in dead code, unused libraries, or non-executed OS layers. This alone reduces vulnerability overload dramatically.

Prioritized Remediation, Not Just Reporting

RapidFort understands that not all CVEs are equally important. It prioritizes based on:

Runtime execution

Actual component usage

Severity and exploitability

Compliance relevance, FedRAMP, CMMC, SOC 2, HIPAA, PCI DSS

Attack surface impact

Your team's focus on the small subset of vulnerabilities that represent real, exploitable risk, not the hundreds that never execute.

From Vulnerability Lists to Hardened Containers

RapidFort’s automated hardening engine delivers the ability to:

Remove unused or unreachable components, reducing unnecessary code paths and inherited risk
Reduce software attack surface by up to 90% through intelligent, behavior-based optimization
Remediate up to 99.9% of vulnerabilities automatically, without requiring source code modification
Optimize and streamline container images, improving performance and maintainability with no developer intervention

Supported by 35,000+ Curated Near-Zero CVE Images, RapidFort allows teams to begin with hardened, FIPS-validated, STIG and CIS-aligned CVE-free base images rather than inheriting upstream vulnerabilities.

Continuous Monitoring and Runtime Protection

Security does not stop once a container is deployed. Real workloads evolve, usage patterns shift, and new CVEs emerge daily. RapidFort’s Runtime Protection extends security into production environments by providing continuous visibility into how software actually behaves.

With RunTime Protection, organizations gain:

Runtime behavioral baselines, showing how workloads operate under normal conditions
Anomaly and drift detection, surfacing unexpected or unauthorized execution
Alerts tied to real runtime activity, not theoretical vulnerabilities
Cluster-wide monitoring with near-zero overhead, enabling broad visibility without operational impact
Automatic hardening workflows informed by runtime intelligence, helping teams maintain security alignment throughout the software lifecycle

These capabilities ensure that deployed software remains hardened and stays aligned with both security policies and compliance expectations, supported by evidence that matches production reality.

Real Impact: Metrics That Matter

RapidFort’s approach has produced consistent, measurable results across enterprise, public sector, and defense environments:

99.9% reduction in patching backlog
90% reduction in software attack surface
Accelerate FedRAMP, cATO, CMMC, SOC2 compliance readiness
Reduce development costs by more than 10%

ColorTokens Case Study

ColorTokens, a Zero-Trust cybersecurity leader, utilized RapidFort to enhance the security of its containerized platform and expedite federal compliance efforts. By adopting RapidFort’s curated near-zero CVE Images and automated hardening workflows, the team eliminated long-standing patching bottlenecks, reduced its attack surface by 77%, and accelerated readiness for frameworks such as FedRAMP.

RapidFort’s runtime-aware scanning and removal of unused components enabled a significant reduction in vulnerabilities without requiring any code changes. At the same time, continuous benchmarking and STIG-aligned baselines provided the audit evidence needed to advance federal certifications.

With RapidFort, ColorTokens now ships more secure containers at higher velocity - with substantially less engineering effort and greater confidence in compliance-aligned delivery. Read more here.

Final Word: Move Beyond Detection -Achieve Verified Remediation

Scanning tells you what’s wrong.
It doesn’t fix it.
It doesn’t reduce your attack surface.
It doesn’t produce audit-ready evidence.

RapidFort changes the equation by transforming vulnerability data into actual remediation, removing what’s unused, and validating what truly runs - continuously.

If your teams are still triaging spreadsheets of CVEs, you’re carrying unnecessary risk.
Shift to a model where remediation is automated, evidence is continuous, and security keeps pace with delivery.

👉 Browse 35,000+ Curated Near-Zero CVE Images.

👉 Access RapidFort Platform.

‍

RapidFort's Giant Washing Machine: Cleaning Open Source at Scale

blog

November 5, 2025

RapidFort's Giant Washing Machine: Cleaning Open Source at Scale

How RapidFort’s “Giant Washing Machine” cleans open source containers, cuts millions of CVEs, and frees engineers to build faster and safer.

RapidFort Platform

Image Hardening & Optimization

Security chores pile up. Engineers just want to build.

In his Paramify Podcast conversation, RapidFort’s Chief Strategy & Revenue Officer George Manuelian laid out a clear, engineer-first philosophy: take the drudgery out of vulnerability work, prove what’s actually running, and turn compliance from a brake pedal into a by-product of sound engineering.

This article distills George’s discussion, in his words and framing, into the core ideas that guide RapidFort’s approach today.

“It’s not sexy. It’s laundry. It’s the stuff you know you need to do, but you don’t want to. You’d rather outsource it or have a tool do it for you.” - George Manuelian, CRO, RapidFort

Built by Engineers, for Engineers

RapidFort’s origin story begins with a familiar crunch - a major refactor completed in months, then blocked at the finish line by a security review. Patching by hand took quarters. The lesson wasn’t “do less security.” It was “engineer a better way.”

As George put it, the company’s DNA is about helping engineers fix the problem without forcing a false choice between speed and safety.

Key principles he emphasized:

Work with what teams already ship. RapidFort doesn’t need source code to make meaningful progress on risk.
Automate where time is leaking. Let pipelines handle the repetitive parts. Save human effort for architecture and features.
Prove reality, not intent. Map what actually executes and keep evidence current.

The Scale Problem: Vulnerability Debt Outpaces Human Bandwidth

George shared numbers that feel uncomfortably common:

Teams spending about 20% of developer time on tickets, patch hunts, and research.
An enterprise reporting 7,000,000 total vulnerabilities, with 2,000,000 labeled critical.
A security group closing 100,000 CVEs per month while 175,000 new ones arrive.

Then there’s AI. “AI doesn’t sleep,” George said. It can find vulnerabilities in 30 seconds that once took 30 days. Discovery is accelerating, and exploit research is faster than ever. If your process relies on manual triage and one-off fixes, you will fall behind.

The only sustainable posture, George argues, is to start clean and stay clean automatically at every build.

Containers Changed the Patch Playbook

CISOs often ask, “We had golden VM images. What’s different with containers?” George’s answer is blunt:

Volume and Ephemerality: Where you had hundreds of VMs, you now have thousands - even tens of thousands - of containers spinning up and down constantly.
Immutable Reality: You don’t SSH and patch a running container. To fix, you rebuild and redeploy.
Developer Loop: Real remediation happens in the build system. Non-developers can’t hot-patch containers the way they could a VM.

The net effect: remediation belongs in CI/CD, not as a weekend fire drill on live systems.

Open Source at the Core: “The Giant Washing Machine”

George describes RapidFort as a “giant washing machine” for open source:

Respect upstream. Leverage the strength of broad, public scrutiny across Debian, Ubuntu, Red Hat, Alpine, and more.
Patch once, distribute cleanly. Don’t make every team reinvent the same fixes.
Avoid lock-in. Keep bases compatible with upstream to preserve freedom of choice. This is critical for regulated and long-lived systems.

This is not about rewriting the ecosystem from scratch. It’s about cleaning and curating what millions already trust so teams can ship safer software without swapping their foundations.

“Start Clean, Stay Clean”: What That Looks Like in Practice

George’s framing is intentionally simple:

Begin with clean images. If your baseline is full of known CVEs, you’re already behind before the first line of your code compiles.
Continuously rebuild with fixes. Each build cycle should pull in upstream remediations and remove what you don’t need.
Prove what’s really running. Keep accurate inventories and execution-aware records that your auditors and incident responders can use.

The “stay clean” part matters as much as the “start clean.” Vulnerabilities don’t arrive on a schedule. Your process must keep pace by default, not as an emergency ritual.

Hardening Is About Reality, Not Reachability

George cautions against the “reachability” trap - assuming a firewall or network segmentation makes a vulnerability irrelevant.
Attackers jump fences. If they land in a container and find curl, package managers, shells, and unused tools, they have everything they need to move laterally or escalate.

The safer stance is to remove what isn’t mission-critical. Like your phone with 150 apps you don’t use, extra components are just extra risk.

Cadence: Patch at the Speed You Build

“How often should we deploy?” is the wrong question. George flips it to “How often do you build?” Patch on that cadence. Whether you build multiple times per day or monthly, each build should incorporate updates and hardening. That’s how you keep pace without stalls or surprise regressions.

Real-World Results (Framed the Way George Shared Them)

A customer facing roughly 3,582 CVEs estimated six engineers and three months to remediate.
With profiling, clean bases, and removal of unused components, they dropped to fewer than 500 CVEs in about two hours, then to 3 CVEs within a week. Those few weren’t patchable at the time, and there were no source code changes.
Image size shrank from about 1.8 GB to about 262 MB, improving performance and build times.

These outcomes illustrate the compounding effect of starting clean and shipping only what’s needed.

Compliance: Turn Evidence Into a Continuous Output

George is clear - this isn’t about buzzwords or checkbox theater. It’s about evidence that stands up for programs like FedRAMP and CMMC, and for internal risk reviews.

Generate SBOMs and a Runtime Bill of Materials (RBOM™) that reflect what’s actually executing.
Keep proof current at every build so compliance readiness accelerates instead of pausing delivery.
Produce artifacts that map directly to controls and Plans of Action and Milestones (POAMs) or self-attestations - the formats your governance teams need.

Compliance, in George’s view, should ride along with engineering, not work against it.

Why Upstream Alignment Matters (Especially in Regulated Spaces)

Enterprises - particularly public-sector and defense programs - need confidence they can maintain software lifecycles over years without being boxed in.

George underscored that staying true to upstream open source gives teams longevity, flexibility, and a broad community of scrutiny. It also reduces the blast radius if a vendor relationship changes. You’re not forced to rip out foundations to keep operating.

The Road Ahead: Closing the Loop

George’s forward look is about closing the loop between build-time and runtime:

Let runtime observations sharpen build-time decisions.
Push as much remediation as possible into automation so human time goes to design and verification.
Keep the proof flowing for security teams, auditors, and incident response.

As he put it, the aim is simple - give engineers their time back while raising the security floor for everything you ship.

Want to Hear It In George’s Words?

This article captures the conversation’s essence, but the full nuance, stories, numbers, and philosophy are in the Paramify Podcast episode featuring George Manuelian, Chief Strategy & Revenue Officer at RapidFort.

Listen to the full episode here: Paramify Podcast — “Giant Washing Machine of Open Source: Container Security with George Manuelian”

If your team is wrestling with vulnerability debt, patch cadence, or audit evidence, this conversation is a must-listen on building secure software the engineer-first way.

‍

Why SBOMs Fail: RBOM® & Near-Zero CVE Images Fix the Gap

blog

October 27, 2025

Why SBOMs Fail: RBOM® & Near-Zero CVE Images Fix the Gap

A new 2025 study reveals why even “compliant” SBOMs fail to show real risk. Discover how RapidFort’s RBOM® and Curated Near Zero CVE Images turn static compliance into measurable, runtime-verified security.

Software Supply Chain Security

Secure Base Images

Software Bills of Materials (SBOMs) were created to make software transparent. They list every open-source and third-party component inside an application, helping teams track dependencies and assess risk.

Regulations such as Executive Order 14028 in the United States and the EU Cyber Resilience Act require organizations to maintain SBOMs as part of their security and compliance efforts.

However, research in 2025 showed that even when SBOMs meet official standards, they can still produce inconsistent or incomplete results. The reason is that SBOMs describe what is installed - not what is actually running.

The Challenge: Incomplete or Inconsistent Data

Multiple studies in 2025 examined several SBOM generation tools and found significant differences in their output. Each tool followed its own interpretation of SBOM standards, resulting in inconsistent or incomplete data.

Key challenges identified include:

Missing dependencies contain active threats: 4.97% of undisclosed dependencies harbored known vulnerabilities, leaving software exposed to exploits that security teams couldn't detect or patch.
Nearly 1 in 3 SBOMs are incomplete: IBM's 2025 analysis of over 35,000 SBOMs revealed that 7,907 failed to disclose direct dependencies, creating dangerous blind spots in vulnerability management.

Cross-tool incompatibility: Carnegie Mellon's study of 21 different SBOM generation tools found "significant variance" in results, with each tool producing dramatically different component inventories for identical software.
Average of 6+ missing components per SBOM: Non-compliant SBOMs averaged 6.18 missing dependencies each, making accurate risk assessment nearly impossible for security teams.

These problems make it difficult for organizations to depend on SBOM data for real-time security decisions.

The Root Cause: Static Data in a Dynamic World

Containers and microservices change frequently. New images are built every day, and dependency updates happen automatically. Since an SBOM is generated at a single point in time, it quickly becomes outdated. It cannot easily reflect the live state of running software, where most security decisions need to happen.

As a result, teams using SBOMs alone often face a gap between what they document for compliance and what actually exists in their production environments.

RapidFort’s Approach: Turning Visibility into Action

RapidFort addresses this gap by combining software inventory, runtime observation, and automated hardening into one continuous process. Instead of stopping at what is listed, it analyzes what is running, identifies unnecessary components, and safely removes them. This approach helps reduce vulnerabilities and ensures compliance evidence matches real-world conditions.

1. Runtime Bill of Materials (RBOM)

An RBOM extends the idea of an SBOM by showing which components are actively used at runtime. RapidFort’s platform captures runtime behavior to distinguish between code that executes and code that remains idle. This insight allows teams to focus remediation on the components that truly matter while improving consistency across tools.

2. Curated Near Zero CVE Images

RapidFort provides Curated Near Zero CVE Images that serve as secure, optimized base images for containerized workloads. They remove unnecessary packages, apply verified patches, and align with common security benchmarks such as STIG, CIS, and NIST guidance. These curated images are rebuilt regularly to ensure up-to-date compliance integrity.

3. Automated Hardening Pipeline

Using RBOM visibility, the RapidFort platform can automatically detect and remove unused components from applications and containers. This process can remediate a large portion of known vulnerabilities without any changes to application code.

The Result: Verified, Measurable Security

By connecting runtime visibility with automated hardening, RapidFort delivers results that can be measured and proven:

Up to 99.9% of CVEs remediated automatically by identifying and removing unused components - without any changes to source code.
Up to 90% reduction in container attack surface, achieved by eliminating unnecessary packages, binaries, and dependencies.
Continuous alignment with frameworks such as FedRAMP, NIST SP 800-70, STIG, and CIS benchmarks, supported by regularly rebuilt and validated base images.

These outcomes translate into fewer vulnerabilities to patch, faster compliance validation, and stronger runtime assurance across containerized environments.

The Takeaway

SBOMs have advanced transparency across the software supply chain, but visibility alone does not equal security. Modern environments require continuous validation, removal of unnecessary components, and evidence that reflects runtime reality.

RapidFort bridges this gap by connecting SBOM data, runtime insights, and automated hardening into a single, integrated process that transforms information into practical, measurable security improvements.

Build transparency that proves itself. Choose RapidFort.

‍

A Disciplined Approach to Container Supply Chain Security

Whitepaper

September 22, 2026

A Disciplined Approach to Container Supply Chain Security

No items found.

August 10, 2026

Datasheet

RapidFort Runtime

No items found.

RapidFort Runtime

Continuous Threat Elimination for Live Production Environments

Know exactly what is running live in production. Detect what changes. Identify and address new risks before they become incidents. RapidFort Runtime extends software supply chain security beyond build, deployment, and static monitoring into live production environments.

The Runtime Security Gap

Nearly all existing software supply chain security tools stop at deployment. But production environments do not remain static. New CVEs are disclosed hourly, packages are updated, processes change, dependencies are downloaded, and unauthorized modifications can occur after software has passed its original security checks.

Software may become vulnerable immediately after deployment.

Static SBOMs quickly become outdated.

Security and DevOps teams must manually determine whether new CVEs affect production.

Unauthorized package, binary, or behavioral changes can go undetected.

Audit teams lack definitive evidence of what is actually executing.

Key Capabilities

Continuous CVE Monitoring

Dynamic Runtime Bill of Materials

Runtime Tamper Detection

Actionable Mitigation Recommendations

Evidence-Based Runtime Profiling

How RapidFort Runtime Works

Establishes a runtime baseline

RapidFort identifies approved packages, libraries, binaries, processes, and behaviors within the production environment.

Observes actual execution

Lightweight agents use BPF and ptrace technology to capture evidence of what software is truly running.

Generates a dynamic RBOM®

The platform continuously creates an accurate inventory of executing software and runtime dependencies.

Monitors CVEs and environmental changes

RapidFort correlates newly disclosed vulnerabilities with deployed software and detects unexpected changes.

Business Benefits

Reduce Vulnerability Noise

Prioritize vulnerabilities using evidence of actual runtime execution rather than relying solely on static package inventories, SBOM snapshots, or theoretical exposure.

Eliminate Manual CVE Correlation

Continuously correlate new vulnerability disclosures with live production software instead of requiring teams to manually review every new CVE.

Detect Unauthorized Changes

Identify modifications to packages, libraries, processes, and behaviors that could indicate tampering, drift, or compromise.

Improve Audit Readiness

Generate dynamic RBOMs® and verifiable runtime evidence to support compliance, security reviews, and software integrity requirements.

Why RapidFort

End-to-end protection from software intake through live production

Continuous monitoring of newly disclosed CVEs

Dynamic, audit-ready RBOM® generation

Runtime tamper and integrity monitoring

Reduced false positives and vulnerability noise

No code changes or proprietary platform migration required

"Maintaining an accurate, real-time inventory of what is actually executing in production has been a consistent audit and compliance hurdle. RapidFort Runtime's ability to generate a precise, dynamic RBOM® provides us with undeniable evidence of our software's state. We can now verify integrity and confirm our compliance in real time, which is a total game-changer for our security operations."

See RapidFort Runtime in Action

Up to 99.9% reduction in CVE exposure with RapidFort-hardened software. Request a Demo at RapidFort.com.

‍

Strengthening Software Security Posture for Defense Missions with RapidFort

October 27, 2025

Case Study

Strengthening Software Security Posture for Defense Missions with RapidFort

Compliance & Governance

RapidFort Platform

case study

Strengthening Software Security Posture for Defense Missions with RapidFort

Industry

Defense Software & Mission Systems

Challenge

Harden containers at scale without delaying delivery to defense customers

Solution

RapidFort Platform and Curated Near Zero CVE Images

The Challenge

Defense Unicorns delivers software for defense missions often in classified environments where security is non-negotiable. As a veteran-founded company, its team has personally experienced the burden of outdated software in the DoD and is committed to building solutions that enable modern, secure software delivery. While building their secure runtime platform, Unicorn Delivery Service (UDS), the team encountered several critical hurdles.

Complex Hardening at Scale

Hardening containers at scale was complex and labor-intensive.

Delivery Delays

Internal security processes would delay delivery to defense customers.

Balancing Security and Speed

Achieving a strong security baseline without slowing down mission readiness required a new approach.

The Solution

Defense Unicorns conducted a thorough build-versus-buy evaluation and determined that partnering with RapidFort offered the most effective path to delivering mission value at the speed required. The company licensed RapidFort Curated Images to secure UDS and other internal environments. These images enabled the team to achieve a near-zero CVE state across the platform providing flexibility for both open-source and custom-built tools.

To further strengthen security and streamline operations, Defense Unicorns leveraged several key capabilities of the RapidFort Platform:

Container Hardening for Proprietary Tools

Defense Unicorns used the RapidFort Platform to harden containers for proprietary products such as UDS Registry, an OCI-compliant registry launched in June 2025.

FIPS Validated Modules

RapidFort delivered FIPS- validated modules for all 32 UDS Core images, supporting deployment into compliance-sensitive environments.

Optimized Image Sizes

Smaller image sizes, reduced by 140 MB total (5.9%), enabled faster deployments in both low-bandwidth and tactical-edge environments.

Collaborative Partnership

The collaborative nature of the partnership played a key role especially when engineers required new FIPS-compliant images or encountered issues with existing builds.

Results

By working with RapidFort, Defense Unicorns achieved the following results:

Accelerate Delivery

of a near-zero CVE UDS platform without building in-house hardening pipelines

Optimize Deployment

by reducing UDS Core image sizes by a total of 140 MB (across 32 images)

Strengthen Compliance Posture

by embedding FIPS-validated modules across their curated images

Collaborate Effectively

on security improvements through responsive engineering support

Conclusion

Defense Unicorns selected RapidFort to support its mission of delivering secure, reliable software. With RapidFort Curated Images and a flexible hardening platform, they enhanced their container security posture while maintaining the speed and agility required in defense operations. The partnership continues to be shaped by shared values, responsiveness, and an understanding of the unique demands of delivering national security software.

Continuously Eliminate Up to 99.9% of CVEs Without Code Changes

Request a Access

‍

The Modern Data Company Enhances and Accelerates Data Security with RapidFort

October 27, 2025

Case Study

The Modern Data Company Enhances and Accelerates Data Security with RapidFort

Software Supply Chain Security

case study

The Modern Data Company Enhances and Accelerates Data Security with RapidFort

Industry

Technology Data Platform

Challenge

Enhance data security and ensure compliance

Solution

RapidFort Platform and Curated Near Zero CVE Images

The Challenge

The Modern Data Company, a fast-growing data platform, provides customers with a data operating system to scale business transformation and AI. As customer adoption expanded, Modern faced three primary challenges:

Vulnerability Risk

Container images are often shipped with unnecessary packages and open vulnerabilities, increasing exposure.

Compliance Pressure

Meeting requirements such as FedRAMP, CMMC, and SOC 2 requires more rigorous vulnerability management.

Time-to-Deployment

Security bottlenecks slowed down development and delivery, affecting speed-to-market.

The Solution

Modern needed a security solution that would enhance customer trust while accelerating secure deployments, and selected the RapidFort Platform and Curated Near Zero CVE Images to transform its software delivery approach.

Curated Near Zero CVE Images

TMDC adopted RapidFort's continuously optimized container images, reducing vulnerabilities by removing unnecessary components.

RapidFort Platform

Provided automated vulnerability management, real-time remediation insights, and compliance alignment.

Secure-by-Default Deployments

Security was embedded from the start, reducing the need for late-stage patching and rework.

Results

By integrating RapidFort into its workflow, Modern achieved measurable improvements:

80% Fewer Vulnerabilities

in containerized environments through curated images

Accelerated Compliance

with FedRAMP and CMMC by automating vulnerability management and reporting

50% Faster Deployments

as security bottlenecks were reduced, enabling development teams to ship quickly and securely

Increased Customer Trust

through a demonstrably stronger security posture

Conclusion

Modern’s partnership with RapidFort has enhanced and accelerated its ability to provide secure, compliant, and reliable customer data solutions. By leveraging RapidFort’s curated images and platform, Modern reduced vulnerabilities, accelerated compliance, and improved its overall resilience - allowing the company to deliver innovation with confidence.

Eliminate Attack Vectors At The Source

Continuously Eliminate Up to 99.9% of CVEs Without Code Changes

Request a Access

‍

Qanapi Accelerates FedRAMP High Readiness with RapidFort

October 27, 2025

Case Study

Qanapi Accelerates FedRAMP High Readiness with RapidFort

Compliance & Governance

Software Supply Chain Security

case study

Qanapi Accelerates FedRAMP High Readiness with RapidFort

Industry

Technology Data Security

Challenge

Achieve FedRAMP High compliance on an aggressive timeline, reduce vulnerability noise, and secure container images without slowing development

Solution

RapidFort Platform and Curated Near Zero CVE Images

The Challenge

Qanapi, a data-security API platform, was on an accelerated path to achieve FedRAMP High compliance for its regulated customers. The organization needed to meet rigorous CIS/STIG alignment requirements while maintaining operational speed and engineering focus. Qanapi faced three primary challenges:

Complex Vulnerability Backlog

The existing container stack carried a large, noisy vulnerability load, and detect-only tools surfaced issues but did not meaningfully reduce the attack surface.

Aggressive Compliance Timeline

The organization needed to reach FedRAMP High readiness quickly to meet customer and regulatory commitments.

Operational Efficiency

Building and maintaining a compliant “gold build” internally would have taken months and diverted scarce engineering resources.

The Solution

To efficiently meet its compliance and security goals, Qanapi turned to the RapidFort Platform and Curated Near Zero CVE Images, enabling accelerated FedRAMP High readiness, stronger container security, and uninterrupted delivery.

To further strengthen security and streamline operations, Defense Unicorns leveraged several key capabilities of the RapidFort Platform:

Curated Near Zero CVE Images

RapidFort provided pre-hardened, benchmarked images with built-in CIS/STIG alignment, enabling Qanapi to start from a clean, compliant foundation rather than hardening vulnerable base layers.

Runtime Aware Hardening with RBOM

RapidFort’s runtime-aware engine continuously filtered out non-reachable CVEs and stripped unused components from running containers, dramatically reducing noise and remediation workload.

Supply-Chain Assurance

The platform provided signed, provenance-tracked, and SLSA-aligned builds with non-root and distroless options, ensuring integrity and trust across the software supply chain.

Seamless Integration

With straightforward CI/CD integration, Qanapi embedded security directly into its pipelines, achieving continuous hardening and compliance alignment with minimal friction.

Results

By integrating RapidFort into its workflow, Qanapi achieved measurable improvements:

Reduced Attack Surface

of a near-zero CVE UDS platform without building in-house hardening pipelines

Accelerated FedRAMP High
Readiness

by months compared to manual gold-image processes

Lower Compliance Overhead

as RapidFort automatically filtered out non-actionable CVEs, streamlining triage and reporting

Maintained Developer Velocity

by embedding security directly into the CI/CD pipeline, enabling rapid, compliant delivery

Conclusion

Qanapi’s collaboration with RapidFort enabled the company to achieve FedRAMP High readiness faster and with greater operational efficiency. By leveraging Curated Near Zero CVE images, runtime-aware hardening, and supply-chain assurance, Qanapi strengthened its container security posture and sustained developer agility, demonstrating that compliance readiness and innovation can advance together.

Eliminate Attack Vectors At The Source

Continuously Eliminate Up to 99.9% of CVEs Without Code Changes

Request a Access

‍

November 23, 2024

Case Study

The State of Container Security

Container Security

case study

The State of
Container Security

OSS Vulnerability Management, Containerization, and Shift Left:
Insights from RapidFort Comprehensive Survey

Containerization is on the rise in the software industry, but this shift has come with increased security risks. RapidFort surveyed organizations to understand their container security practices and secure application delivery. In this document, we have analyzed the results, and have provided our own recommendations for containerization.

Foreword

Today's software environments present significant risks to organizations, with 50% to 90% of software going unused, yet still continuously maintained and open to security threats. Most of this risk comes from vulnerabilities present in open source software, which represent the bulk of modern applications and must be managed differently from in-house or vendor software.

Unfortunately, the scanning solutions in today's market offer limited effective prioritization methods beyond identifying vulnerabilities by category, leaving security teams overwhelmed and needing practical tools to manage the risk associated with software vulnerabilities.

At RapidFort, we have developed the industry's first Software Attack Surface Management platform to help organizations understand and harden their software infrastructure. Our SASM platform allows security teams to observe and manage software components, making informed decisions about their risk management strategies. By choosing RapidFort, organizations can proactively manage their software infrastructure and reduce the risk of data breaches and other cyber attacks.

We hope you consider these insights and findings as you build your vulnerability management strategies.

Introduction

In recent years, the software industry has been shifting away from traditional virtual machines and embracing containerization. Containerized applications offer significant advantages, such as efficient resource utilization, flexibility, and scalability. Containers are a lightweight, efficient option for software development and deployment, and often contain a substantial amount of free, open source software (OSS).

The rise in OSS usage and containerized workloads has yielded a complex software attack surface, presenting a seemingly insurmountable challenge for security teams to manage risk. There are many OSS vulnerabilities that security teams must assess, prioritize, and address continuously with limited resources. In addition, DevOps adoption is exacerbating this problem as the software is rapidly changing.

As a result, security teams face the difficult task of reducing significant risks for their organizations, while needing clarity and the proper tooling to do so effectively. It has become critical for many organizations to prioritize container security and implement modern vulnerability management practices with efficacy.

Different ideas exist on how to approach container security, including when to implement security measures during software development and who should oversee them.

As a modern cybersecurity company, RapidFort sought to gain insights into the current state of container security and vulnerability management practices. We surveyed industry professionals to learn about how organizations handle the shift towards containerization and what steps they take to ensure their applications are delivered and deployed securely and efficiently.

Methodology:

100

IT professionals surveyed

91%

aged 25–44

55/45

male / female split

Key Findings

Companies operate within a mixed environment:

While the mean percentage of containerized workloads in the respondents' organizations is nearly 40%, more than a third of applications run on VMs, and over 30% classify as serverless.

Security and dev teams share vulnerability ownership:

43% of respondents said developers and security personnel own vulnerability management in their companies.

Broad adoption of open source software:

75% of respondents reported that at least half of their software is open source. As most containers have open source software, this can be a factor in the high open source utilization, and a potential flashpoint for security concerns.

CVE Management takes up a significant amount of company time:

73% of people said that their organizations spend between 11 and 30 hours each week remediating each prioritized CVE.

Challenges and Expectations

The responses garnered from the survey are an informative look into the state of container security while providing valuable insights into related issues, such as CVE remediation, the "Shift Left" approach, and the delegation of vulnerability management.

Container Security: Three main issues

Respondents frequently mentioned three challenges that they face in securing containers, applications, and workloads:

Implementation:

With many organizations still running a large portion of their applications running on VMs, it is reasonable to expect container adoption to be challenging, as VM-to-container migration is rewarding but complex. Proper developer and security tooling are integral to aiding this migration.

Vulnerability Remediation:

Vulnerability monitoring and remediation present unique challenges to organizations. Respondents use several methods to gain visibility into software vulnerabilities, including SCA (Software Composition Analysis), SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), and IAST (Interactive Application Security Testing). SAST — which allows for automation, efficient results, and early detection — proved to be the most popular answer, with 49% of respondents reporting this as the method their companies utilize to gain an understanding of their security posture.

Automation:

Automation encompasses the scheduling, resource allocation, and scanning of containers, and it was identified as the most prominent issue among the respondents. While cited as a critical issue, automation is the primary solution to problems related to human-based container monitoring. As the number of containers an organization uses increases, the need for automation becomes ever more significant to ensure each container functions well without the additional resource drain of human oversight.

Security Practices and CVE Remediation

In understanding what security issues and vulnerabilities respondents deal with, it is essential to know how they deal with these issues, including how they are prioritized, at what stage in SDLC, who is responsible for vulnerabilities, and how much time is spent on these issues.

Shift Left Adoption

69% of respondents scan during or after the testing phase, aligned with Shift Left best practices.

CVE Time Drain

73% of organizations spend 11–30 hours per week on remediating each prioritized CVE.

CVE Prioritization

With so many potential pain points in container security and CVE remediation incurring a significant resource drain for security teams, prioritization of vulnerabilities is crucial for any organization that utilizes containers. The respondents listed several ways their organizations prioritize CVEs, including the value of the impacted asset, the CVSS (Common Vulnerability Scoring System, an industry standard for assessing vulnerabilities), and custom risk scoring exclusive to each respondent's respective company. Tellingly, the most widely mentioned method (utilized by 60% of respondents) was threat intelligence, indicating that companies prioritize CVE remediation around the potential harm that can arise from these vulnerabilities being exploited.

When Vulnerabilities are Scanned and Remediated: Shift Left Adoption

Scanning during testing is in line with best practices for application security. It is reassuring that 69% of respondents reported that their companies scan their applications for vulnerabilities during or after a defined "testing phase" of the software development lifecycle. In addition, 66% of respondents reported that testing is also conducted when CVEs are remediated.

What is more interesting may be that companies also opted to scan and remediate vulnerabilities during development or deployment at equal rates. Scanning and remediation associated with the earlier stages of the software development lifecycle are consistent with the "Shift Left" approach, which seeks to deal with software issues as early as possible. Shift Left aims for testing done early and often to identify and curb potential vulnerabilities before remediation becomes more expensive at later stages.

Shift Left Best Practice

Organizations that implement Shift Left methodology identify vulnerabilities earlier, when fixes cost significantly less. RapidFort SASM platform makes this transition seamless and cost effective.

While RapidFort is a proponent of the Shift Left approach, we understand the issues associated with its effectiveness and the considerable effort and resources needed for successful implementation. RapidFort is committed to helping companies Shift Left without adding more work or resource drain to development teams, but we also understand why many companies are not yet able to fully commit to Shift Left.

The owning of vulnerability management

The survey suggests that many companies view vulnerability management as a shared responsibility, with nearly half (43%) of the respondents stating that a mix of security professionals and developers own vulnerability management at their companies. RapidFort is a strong believer in a hybrid approach to vulnerability management, so it is gratifying to see this approach of shared accountability being adopted by respondents' organizations.

Hours Spent on CVE Remediation: A Time Drain

An illuminating result from this survey was how much time companies spend remediating CVEs, which highlights the drain these vulnerabilities can have on an organization's time and resources, and how important time-saving security tools can be to alleviate these issues.

44%

spend over 21 hours/week on each CVE remediation

80%

vulnerability reduction with RapidFort SASM platform

44% of respondents reported their companies spend over 21 hours a week on remediating each CVE, while only 10% reported that their employers spend 10 hours a week or less on these issues. For companies with a frequent release cadence and limited bandwidth, spending 3 or more hours a day on individual CVE remediation is a costly use of time. Ensuring the proper security resources are employed (such as RapidFort SASM platform, which can identify and remove roughly 80% of vulnerabilities in the execution path) to mitigate this time spent should be an essential priority for any applicable organization.

Strategies for Improving Container Security

To address the challenges spanning container security and CVE remediation, RapidFort recommends implementing a "Shift Left" approach to vulnerability management where security is integrated early in the software development life cycle. This approach enables organizations to identify and remediate vulnerabilities early, reducing the risk of attacks, minimizing the impact on production environments, and saving substantial resources in the aggregate. Our SASM platform provides an instant reduction in attack surface by 60–90%, and makes the transition to a Shift Left approach as seamless and cost effective as possible.

Additionally, RapidFort recommends an increased focus on automation. While cited as the biggest hardship when it comes to container security, using CI/CD pipelines to automatically scan and remediate those vulnerabilities in the SDLC can significantly reduce the time spent on vulnerability management, allowing teams to focus on other critical tasks.

Moreover, RapidFort recommends implementing a hybrid ownership model for vulnerability management, where both security and development teams are involved. This ensures that vulnerabilities are identified and remediated promptly reducing the risk of complications while also creating a culture of shared accountability and responsibility throughout an organization.

Strategy Impact

Shift Left Integrate security early in SDLC60–90% attack surface reduction

Automation CI/CD pipeline scanning & remediationReduces manual overhead significantly

Hybrid Ownership Shared dev + security accountabilityFaster identification & remediation

SASM Platform Software Attack Surface Management~80% vulnerability path reduction

Conclusion

The survey results provide an enlightening look into the challenges associated with container security and vulnerability management. As containerization continues to grow in popularity, the need for effective security practices becomes even more critical. Faced with a plethora of potential security issues and vulnerabilities, security teams are tasked with discerning what is most important, and how best to proceed.

Organizations must address the challenges outlined in the survey including the need to manage third-party CVEs, prioritize remediation efforts, and ensure visibility into containers and workloads to ensure their systems and data remain secure.

At RapidFort, we provide organizations with the solutions to remediate these problems. With proprietary tools such as our SASM platform, we can empower your organization to commit to container automation, a hybrid ownership of vulnerability management, and a Shift Left approach to software testing, without severely draining security bandwidth or pulling your teams away from more important work. By adopting these best practices, organizations can tackle container security without overwhelming their security teams or depleting their resources.

About us

At RapidFort, we are committed to helping organizations address their container security and vulnerability management needs. As a cloud-native cybersecurity company specializing in container security, we understand the unique challenges of securing modern software environments and offer innovative solutions to help our clients protect their software infrastructure. We hope that the insights provided by this survey will help organizations better understand the challenges they face and take steps to address them.

Visit our website to learn more.

SASM Platform

Software Attack Surface Management for complete visibility

Shift Left Ready

Seamlessly integrate security into your SDLC from day one

Hybrid Ownership

Enable shared security accountability across dev and sec teams

60-90% Reduction

Instant attack surface reduction with automated remediation

Eliminate Attack Vectors At The Source

Continuously Eliminate Up to 99.9% of CVEs Without Code Changes

Request Access

August 27, 2024

Datasheet

RapidFort Curated Images

RapidFort offers a unified platform for software attack surface management with near-zero CVE images, DevTime and RunTime protection, vulnerability remediation, and FedRAMP compliance tools to simplify security, accelerate software delivery, and reduce costs.

No items found.

RapidFort
Curated Images

Start secure. Stay secure. With no code changes

Production grade, Near-Zero CVE container images built on the LTS distributions
you already use. Replace your base images and eliminate inherited vulnerabilities
before development even begins

Up to

99.9%

of CVEs eliminated,
continuously

Up to

90%

smaller software
attack surface

35K+

Near-Zero CVE images,
ready to pull

A trusted stack, ready to deploy

Browse 35,000+ curated images across Ubuntu, Debian, Red Hat, and Alpine. Hardened to NIST 800-70. FIPS
140-2 and 140-3 validated. STIG and CIS benchmarked.

NIST 800-70

FIPS 140-3

Most vulnerabilities are inherited, not written

Your applications inherit thousands of vulnerabilities from base images and open source before a single line of code
is written. Most tools only detect and rank that risk, leaving your team to chase it forever. RapidFort removes it at the
source, so you ship from a clean foundation instead of cleaning up later.

Deliver fast. Reduce risk. Stay secure.

Continuous protection. Zero code changes required.

Why teams choose
RapidFort Curated Images

Drop in, no hassle

Plug-and-play replacements that slide right into your stack.

Runs everywhere

Supports all major LTS distros and
versions, even the minor releases.

Scanner friendly

Rich metadata built in, compatible with every major scanner.

No vendor lock-in

Open, independent, and registry flexible. RapidFort's registry or your own.

Secure by default

FIPS validated crypto and a hardened, STIG compliant OS out of the box.

Always up to date

Critical CVEs fixed in 7 days, everything else in 14.

Compliance ready

FedRAMP and major frameworks
supported from day one.

White glove support

Dedicated customer success and hands-on implementation help.

Built for regulated and
mission-critical environments

Hardened to NIST 800-70. FIPS 140-2 and 140-3 validated. STIG and CIS
benchmarked. DoD trusted, Iron Bank approved, and DISA validated.

Accelerates FedRAMP, cATO, CMMC, SOC 2, NIS 2, CRA, and SLSA readiness.

FIPS 140-3

FIPS 140-2 FI

FIPS 140-3

STIG

CIS

FedRAMP

cATO

PCI DSS

CMMC

SOC 2

NIS 2

CRA

SLSA

DoD

Iron Bank

DISA

How RapidFort Curated Images compare

This is some text inside of a div block.

RapidFort

The alternatives

Catalog

35,000+ images, including olderversions, continuously patched

Limited catalogs, often latestversions only

CVE elimination

Up to 99.9%, across distroless andfull images

45% to 65%, often distrolessonly

Operating system

Trusted LTS distros, no lock-in

Proprietary or trademarkrestricted variants

Compliance

FIPS 140-3, STIG, FedRAMP,CMMC, SOC 2, SLSA

Limited or no formalbenchmarks

Government validation

DoD trusted, Iron Bank, DISAvalidated

None

Tooling

Full SASM platform: scan, profile,harden, benchmark, build

Fragmented, no integratedhardening

Put Curated Images to
work in three steps

Develop

Pull a Near-Zero CVE image as your base. It drops into your existing CI/CD pipeline, pin for pin compatible, with no re-baselining.

Build

Run the RapidFort platform across your registries and clusters to scan continuously, track CVE drift, generate SBOMs, and prioritize real risk.

Comply

Harden to NIST 800-70, validate to FIPS, and auto-generate audit evidence. Reach compliance up to 30% faster and cut roughly 3 months off certification.

Part of one platform that secures
the entire software lifecycle

RapidFort secures the software supply chain from source to runtime, continuously and without code changes.
Curated Images secure what enters your pipeline. The rest of the platform keeps it secure all the way to production.

SOURCE

BUILD

RUNTIME

Secure the source

RapidFort Curated Images deliver Near-Zero CVE base images. RapidFort Curated Libraries deliver malware scanned, pin for pin open source packages that stop supply chain attacks before the pipeline.

Understand the risk

RapidFort Analyzer finds real, validated risk across images, registries, and clusters, and cuts up to 25% of scanner noise. RapidFort Profiler shows what actually runs in production and generates an RBOM® to separate real risk from theoretical risk.

Harden and prove it

RapidFort Optimizer continuously removes unused components and rebuilds hardened, minimal images. RapidFort CART validates compliance continuously and produces audit-ready reports.

“By leveraging the RapidFort platform, our organization halved our FedRAMP
certification costs and reduced time to compliance by a full three months.”

WORKS WITH

AWS

Google Cloud

Microsoft

Carahsoft

Jira

Jenkins

GitLab

Slack

Harness

CircleCI

Splunk

Sumo Logic

Aqua

Prisma

Twistlock

Snyk

Nessus

CrowdStrike

Eliminate attack vectors at the source

‍

August 21, 2024

Datasheet

RapidFort Platform

The End-to-End Platform That Eliminates Software Supply Chain Risk

Named in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security
Nutanix .Next Partner of the Year, 2026

Up to 99.9%

CVE Elimination

No code changes. No OS changes. No pipeline modifications.

Up to 90%

Attack Surface Reduction

Shrink your attack surface by removing software you never use.

The Reality of Software Supply Chain Risk

85%

of enterprise software is open source

Most of your risk was written by someone else.

10 hrs

from vulnerability disclosure to active exploit

Down from 24 months a decade ago. Your team still takes weeks.

235,000+

CVEs with known fixes, still unpatched

Across 2016 to 2025. Patching cannot keep pace with the volume.

The industry is solving the wrong problem.

Traditional tools detect and rank vulnerabilities. They do not remove them. Risk stays in your stack indefinitely.
RapidFort eliminates attack vectors at the source, before they reach production.

How it Works

Eliminate at the source

Start with RapidFort Curated Images and RapidFort Curated Libraries to remove attack vectors before they enter your software supply chain.

Continuously reduce risk

RapidFort Analyzer creates an SBOM. RapidFort Profiler generates an RBOM® showing what actually runs. RapidFort Optimizer removes unused components to reduce CVEs and attack surface without code changes

Protect, govern, and prove

RapidFort continuously monitors and protects deployed environments, while RapidFort CART compiles security benchmarks into audit-ready evidence for ATO, NIST, FedRAMP, CMMC, and more.

INTAKE‍Eliminate attack vectors

BUILD‍Analyze, profile, optimize

RUNTIME‍Protect, govern, prove

Platform Capabilities

Curated Images

Start with a secure foundation. Near-zero CVEs from day one.

35,000+ near-zero CVE images, continuously patched and production-ready

FIPS 140-2/3, STIG, CIS, NIST 800-70 hardened. Drop-in replacements.

Ubuntu, Debian, Red Hat, Alpine. No vendor lock-in.

Curated Libraries

Most supply chain attacks enter through open-source dependencies. Stop them here.

Malware-scanned packages for npm, PyPI, and more

Pin-for-pin compatible, zero workflow changes required

Covers the ecosystems most targeted in enterprise and AI workloads

RapidFort Analyzer

Cut through scanner noise. Know exactly which CVEs actually apply.

Validates CVE applicability: not just what is installed, but what is real

Exploit-aware Rapid Risk Score for focused, actionable prioritization

SBOM export in SPDX, CycloneDX, JSON, and CSV

RapidFort Optimizer

Remove every component your application never uses.

Up to 99.9% CVE elimination from unused code paths

Up to 90% attack surface reduction via RBOM®-validated hardening

Hardened images automatically rebuilt every 24 hours, drop-in ready

RapidFort Profiler

Start with a secure foundation. Near-zero CVEs from day one.

Generates RBOM®, RapidFort's proprietary Runtime Bill of Materials

Separates real exploitable risk from theoretical CVE noise

Under 1% overhead. No code changes. No disruption.

RapidFort CART

Start with a secure foundation. Near-zero CVEs from day one.

US: FedRAMP, CMMC, cATO, DISA STIG, FIPS, NIST 800-53, NIST 800-190, SOC 2, PCI DSS

EU: NIS 2, CRA, SLSA. Validated via the OpenSCAP framework.

Drift detected immediately. Audit-ready reports and remediation scripts auto-generated.

Why RapidFort

Eliminates, not detects

CVEs are removed from your stack, not added to a backlog.

No code changes. Ever.

Hardening works entirely outside your application code.

Ships faster, stays secure

Cut development costs by over 10%. Speed releases by weeks, not months.

End-to-end, one platform

CVEs are removed from your stack, not added to a backlog.

Compliance built in

FedRAMP, CMMC, NIS 2, CRA, SOC 2, PCI DSS, FIPS, STIG, CIS.

Government validated

DoD Trusted. Iron Bank Approved. DISA Validated. Mission-critical ready.

RapidFort Vs Everything Else

Capability

RapidFort Platform

Traditional Alternatives

CVE Outcome

Up to 99.9% eliminated. Continuously.

Detected and prioritized. Your team still patches.

Secure Source

35,000+ near-zero CVE images, ready to drop in.

Scanning only. You inherit whatever the base has.

Attack Surface

Up to 90% reduction via RBOM®-validated hardening.

Static scanning. Nothing is removed.

Runtime Visibility

RBOM® shows what actually executes in production.

SBOM only. No runtime context.

Compliance

FedRAMP, CMMC, NIS 2, CRA, PCI DSS, FIPS, STIG, SLSA.

Point-in-time audits. Manual evidence collection.

Lifecycle

Intake to runtime. One platform. No gaps.

Fragmented tools. Isolated stages.

Proven in Production

“By leveraging the RapidFort platform, our organization halved our FedRAMP
certification costs and reduced time to compliance by a full three months.”

FedRAMP

CMMC

cATO

NIS 2

CRA

FedRAMP

PCI DSS

SOC 2

SLSA

FIPS 140-2/3

DISA STIG

CIS

NIST 800-53

NIST 800-190

DoD Trusted

DISA Validated

Works with your existing stack:

AWS

Google Cloud

Microsoft Azure

Carahsoft

GitHub

GitLab

Jenkins

Harness

CircleCI

Jira

Splunk

Sumo Logic

Aqua

Prisma

Twistlock

Snyk

Nessus

CrowdStrike

About RapidFort

RapidFort is the leader in Software Supply Chain Security, enabling organizations to eliminate risk across their software stack at scale. Its platform combines curated near-zero CVE container images, aged application libraries, malware removal threat intelligence, runtime profiling, and attack surface management to remove up to 99.9% of vulnerabilities within hours and reduce the attack surface by up to 90% without code changes.

‍

November 27, 2023

Case Study

The Future of Container Security

Container Security

Software Supply Chain Security

case study

The Future of
Container Security

How RapidFort Scanner Outperforms Industry Leaders

Executive Summary

In recent years, Software Attack Surface Management (SASM) has become a critical focus for organizations striving to maintain robust security postures. As the foundational step in developing a successful software security program, vulnerability scanning provides essential clarity by identifying potential weaknesses within software systems, allowing proactive remediation to mitigate risk. This is why accurate scanning is crucial, showcasing true risks that need remediation and thus fortifying an organization's defensive posture.

While various techniques exist for scanning software, such as internal and external scanning or compliance scanning, RapidFort stands out by employing a combination of patented mechanisms to achieve unparalleled reliability and accuracy. This cutting-edge approach not only provides the most dependable results but also empowers customers to consolidate multiple scanners into one, significantly reducing compute requirements and eliminating false positives.

This case study presents a comparative analysis of RapidFort against three industry-leading scanners, as per DoD customer requirements. The study involved a rigorous 20-container test designed to evaluate the performance and accuracy of each scanner. Key findings from the study reveal that RapidFort outperforms all three competitors, demonstrating superior accuracy and reliability in vulnerability detection.

As we delve deeper into the study's methodology and comparative analysis, it becomes evident that RapidFort's innovative approach to vulnerability scanning sets a new standard. Embrace the power of precision, consolidate your scanning needs, and take a proactive stance against potential threats the future of security starts with RapidFort.

Study Highlights:

RapidFort delivered the most accurate results in the study, successfully detecting all known vulnerabilities without introducing false positives or false negatives.

The other three scanners exhibited varying levels of detection accuracy, with some missing critical vulnerabilities and others generating false positives that could lead to unnecessary remediation efforts.

These findings underscore the importance of precision in vulnerability scanning minimizing both false positives and false negatives is essential to maintaining an effective and efficient security posture.

Introduction

Software and applications are the lifeblood of modern organizations, but in recent years, the industry has shifted away from traditional virtual machines to embrace containerization. The Application Container Market and Containers as a Service (CaaS) Market are both projected to grow at compound annual growth rates of over 30% in the next five years, reflecting the widespread adoption of container technology across both public and private sectors.

This rapid adoption underscores the urgent need for robust security measures tailored to containerized environments. Research indicates that 50% to 90% of software within production environments remains unused. These dormant components frequently include known vulnerabilities providing bad actors with opportunities to exploit systems, exfiltrate data, or gain persistent access while remaining undetected.

In this context, vulnerability scanning plays a critical role. Scanners must not only detect a wide range of vulnerabilities, but also deliver precision identifying real threats while minimizing noise from false positives and missed detections. As organizations strive to meet compliance standards, adopt DevSecOps practices, and manage growing software supply chains, the effectiveness of these scanners becomes central to maintaining security posture.

This study was designed to evaluate the performance of RapidFort's vulnerability scanner against three industry leaders as per DOD requirements. With a methodology aligned to real-world use cases including container images drawn from popular open-source registries and a range of operating systems the goal was to measure detection fidelity across consistent baselines. By providing clarity on scanner performance in terms of both breadth (number of tests passed) and depth (accuracy within those tests), this report enables security professionals to make informed, data-driven decisions about their vulnerability management strategies.

Methodology

To effectively evaluate RapidFort's vulnerability scanner performance against three industry-leading competitors, extensive testing was conducted across 20 container images encompassing a diverse range of programming languages and operating systems. This structured approach was designed to ensure a balanced, real-world, and comprehensive assessment of each scanner's detection capabilities across varied technical environments.

Study Design

In our methodology, the diversity and range of programming languages and operating systems used mirrored real-world containerized applications. By incorporating this variety, we ensured the study provided a holistic evaluation of each scanner's performance across different technical landscapes.

The selection of container images was meticulously curated to represent commonly used and high-value containers in both government and commercial sectors. This included popular open-source images favored by developers, ensuring that the tests were both relevant and reflective of typical usage scenarios.

Scoring System

To objectively compare scanner performance, we implemented a robust scoring system. Each test (container image) contained a set of predefined vulnerabilities, which served as the Ground Truth (GT). The scanners were tasked with identifying these vulnerabilities, and their results were then compared against the GT. Points were awarded based on correct matches to the GT. Specifically:

A scanner received one point for each correctly identified vulnerability.

No points were awarded for incorrect or missed vulnerabilities.

Given that each test varied in the number of embedded vulnerabilities, it was essential to normalize the scoring to ensure fairness. We achieved this by calculating both the number of tests correctly scored and the total number of vulnerabilities accurately identified. This dual-metric approach provided a comprehensive view of each scanner's performance, accounting for both breadth (number of tests) and depth (number of vulnerabilities).

Summary of Results

100%

Overall accuracy rate

SCANNER A

74%

SCANNER B

86%

SCANNER C

51%

The results of our comparative study reveal significant differences in the performance of the three vulnerability scanners. RapidFort consistently outperformed all three competitors, demonstrating superior accuracy and reliability in vulnerability detection.

Performance Metrics

Our evaluation showed that RapidFort scored better than Scanner A in all 20 tests, outperformed Scanner B in 19 tests, and surpassed Scanner C in all 20 tests. The overall accuracy rates were as follows:

RapidFort:

100%

Scanner A:

74%

Scanner B:

86%

Scanner C:

51%

Implications of Findings

The high accuracy rate achieved by RapidFort has significant implications for vulnerability detection and overall security posture. In the context of vulnerability scanning, accuracy is paramount it ensures that true risks are identified and addressed while minimizing the operational noise caused by false positives and reducing exposure from undetected vulnerabilities due to false negatives.

Reduction of False Positives:

High accuracy in vulnerability detection reduces the number of false positives incorrect identifications of vulnerabilities that do not actually exist. These inaccuracies can overwhelm security teams, wasting valuable time and diverting attention from genuine threats. In fact, 44% of organizations report spending over 21 hours per week remediating CVEs.

By minimizing false positives, RapidFort enables security teams to focus on real, actionable issues, improving both the efficiency and effectiveness of vulnerability management workflows.

Reduction of False Negatives:

Equally important is minimizing false negatives, which occur when actual vulnerabilities go undetected. These pose a serious risk, as they leave critical issues unaddressed potentially exposing organizations to exploitation.

RapidFort's superior detection accuracy significantly reduces false negatives, ensuring that fewer vulnerabilities are overlooked. This enhances the overall security posture of containerized applications and helps safeguard production environments from undetected threats.

In summary, the results of our study clearly demonstrate that RapidFort sets a new standard for vulnerability scanning within containerized environments. Its superior accuracy and reliability make it an invaluable tool for organizations seeking to strengthen their security posture and protect containerized workloads against evolving threats.

Why You Should Run with RapidFort

The findings from our study not only underscore RapidFort's superior performance but also highlight the distinct strengths that enable it to excel in vulnerability detection. These strengths rooted in advanced technology and comprehensive methodologies translate into tangible, real-world benefits for securing containerized environments.

Comprehensive Package Detection:

RapidFort employs proprietary techniques to achieve deep and comprehensive package detection. This includes identifying all files and packages whether or not they are managed by a package manager as well as binaries, associated vulnerabilities, and their dependencies within a containerized application.

By thoroughly scanning and analyzing these components, RapidFort ensures that no potential vulnerabilities are overlooked during security analysis.

Superior Vulnerability Database Quality:

RapidFort curates and integrates data from a wide range of trusted sources, intelligently filtering out noise caused by false positives and exposing false negatives. This meticulous curation enables the scanner to accurately match identified packages with known vulnerabilities, delivering dependable results that security teams can trust.

Additionally, RapidFort's advisory system provides clear justification when a vulnerability is deemed not applicable, along with direct references to the original sources from which those justifications were derived.

Real-World Impact

The importance of these strengths becomes evident when considering the real-world consequences of inaccuracies in vulnerability detection. Missing critical vulnerabilities due to false negatives can result in severe outcomes, as illustrated by the recent high-profile incident involving a backdoor in XZ Utils, a widely used utility. When a scanner fails to detect such a vulnerability, it leaves the organization exposed to exploitation and significantly increases the risk of security breaches.

Conversely, an overabundance of false positives can overwhelm security teams, forcing them to waste valuable time and resources chasing non-existent threats. This not only reduces operational efficiency but also increases the likelihood that genuine vulnerabilities will be overlooked. RapidFort's high detection accuracy helps mitigate both risks, allowing security teams to focus on addressing real issues and maintaining a resilient security posture.

100% Accuracy

Detected all known vulnerabilities in the 20-container test no false positives, no false negatives.

Deep Package Detection

Scans all files and binaries regardless of package manager, leaving zero blind spots.

Trusted DB Quality

Curated, multi-source vulnerability database with clear justification for every finding.

About Us

At RapidFort, we are dedicated to empowering organizations to enhance their container security and vulnerability management practices. As a leading provider of cloud-native cybersecurity solutions, we combine Near-Zero CVE Images with our CI/CD-native SASM platform to remove up to 99% of CVEs automatically, with no code changes helping teams reduce their attack surface and secure containerized environments.

We trust that the insights presented in this report will aid organizations in gaining a deeper understanding of their security landscape and taking proactive steps to fortify their defenses.

To learn more about the RapidFort platform, please visit www.rapidfort.com

Continuously Eliminate Up to 99.9% of CVEs Without Code Changes

Request Access

‍

Beyond Identity Accelerates FedRAMP Compliance with RapidFort

April 10, 2025

Case Study

Beyond Identity Accelerates FedRAMP Compliance with RapidFort

Compliance & Governance

Software Supply Chain Security

case study

Beyond Identity Accelerates FedRAMP Certification with RapidFort

Industry

Identity and Access Management

Challenge

Achieve FedRAMP Moderate certification efficiently and cost-effectively while maintaining development speed and audit readiness

Solution

RapidFort Platform and Curated Near Zero CVE Images

The Challenge

Beyond Identity, a leading provider of identity and access management solutions, needed to achieve FedRAMP Moderate certification under tight deadlines and complex compliance requirements. FedRAMP certification involves extensive documentation, rigorous security testing, and ongoing alignment with federal standards. Beyond Identity sought to simplify and accelerate this process without diverting engineering resources from core product innovation.

Vulnerability Management

Container images required significant hardening to eliminate unnecessary packages and open vulnerabilities.

Continuous Compliance

Monthly audits required continuous monitoring and consistent documentation for ongoing compliance.

Engineering Efficiency

Manual SSDLC and image management consumed valuable engineering time.

Federal Market Entry

Meeting FedRAMP timelines was critical to accelerate entry into the U.S. federal market.

The Solution

Beyond Identity selected the RapidFort Platform and Curated Near Zero CVE Images to accelerate FedRAMP readiness and reduce engineering workload. RapidFort’s platform provided these key capabilities:

Pre-Hardened, Near Zero CVE Images

Hardened base images aligned with NIST 800-70 and FIPS 140-2/3 standards, significantly reducing setup time.

FedRAMP-Specific Audit Support

Tools and documentation simplified creation of POA&Ms and SBOMs for compliance audits.

Security Benchmarking & Hardening

Enabled Beyond Identity to ensure STIG compliance across application layers and streamline SSDLC integration.

RapidFort was an excellent and comprehensive partner during our FedRAMP journey. They cut the cost of image hardening and SSDLC efforts by 50%, shaved three months off our overall compliance timeline, and delivered outstanding support every step of the way.”

Results

By leveraging RapidFort, Beyond Identity achieved measurable improvements:

50% Cost Reduction

Image hardening and SSDLC costs were cut in half compared to internal builds

3-Month Acceleration

FedRAMP compliance time was reduced by three months, accelerating market readiness

Improved DevSecOps Velocity

Hardened containers integrated directly into SSDLC pipelines, improving delivery speed and audit readiness

Conclusion

RapidFort played a critical role in Beyond Identity’s ability to move quickly and confidently through FedRAMP Moderate certification. Its automation-driven platform enabled faster compliance, lower costs, and stronger assurance — empowering engineering teams to focus on secure innovation.

Eliminate Attack Vectors At The Source

Continuously Eliminate Up to 99.9% of CVEs Without Code Changes

Request a Access

‍

RapidFort Kimia: The Secure Successor to Kaniko

Whitepaper

December 2, 2025

RapidFort Kimia: The Secure Successor to Kaniko

Kimia is RapidFort’s secure, rootless, and fully backward-compatible successor to Kaniko—designed for modern, compliance-aligned container builds.

RapidFort Platform

The Hidden Dangers of Proprietary Open Source Distributions

Whitepaper

November 10, 2025

The Hidden Dangers of Proprietary Open Source Distributions

Not all “open source” is truly open. This whitepaper exposes how closed Linux distributions limit control, obscure vulnerabilities, and erode developer independence.

Cloud Security Fundamentals

Software Supply Chain Security

Whitepaper

November 23, 2024

Your Path to Near-Zero CVE Images

Secure Base Images

Image Hardening & Optimization

Whitepaper

October 7, 2024

Optimize & Secure Your Cloud

Cloud Security Fundamentals

Image Hardening & Optimization

Whitepaper

October 7, 2024

Secure Software Development Lifecycle

DevSecOps & Best Practices

Software Supply Chain Security

Navigating the Evolving Threat Landscape

Whitepaper

October 7, 2024

Navigating the Evolving Threat Landscape

Threats

DevSecOps & Best Practices

Whitepaper

September 30, 2024

RapidFort Attack Surface Management

Discover how RapidFort's SASM platform automates vulnerability remediation, accelerates secure software delivery, and reduces development costs within CI/CD pipelines.

RapidFort Platform

Software Supply Chain Security

Accelerating Secure Software Delivery with a Three-Step Approach

Whitepaper

September 18, 2024

Accelerating Secure Software Delivery with a Three-Step Approach

RapidFort Platform

DevSecOps & Best Practices

EU Cyber Resilience Act & Mythos: Securing Your Container Infrastructure with RapidFort

Whitepaper

July 22, 2026

EU Cyber Resilience Act & Mythos: Securing Your Container Infrastructure with RapidFort

No items found.

No items found.

Runtime Bill of Materials (RBOMs®) operate as a dynamic, execution-aware refinement of the Software Bill of Materials (SBOM).

Cloud Security Fundamentals

Compliance Guide

July 17, 2026

What is an RBOM® (Runtime Bill of Materials)?

Runtime Bill of Materials (RBOMs®) operate as a dynamic, execution-aware refinement of the Software Bill of Materials (SBOM). SBOMs record all software artifacts associated with a build, whereas RBOMs® capture only the components that are actually executed or loaded into memory at runtime. Thinking about how an RBOM improves compliance requires analyzing large codebases, identifying unused components, isolating what is truly essential, and reducing SBOM elements that unnecessarily expand the attack surface.

SBOM

Records all software artifacts associated with a build.

RBOM®

Captures only the components that are actually executed or loaded into memory at runtime.

RBOM® as a Risk Reduction Tool

One of the best ways to think about RBOM® is in terms of risk reduction. In many DevSecOps pipelines, teams believe security has been fully integrated once scanning is enabled and builds are passing. However, if a scanner is configured too permissively or lacks meaningful baselining, there may be no effective comparison between versions or visibility into what truly changed. Simply comparing one build to the next does not always provide actionable insight. RBOM® goes further by establishing a runtime baseline and evaluating which libraries, binaries, dependencies, and other code elements are actually executed. This approach ensures that organizations do not spend time managing vulnerabilities in code their product does not use.

RBOM® and FedRAMP CM-8 Compliance

FedRAMP, under CM-8 guidance, requires a complete and up-to-date inventory of all system components. This process often begins with an SBOM. However, just because you can include every possible item does not mean you should. In creating the RBOM®, the first step is analyzing all components within the codebase. Comparing the SBOM to the RBOM® brings clarity to what is actually required versus what merely exists.

Why Dependency Trees Keep Growing

The rise of open-source usage, AI-assisted development, and rapid coding practices has significantly expanded dependency trees. Many projects include just-in-case libraries that are never used at runtime. RBOM® comparison identifies unused components within the overall package, uncovering what might otherwise take engineers hundreds of hours to manually analyze and resolve.

Finding What's Actually Unused

The next RBOM® step highlights unused components for further evaluation and potential removal. These elements are flagged for deeper analysis within the platform. For example, one Python graphics library used by a bank had over 3,200 packages installed, yet only 200 were actually used at runtime. This does not imply that the remaining packages were malicious or without value, only that they were not used in that deployment. Many production environments lack a systematic way to surface these inactive components.

3,200+Packages installed in one bank's Python graphics library

200Packages actually used at runtime

Aligning the RBOM® with the Final SBOM

RBOM® supports a specific approach for eliminating excess SBOM components. This approach removes unused code (such as the 3,000 dormant Python packages) to streamline the artifact down to essential runtime components. Ultimately, the RBOM® should closely align with the final SBOM. This means no explaining discrepancies to auditors, no securing unused code, and no engineering time wasted on non-essential elimination efforts.

Is It Time to Deploy an RBOM®?

Overall, RBOM® is an efficient tool for evaluating the SBOM at runtime, ensuring that everything listed in the inventory is actually being used. If your platform or product uses 80% of its footprint for unused components, and 95% of your vulnerabilities reside there, it may be time to deploy an RBOM®.

80%Of platform footprint made up of unused components

95%Of vulnerabilities residing in that unused footprint

Break down large codebases

Identify unused components

Isolate essential runtime elements

Eliminate unnecessary vulnerabilities

If you want to dramatically reduce CVEs and strengthen your compliance posture, RapidFort does this.

Key Takeaways

RBOM® captures only the components actually executed or loaded into memory at runtime, unlike an SBOM, which records all software artifacts associated with a build.
RBOM® establishes a runtime baseline, evaluating which libraries, binaries, and dependencies are actually executed.
FedRAMP CM-8 requires a complete, up-to-date inventory of system components, and comparing the SBOM to the RBOM® clarifies what is actually required versus what merely exists.
In one example, a bank's Python graphics library had over 3,200 packages installed, yet only 200 were actually used at runtime.
Eliminating unused packages reduced CVEs associated with dormant code, shrank the attack surface, and improved build times.
Ultimately, the RBOM® should closely align with the final SBOM, removing the need to explain discrepancies to auditors or secure unused code.

‍

RapidFort Recognized as a CRN® 2026 Stellar Startup

Press Release

November 9, 2026

RapidFort Recognized as a CRN® 2026 Stellar Startup

No items found.

RapidFort Recognized as a CRN ® 2026 Stellar Startup for Delivery of Software

Supply Chain Security to the Channel

RapidFort Recognized as Channel’s Most Comprehensive End-to-End Software Supply Chain Security

Solution from Intake to Runtime

Sunnyvale, Calif. — Nov. 9, 2026 — RapidFort, the leader in Software Supply Chain Security (SSCS) with
the largest distribution of curated truly open-source software, today announced that CRN ® , a brand of
The Channel Company, has named RapidFort as a 2026 Stellar Startup for its leading SSCS solution. This
prestigious list highlights fast-rising technology vendors that are driving innovation and fostering growth
in the IT channel with groundbreaking products.
Each technology vendor featured on the CRN 2026 Stellar Startups list is distinguished by its
commitment to innovation and to delivering cutting-edge offerings that help solution providers stand
out in today’s fast-changing IT landscape. This annual list serves as an invaluable resource for solution
providers making business-critical strategic decisions and exploring new technologies and services to
add to their portfolios to give them a competitive advantage and drive success.
“We’re proud to recognize the innovative companies featured on this year’s Stellar Startups list,” said
Jennifer Follett, Vice President, U.S. Content, Executive Editor at CRN, The Channel Company. “These
organizations are redefining what’s possible in the IT channel by bringing fresh ideas, transformative
technologies and a strong commitment to partner success. We look forward to seeing the impact they
continue to make across the industry.”
RapidFort has a growing presence in the channel, due to the solution’s easy installation in end user sites
and revenue opportunities realized by partners. Partnerships have increased 50 percent year-over-year
over the past three years, and RapidFort is becoming an important solution in partners’ suite of security
offerings. Partners are able to add on services such as running RapidFort as a managed service, and offer
leading Software Supply Chain Security functionality in their portfolios.
“RapidFort is deeply committed to our channel partners,” said Avery Lyford, VP of Commercial
Partnerships at RapidFort. “It’s gratifying to be recognized by CRN for our innovation in delivering a
channel-friendly leading Software Supply Chain Security Solution from intake to runtime. RapidFort

works closely with our partners to develop easily deployed solutions that provide customer value and
channel opportunities.”
RapidFort is a comprehensive, end-to-end platform that secures the entire software lifecycle from
intake to runtime. It delivers near-zero CVE images, malware scanning, and production runtime
protection, enabling organizations to eliminate up to 99.9% of security vulnerabilities. RapidFort
empowers development teams to innovate quickly with industry-standard open-source and AI
technologies while abiding by organizations’ security requirements, providing continuous security and
compliance without vendor lock-in or operational bottlenecks.
Coverage of the 2026 CRN Stellar Startups can be found at crn.com/StellarStartups.
About The Channel Company
The Channel Company (TCC) is the global leader in channel growth for the world’s top technology
brands. We accelerate success across strategic channels for tech vendors, solution providers and end
users with premier media brands, integrated marketing and event services, strategic consulting, and
exclusive market and audience insights. TCC is a portfolio company of investment funds managed by
EagleTree Capital, a New York City-based private equity firm. For more information,
visit thechannelco.com. Follow The Channel Company at LinkedIn and X.
About RapidFort
RapidFort leads the Software Supply Chain Security market with the largest distribution of curated,
genuinely open-source software. Its platform enables organizations to eliminate risk at scale through
hardened near-zero CVE container images, runtime profiling, attack surface management, and the
industry’s first independently malware-scanned open-source images – cutting CVE exposure by up to
99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner®
Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as
a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint
Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

‍

RapidFort to Deliver Hardened Container Images for GitLab Regulated Self-Managed Deployments

Press Release

November 2, 2026

RapidFort to Deliver Hardened Container Images for GitLab Regulated Self-Managed Deployments

No items found.

RapidFort to Deliver Hardened Container Images for GitLab Regulated Self-Managed Deployments

SUNNYVALE, Calif. — Nov. 3, 2026 — RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced a new strategic partnership with GitLab to deliver hardened container images for GitLab regulated Self-Managed Deployments. The offering enables development and security teams to identify and eliminate vulnerabilities within the GitLab workflows they already use, without requiring changes to application code or migration to a proprietary operating system.

The partnership combines GitLab’s DevSecOps platform with RapidFort’s industry-first combination of minimal and near-zero CVE container images, attack surface management, and continuous runtime monitoring. The images retain GitLab’s existing functionality and version tags, so teams can adopt them without changing how they build and ship software.

“Regulated organizations need confidence in what they deploy and flexibility to meet their security requirements,” said Omer Azaria, VP of Product Management, GitLab. “Through our strategic partnership with RapidFort, regulated and air-gapped customers have a new way to get hardened, continuously patched GitLab images, along with audit-ready evidence, without slowing development.”

“This partnership is designed to let joint customers establish a golden image pipeline for GitLab – a single, centrally governed, hardened source of GitLab images that flows through the customer's build, security scanning, and deployment stages,” said George Manuelian, Chief Strategy Officer at RapidFort. “It moves the industry from detecting vulnerabilities to eliminating them at the source, making secure-by-default software achievable at scale inside the platform where code is built.

“For self-managed customers, security doesn’t stop at the application layer. As AI accelerates vulnerability discovery, customers need to apply the same security scrutiny to the container images they use to deploy GitLab. This partnership gives customers a traceable path to hardened images and supporting security evidence,” said Martin Brümmer, Senior Product Manager, GitLab.

Today’s announcement builds on RapidFort existing public-sector work; it already publishes an optimized, hardened image for GitLab Runner Iron Bank, and compiles security benchmarks into audit-ready evidence for FedRAMP, Authorization to Operate (ATO), Cybersecurity Maturity Model Certification (CMMC), the EU’s Digital Operational Resilience Act (DORA), and the Cyber Resilience Act (CRA), while still moving at commercial development speed.

Under the partnership, GitLab’s on-premises images are now available through the RapidFort Curated Catalog, a library of more than 48,000 base and third-party container images spanning every major Linux distribution. Curated GitLab images will retain GitLab’s existing functionality, version tags, and configuration surface. Key characteristics of curated GitLab images from this partnership include:

● Near-zero CVE posture, updated daily. Images are continuously patched as upstream fixes land, with published SLAs of seven calendar days for Critical/High severity CVEs, 21 days for Medium severity CVEs, and 28 days for Low severity CVEs, once an upstream patch is available.

● FIPS 140-2/140-3 alignment. FIPS-validated OpenSSL providers (covering downstream consumers such as cURL) are built into applicable images, with images tested against a FIPS-enabled kernel helping customers meet a prerequisite for federal and defense deployments.

● Security Technical Implementation Guide (STIG)-hardened configurations. These reduce the manual effort security teams spend remediating baseline findings before GitLab can be authorized for use in regulated environments.

● Minimal attack surface. Hardened/community image variants strip out unused packages, shells, and debug utilities, reducing image size and CVE count well beyond the base curated image.

● Audit-ready compliance evidence. RapidFort’s Compliance and Remediation Tool (CART) component continuously validates images against security baselines and generates compliance reports usable in support of FedRAMP, CMMC, CRA, SOC 2, and CIS Benchmark assessments – reducing the manual evidence-gathering burden during ATO and audit cycles.

Availability
Multiple GitLab images are available immediately in the RapidFort Curated Images catalog, giving joint customers a ready-to-use starting point for hardened, on-prem GitLab deployments. To buy or for more information, visit https://www.rapidfort.com/schedule-a-call.

About RapidFort
RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

‍

RapidFort Selected to Present on Software Supply Chain Security

Press Release

October 22, 2026

RapidFort Selected to Present on Software Supply Chain Security

No items found.

RapidFort Selected to Present on Software Supply Chain Security and Exhibiting During Important Events Next Quarter

Share

Company Participating in SF Tech Week, OWASP Global AppSec USA, KubeCon+CloudNativeCon N.A., and FutureCon

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced that it will present on Software Supply Chain Security and exhibit during a number of important industry events next quarter.

RapidFort participating in SF Tech Week, OWASP Global AppSec USA, KubeCon+CloudNativeCon N.A., and FutureCon in Q4.

Share

RapidFort will participate in the following important upcoming industry events in Q4:

SF Tech Week, San Francisco. RapidFort is hosting an evening event for defense technologists during Tech Week, including a speaker panel titled Bridging Innovation and Defense announcing the SpaceWERX Transition Program on Oct. 6 from 6 pm – 8 pm PDT.
OWASP Global AppSec USA, San Francisco. RapidFort is a Silver sponsor of the leading event for application security professionals, and will exhibit in Booth S21 during the event from Nov. 5 – 6.
KubeCon+CloudNativeCon N.A., Salt Lake City. RapidFort is a Silver sponsor of this flagship Linux Foundation event, and will exhibit in Booth 310 during the event from Nov. 9 – 12.
FutureCon, Boston, Mass. RapidFort is a Silver sponsor of this cybersecurity industry event and will exhibit during the Nov. 19 event.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry’s first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort Named 2026 Top InfoSec Innovator for Software Supply Chain Security

Press Release

October 20, 2026

RapidFort Named 2026 Top InfoSec Innovator for Software Supply Chain Security

No items found.

RapidFort Wins Top InfoSec Innovator Award for 2026 as Market Leader in

Software Supply Chain Security

RapidFort Recognized for Delivering Industry’s Most Comprehensive End-to-End Software Supply Chain

Security Solution from Intake to Runtime

Sunnyvale, Calif. — Oct. 20, 2026 — RapidFort, the leader in Software Supply Chain Security (SSCS) with
the largest distribution of curated truly open-source software, today announced it has been named the
Market Leader in Software Supply Chain Security and winner of the Top InfoSec Innovator Award for
2026 by Cyber Defense Magazine (CDM), the industry’s leading electronic information security
magazine.
“We scoured the globe looking for cybersecurity innovators that could make a huge difference and
potentially help turn the tide against the exponential growth in cyber-crime,” said Yan Ross, Editor of
Cyber Defense Magazine. “RapidFort is worthy of being named a winner of these coveted awards and
consideration for deployment in organizations’ environments.”
This is CDM’s 14th year of honoring cybersecurity innovators. Judges for these prestigious awards
include cybersecurity industry veterans, trailblazers and market makers Ron Gula of Gula Tech
Adventures, Gary Miliefsky of CDMG, Dr. Lindsey Polley de Lopez of VentureScope, Katie Gray of In-Q-
Tel, Robert R. Ackerman Jr. of DataTribe, Ira Winkler from CruiseCon, Dino Boukouris of AltitudeCyber;
and with much appreciation to emeritus judges Robert Herjavec of Cyderes, Dr. Peter Stephenson of
CDMG, and David DeWalt of NightDragon. The full list of the Top InfoSec Innovators for 2026 is found
here: https://cyberdefenseawards.com/top-infosec-innovators-for-2026/ .
“It’s rewarding to be validated as the market leader in Software Supply Chain Security in one of the
world’s most prestigious cybersecurity awards programs from Cyber Defense Magazine,” said Michael
Wood, RapidFort CMO. “This award stands out in the industry because winners are determined by a
judging panel of leading experts, not vendor content submissions. 2026 has been a record-setting year
for RapidFort as organizations across the globe turn to us to best protect themselves from SSCS threats
and secure their development operations.”

RapidFort is a comprehensive, end-to-end platform that secures the entire software lifecycle from
intake to runtime. RapidFort integrates smart profiling, near-zero CVE images, code reduction, malware
scanning, and production runtime protection, enabling organizations to eliminate up to 99.9% of
security vulnerabilities. RapidFort empowers development teams to innovate quickly with industry-
standard open-source and AI technologies while abiding by organizations’ security requirements,
providing continuous security and compliance without vendor lock-in or operational bottlenecks.
About Cyber Defense Magazine
Cyber Defense Magazine was founded in 2012 by Gary S. Miliefsky, globally recognized cyber security
thought leader, inventor and entrepreneur, and continues to be the premier source of IT Security
information. It is managed and published by and for ethical, honest, passionate information security
professionals. Its mission is to share cutting-edge knowledge, real-world stories and awards on the best
ideas, products and services in the information technology industry. It delivers electronic magazines
every month online for free, and limited special editions exclusively for the RSAC, Black Hat and Cyber
Defense Conferences. Learn more at http://www.cyberdefensemagazine.com. Cyber Defense Magazine
is a proud member of the Cyber Defense Media Group.
About RapidFort
RapidFort leads the Software Supply Chain Security market with the largest distribution of curated,
genuinely open-source software. Its platform enables organizations to eliminate risk at scale through
hardened near-zero CVE container images, runtime profiling, attack surface management, and the
industry’s first independently malware-scanned open-source images – cutting CVE exposure by up to
99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner®
Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as
a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint
Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

‍

RapidFort and SpaceWERX Unite to Secure America's AI Supply Chain

Press Release

October 8, 2026

RapidFort and SpaceWERX Unite to Secure America's AI Supply Chain

No items found.

RapidFort and SpaceWERX Convene Industry Leaders in San Antonio to Secure America’s AI Software Supply Chain

Event Brings Together Government and Industry to Address AI Software Exploitation, Accelerated Mission Software Delivery, and Emerging Quantum Threats

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, and SpaceWERX, the innovation arm of the United States Space Force, today announced a conference focused on securing America’s AI software supply chain and strengthening national security mission assurance. The conference is being held Thursday, Oct. 8, at the University of Texas at San Antonio’s San Pedro 1 Building, in partnership with the university and its National Security Collaboration Center.

The event convenes industry innovators and national security practitioners to examine how to eliminate software attack vectors at the source, accelerate secure mission software delivery, and prepare critical infrastructure for emerging AI and quantum threats.

RapidFort and SpaceWERX event brings together government and industry to address AI software exploitation, accelerated mission software delivery, and emerging quantum threats.

Building on the Cooperative Research and Development Agreement (CRADA) between RapidFort and SpaceWERX, the conference will provide a forum for connecting commercial expertise with operational requirements. Participants will share technical perspectives and implementation practices to address software security challenges across the national security ecosystem.

Discussions will examine how national security organizations can advance the objectives of DoW Instruction 8430.01, “Accelerated Mission Software,” while maintaining software supply chain security and mission assurance. Participants will explore how commercial capabilities can support faster software delivery, reduce vulnerability exposure, and provide verifiable security evidence to inform mission decisions.

The conference focuses on five areas related to emerging threats and opportunities:

Defensive AI: Outpacing the AI Exploit Window
How The AI Supply Chain Is the New National Security Perimeter
From SBOM to Mission Assurance: Evidence That Actually Changes Risk
Securing the Agentic Enterprise: Identity, Authority, and Blast Radius Best Practices
The 2030 Problem Arrives Early: AI, Quantum, and Critical Infrastructure Best Practices

Across these panels, participants will examine how software transparency and operational evidence can support risk reduction, how identity and authority controls can limit the impact of compromised agentic systems, and how critical infrastructure organizations can prepare for migration to post-quantum cryptography.

“America’s ability to field AI capabilities depends on trust in the software that powers them,” said Austin Sedaghatpour, National Security Lead at RapidFort. “Speed and security must advance together. Our goal is to move beyond discussing risk and focus on practical ways to eliminate software attack vectors at the source. Building on our CRADA with SpaceWERX, this conference connects commercial expertise with operational priorities so warfighters and Guardians can benefit from American innovation without inheriting avoidable software risk.”

RapidFort has a proven commitment to open source and community collaboration, including participation in the Silicon Valley AI and cybersecurity communities and service on the governing board of the Akrites Project. The conference extends this commitment by bringing government and industry practitioners together around shared security priorities.

The conference helps participants identify shared security challenges and opportunities for continued technical collaboration, with a practical focus on reducing software exploitation risk and accelerating secure mission delivery.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images - cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

About SpaceWERX

As the innovation arm of the United States Space Force and a unique division within AFWERX, SpaceWERX inspires and empowers collaboration with innovators to accelerate capabilities and shape the future in space. SpaceWERX identifies, validates, and transitions dual use technologies from across the commercial space ecosystem to deliver capabilities at speed and scale in a contested domain. In partnership with Space Systems Command’s Commercial Space Office, SpaceWERX connects innovative technology developers with operational experts, acquisition professionals, and Guardian talent to bridge innovation and acquisition.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort and SpaceWERX Sign CRADA to Cut Space Force ATO Timelines

Press Release

October 6, 2026

RapidFort and SpaceWERX Sign CRADA to Cut Space Force ATO Timelines

No items found.

RapidFort and SpaceWERX Enter Cooperative Research and Development Agreement to Improve Cyber Readiness and Reduce ATO Timescales for U.S. Space Force

Relationship Addresses Improvement of USSF Cyber Readiness, Reduction of AI Software Exploitation Risk, Rapid Acceleration of ATOs, Fast-Tracking of Security Clearances, and Cybersecurity Protection of Space Systems from Post-Quantum Encryption Risk

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced it has signed a Cooperative Research and Development Agreement (CRADA) with SpaceWERX, the innovation arm of the United States Space Force (USSF) and a division of the Air Force Research Laboratory (AFRL).

This strategic partnership establishes a collaborative framework to build a larger industry consortium to enable SpaceWERX to co-develop, test, and evaluate next-generation capabilities that reduce AI software vulnerability exploitation risk, improve cyber readiness, accelerate ATOs, and reduce post-quantum encryption risk across critical space systems. For the USSF, the CRADA is designed to improve cyber readiness, allowing USSF Guardian personnel to field new software capabilities securely, while having them approved and deployed at operational speed. Under the terms of the CRADA, industry organizations will share technical expertise, infrastructure, and operational insights to accelerate commercialization and cybersecurity mission readiness for space systems.

New RapidFort and SpaceWERX relationship addresses improvement of US Space Force cyber readiness, reduction of AI software exploitation risk, rapid acceleration of ATOs, and cybersecurity protection of space systems from post-quantum encryption risk.

As a CRADA partner, RapidFort now has access to SpaceWERX’s network of operational experts, acquisition professionals, and Guardian talent. Likewise, SpaceWERX has access to RapidFort’s ecosystem of software industry and open-source partners. This collaborative feedback loop will enable the Space Force to validate and refine its capabilities in near real time, ensuring commercial solutions map directly to the dynamic requirements of the contested space domain.

“Partnering with SpaceWERX through this CRADA represents a major milestone in our mission to bridge commercial breakthroughs with national security priorities,” said Mehran Farimani, CEO of RapidFort. “Our focus is clear: Empower the guardians to eliminate AI-driven software attack vectors at the source, accelerate ATOs so Guardians can field next-generation software without trading speed for security, and prepare space systems for emerging post-quantum threats. Through this CRADA we can bring best of industry software into the heart of USSF operations, leveraging the benefits of AI while reducing the security risks of AI.”

RapidFort has been a key member of the Silicon Valley AI and cybersecurity communities and serves on the governing board of the Akrites Project, among other community-based software initiatives.

The joint research under this CRADA will focus primarily on:

Efforts to continuously reduce AI software vulnerability exploitation risk for the Department of War, aligned with the recent presidential executive order on Promoting Advanced Artificial Intelligence Innovation and Security.
Development and evaluation of capabilities to reduce post-quantum encryption risk, aligned with the presidential order on Securing the Nation Against Advanced Cryptographic Attacks.
Expansion of RapidFort complimentary Rapid ATO education and “Ask an Approving Officer Program,” providing industry and Guardians a repeatable pattern to deliver reduced ATO timescales. This is especially important for AI software, which is now a national Department of War priority.
RapidFort publishes a patch-time SLA once an upstream fix exists: Seven calendar days for Critical/High, 21 for Medium, 28 for Low.
Expansion of the complimentary “Ask a Facilities Security Officer (FSO)” education program to help accelerate clearances for key projects within the SpaceWERX ecosystem.

This CRADA underscores SpaceWERX’s ongoing commitment to cultivating partnerships with the community of leading software, AI, cybersecurity, and defense startups, thus leveraging commercial agility to rebuild the nation’s technological arsenal for the modern era.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images - cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

About SpaceWERX

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

Press Release

October 1, 2026

RapidFort Integrates with Wiz

No items found.

RapidFort Integrates with Wiz, Closing the Loop Between Cloud Vulnerability Detection and Near-Zero CVE Remediation

Joint Customers Can Now Utilize RapidFort Leading Set of Curated Hardened Container Images, Enriching CVE Findings from Wiz with RapidFort Evidence-Backed Advisories and Direct Path to Near-Zero CVE Remediation

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced interoperability with Wiz, a leading cloud and AI security platform that’s now part of Google Cloud. With this integration, joint customers can now scan and identify RapidFort industry-largest set of curated and hardened images for the presence of CVEs, and leverage RapidFort advisory-backed remediation status alongside those findings – without leaving the Wiz platform or changing how they scan today.

“We’re happy to welcome RapidFort to the Wiz Integration Network,” said Oron Noah, VP of Product, Extensibility and Partnerships at Wiz. “Managing cloud vulnerabilities isn’t just about identifying risk, it’s about making remediation as seamless as possible. By surfacing RapidFort advisory feed directly within the Wiz platform, we’re helping joint customers clear out false positives and fix CVEs quickly.”

Joint RapidFort and Wiz customers can now utilize RapidFort leading set of curated hardened container images, enriching CVE findings from Wiz with RapidFort evidence-backed advisories and direct path to near-zero CVE remediation.

While Wiz identifies CVEs across cloud and container estates, this integration provides joint customers with a streamlined remediation path. When a CVE finding touches a RapidFort-curated or -hardened image, Wiz surfaces RapidFort advisory context, and the near-zero CVE curated equivalent is available as a direct, typically one-line, remediation. RapidFort curated images retain the same OS, language stack, size, and version tags Wiz customers already use. Its advisory determinations are backed by primary sources and applied consistently across scanners, which gives Wiz customers a documented reason for each false-positive determination rather than a black-box suppression.

“This important integration extends the stated scanner-agnostic strategy of RapidFort into a named, directory-listed partnership with one of the most prominent players in the category,” said George Manuelian, Chief Strategy Officer at RapidFort. “Joint Wiz customers can now spend fewer hours triaging CVEs that were never exploitable in the first place, and have a documented remediation path the moment a real CVE is found, all inside the scanning tool they already run. Now they do not have to choose between their existing scanner investment and adopting a near-zero CVE image supply chain – these two solutions now work together natively.”

Joint customers can now leverage RapidFort industry-leading vulnerability remediation.

RapidFort is the only curated-image distributor that supports all major LTS OS releases in one catalog (Ubuntu, Debian, Red Hat/UBI, and Alpine) rather than standardizing customers onto a single distribution.
RapidFort Curated Images retain the joint customer existing OS, size, and version tags, as a drop-in replacement for CVE remediation not a migration; customers change a FROM line rather than re-platforming. This lowers total cost of ownership and removes the main adoption barrier for both developers (no re-testing a new base) and security teams (no new tooling to learn).
RapidFort Advisory determinations are evidence-backed (NVD, distro trackers, upstream commits) and apply consistently regardless of which scanner reported the finding.
RapidFort publishes a patch-time SLA once an upstream fix exists: Seven calendar days for Critical/High, 21 for Medium, 28 for Low.
RapidFort images are DISA STIG-verified and support full FIPS 140-3 requirements.

For partners building on or alongside RapidFort, this latest integration is a proof point that RapidFort advisory feeds and RapidFort curated catalogs are designed to plug into the tools partners already provide, rather than requiring a closed, single-vendor stack.

Availability

The RapidFort and Wiz integration is currently available and listed live today in the Wiz Integrations directory. For more information visit https://www.wiz.io/integrations?q=rapidfort.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

RapidFort and Aqua Security Partner to Enhance Aqua Trivy Scanner

Press Release

September 29, 2026

RapidFort and Aqua Security Partner to Enhance Aqua Trivy Scanner

No items found.

RapidFort and Aqua Security Partner to Enhance Aqua Trivy Scanner with RapidFort Curated Images, Advisories and Remediation Data

Trivy Connect Partnership Enables Development and Security Teams to Start with Near-zero CVE Images, Reduce Operational Burden of Vulnerability Management, and Spend Less Time Sorting Through Scanner Noise

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced its new partnership with Aqua Security, the company delivering Aqua Trivy, a comprehensive, open-source cloud native security scanner that unifies vulnerability detection, misconfiguration scanning, and secret identification across the entire software development lifecycle.

Under Trivy Partner Connect, Trivy integrates RapidFort security advisories, enabling it to accurately report the status of packages in RapidFort Curated Images. This includes access to enhanced information including when RapidFort uses fixes extracted from other distributions or adapted from otherwise incompatible versions to patch affected packages. This new integration ensures Trivy recognizes each fix and is able to accurately report the near-zero CVE status of RapidFort Curated Images.

RapidFort's new Trivy Connect partnership enables development and security teams to start with near-zero CVE images, reduce operational burden of vulnerability management, and spend less time sorting through scanner noise.

As a result, development and security teams can start with near-zero CVE images, reduce the operational burden of vulnerability management, and spend less time sorting through scanner noise. Instead of managing false positives, developers can focus on building and releasing their products with greater confidence.

“Joint customers benefit from more accurate vulnerability results, less noise, and greater confidence in the security of the images they deploy,” said Matt Richards, Chief Operating Officer at Aqua Security. “RapidFort brings differentiated remediation capabilities and a level of advisory detail that enables Trivy to recognize packages RapidFort has already patched even when those fixes are sourced from other distributions or adapted from versions that would otherwise be incompatible. By combining Trivy’s trusted open-source scanning with RapidFort near-zero CVE images and transparent remediation data, we are helping development and security teams spend less time investigating false positives and more time delivering secure software.”

Even when an application is well-built, teams can spend countless hours chasing vulnerabilities in base images, dependencies, libraries, and operating system packages, many of which turn out to be false positives or already mitigated in ways traditional scanners do not understand. RapidFort Curated Images shift vulnerability elimination left without shifting more work onto developers. Combined with Trivy’s support for RapidFort advisories, teams get cleaner third-party scan results, more accurate security posture, and a faster path from development to production.

“Trivy is one of the most downloaded open-source security scanners, and we are pleased to partner with Aqua Security to enhance the productivity of developers, who get a true assessment of security risks and can now focus on development without worrying about fixing CVEs,” said George Manuelian, Chief Strategy Officer at RapidFort. “RapidFort is truly transparent about its curated images and enables partners to accurately assess images for any CVE risks. Partnering with companies like Aqua Security gives developers confidence that they are working with up to 99.9 percent CVE-free code before applications are ever deployed into production.”

This new integration is generally available immediately. Schedule a demo here https://www.rapidfort.com/schedule-a-call.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort Announces Integration with CrowdStrike Falcon Cloud Security to Accelerate Container Vulnerability Remediation

Press Release

August 31, 2026

RapidFort Announces Integration with CrowdStrike Falcon Cloud Security to Accelerate Container Vulnerability Remediation

No items found.

RapidFort integration with CrowdStrike Falcon Cloud Security accelerates container vulnerability remediation.

RapidFort Announces Integration with CrowdStrike Falcon Cloud Security to Accelerate Container Vulnerability Remediation

Integration Helps Joint Customers Identify, Prioritize, and Remediate Container Vulnerabilities across Kubernetes Environments

LAS VEGAS--(BUSINESS WIRE)--Fal.Con 2026 – RapidFort today at Fal.Con 2026 announced a new integration with CrowdStrike Falcon® Cloud Security. The integration helps joint customers accelerate container vulnerability remediation across Kubernetes environments by combining the comprehensive cloud security capabilities of Falcon Cloud Security with RapidFort automated container image hardening.

As AI accelerates vulnerability discovery and shortens the window between CVE disclosure and potential exploitation, organizations running Kubernetes at scale face increasing pressure to address vulnerabilities faster. Containerized workloads can inherit vulnerabilities from open-source base images and packages, creating significant remediation demands across large environments.

New integration helps joint customers accelerate container vulnerability remediation across Kubernetes environments by combining the comprehensive cloud security capabilities of Falcon Cloud Security with RapidFort automated container image hardening.

The integration enables RapidFort to ingest vulnerability and software bill of materials (SBOM) data from Falcon Cloud Security and use it to automate container image hardening. RapidFort curated image library and runtime profiling capabilities help eliminate identified vulnerabilities and remove unnecessary components without requiring changes to application code. Together, CrowdStrike and RapidFort help joint customers streamline vulnerability management and accelerate risk reduction across Kubernetes environments.

“AI-accelerated vulnerability discovery has made speed increasingly critical for organizations running Kubernetes at scale,” said George Manuelian, CSO, RapidFort. “Our integration with CrowdStrike brings RapidFort automated image hardening into the vulnerability management workflow, helping joint customers move faster from identifying risk to reducing it. RapidFort customers have reduced CVEs by up to 99.9% with our hardening technology, without requiring changes to application code.”

For organizations with stringent security and compliance requirements, including Department of Defense environments, RapidFort supports hardened container images, compliance reporting, and deployment across restricted and air-gapped environments.

To learn more about the integration, visit the CrowdStrike Marketplace listing or visit RapidFort at ReversingLabs Booth #2113 during Fal.Con 2026 in Las Vegas this week.

About RapidFort

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. CrowdStrike and Falcon are registered trademarks of CrowdStrike, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort Selected to Present on Software Supply Chain Security and Exhibiting During Important Events This Quarter

Press Release

August 14, 2026

RapidFort Selected to Present on Software Supply Chain Security and Exhibiting During Important Events This Quarter

No items found.

RapidFort selected to present on Software Supply Chain Security and is exhibiting during important industry events this quarter.

RapidFort Selected to Present on Software Supply Chain Security and Exhibiting During Important Events This Quarter

Company Participating in AFCEA TechNet Augusta, CrowdStrike fal.con, Billington CyberSecurity Summit 2026, and DevOpsDays Dallas

RapidFort will participate in the following important upcoming industry events:

AFCEA TechNet Augusta, Augusta, Ga. RapidFort is exhibiting in booth No. K14 at this event for military and private sector partnerships to accelerate the delivery of innovative and interoperable systems from Aug. 17 – 20.

RapidFort is participating in AFCEA TechNet Augusta, CrowdStrike fal.con, Billington CyberSecurity Summit 2026, and DevOpsDays Dallas later this quarter.

fal.con, Las Vegas. Meet RapidFort at this CrowdStrike high-octane experience for security teams from Aug. 31 – Sept. 3. To book a meeting at the event with RapidFort, please see https://www.rapidfort.com/events/rapidfort-at-fal-con-2026.
Billington CyberSecurity Summit 2026, Washington, D.C. RapidFort is a Gold Sponsor and will be exhibiting at the event in booth No. 215 from Sept. 8 – 10. Russ Andersson, COO and Co-founder of RapidFort, will participate in the breakout session panel titled “Trust but Verify: Assuring Integrity Across Foreign and High-Risk Vendors” on Sept. 9 from 11:40 am – 12:25 pm EDT.
DevOpsDays Dallas, Dallas. RapidFort is a Gold Sponsor of this regional conference for DevOps practitioners and will be exhibiting and speaking at the event from Sept. 28 – 29.

About RapidFort

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort Launches Industry’s First End-to-End Continuous Threat Elimination

Press Release

August 4, 2026

RapidFort Launches Industry’s First End-to-End Continuous Threat Elimination

No items found.

RapidFort launches end-to-end continuous threat elimination by extending leading software supply chain security into live production environments.

RapidFort Launches Industry’s First End-to-End Continuous Threat Elimination by Extending Leading Software Supply Chain Security Into Live Production Environments

Unveiled at Black Hat USA 2026, RapidFort Runtime Uniquely Delivers End-to-End Continuous Monitoring of Live Environments to Detect and Address CVEs Emerging After Software Deployment

LAS VEGAS--(BUSINESS WIRE)--(Black Hat USA 2026 Booth #5704) -- RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today at Black Hat USA 2026 launched RapidFort Runtime, a real-time-based security solution that extends RapidFort’s leading SSCS functionalities into live production environments, creating the industry’s first genuinely end-to-end continuous threat elimination solution – from curated, independently malware-scanned open-source software before deployment to continuous CVE monitoring and tamper detection in live production environments.

Unveiled in Black Hat booth No. 5704 and demonstrated publicly for the first time, RapidFort Runtime operates inside an organization’s production environment continuously monitoring deployed software, detecting unauthorized or unexpected changes, and proactively tracking newly discovered CVEs. It notifies administrators and developers of relevant security impacts and provides actionable mitigation recommendations. This industry-first capability delivers top-level visibility that distinguishes between first-party and third-party software, generates a precise Runtime Bill of Materials (RBOM®), and provides evidence of the software and processes executing in production. It integrates into existing CI/CD pipelines without requiring code changes, effectively bridging the gap between pre-production security and live runtime protection.

Unveiled in Black Hat booth No. 5704, RapidFort Runtime operates inside an organization’s production environment continuously monitoring deployed software, detecting unauthorized or unexpected changes, and proactively tracking newly discovered CVEs.

Together with RapidFort curated open-source software catalog and hardened images validated through ReversingLabs deep-binary malware analysis, RapidFort Runtime enables organizations to verify both what enters production and whether deployed software remains intact once it is running.

“Maintaining an accurate, real-time inventory of what is actually executing in production has been a consistent audit and compliance hurdle,” said Sangram Dash, CISO and VP of IT, Sisense. “RapidFort Runtime’s ability to generate a precise, dynamic RBOM provides us with undeniable evidence of our software’s state. We can now verify integrity and confirm our compliance in real-time, which is a total game-changer for our security operations.”

RapidFort Runtime differentiating new capabilities include:

End-to-End Continuous Monitoring: Monitors live production environments to detect and address CVEs that emerge after software deployment, solving the “production obsolescence” problem where software is often “born outdated” and immediately vulnerable when it hits production due to new CVE disclosures.
Agent-Based Runtime Profiling: Uses BPF/ptrace instrumentation to map system calls, network/memory usage, and process execution, providing cryptographic evidence of what is truly running.
Proactive Mitigation Recommendations: Beyond just detection, the platform notifies administrators of new relevant security impacts and offers actionable mitigation recommendations to fix them in live environments.
Automated Runtime Bills of Materials Generation: Continuously produces dynamic RBOMs for audit-ready compliance.
Curated, Independently Malware-Scanned Software: Integrates with the RapidFort extensive catalog of curated open-source libraries and hardened container images, validated through ReversingLabs deep-binary malware analysis, to reduce the risk of compromised or unverified software reaching production.
Runtime Tamper Detection and Integrity Monitoring: Establishes a verifiable baseline of approved software and continuously detects changes to packages, binaries, libraries, processes, and runtime behavior, providing evidence of what changed and where the change occurred.

“While most software supply chain security tools stop at build-time or deployment, RapidFort continuously monitors live production environments for newly disclosed CVEs that impact deployed software,” said Rajeev Thakur, CTO of RapidFort. “By automatically correlating new vulnerabilities with running workloads, RapidFort eliminates the manual effort of tracking CVEs and determining real production exposure, enabling organizations to respond faster and with greater confidence.”

RapidFort Runtime leverages lightweight agents that utilize BPF and ptrace technology to continuously monitor the software running in live production environments where threats and anomalies are most critical. Only RapidFort uses BPF/ptrace to deliver true runtime intelligence and actual evidence of execution, which drastically reduces false positives and vulnerability noise over relying solely on static analysis or scanning.

Unlike competitors that force migration to proprietary package managers or “distroless” images, RapidFort provides zero-overhead integration with drop-in replacement that supports standard package managers (pip, npm, apk). It is fully aligned with BSI TR-03183 Part 2, NIS2 (enforcement Dec 2025), and EU Cyber Resilience Act (CRA) requirements; and supports CIS Benchmarks and STIG validation, ensuring suitability for defense and mission-critical cloud-native deployments.

Availability

RapidFort Runtime is currently generally available. For more information visit https://www.rapidfort.com/platform/runtime.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort Recognized as a 2026 Top InfoSec Innovator for Software Supply Chain Security

Press Release

July 29, 2026

RapidFort Recognized as a 2026 Top InfoSec Innovator for Software Supply Chain Security

No items found.

RapidFort is recognized as a Top InfoSec Innovator in 2026 for Software Supply Chain Security.

RapidFort Recognized as a 2026 Top InfoSec Innovator for Software Supply Chain Security

RapidFort Unveiling Industry-First Software Supply Chain Security Advancements in its Award-Winning Solution at Black Hat USA Booth 5704

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced it has been recognized as a Top InfoSec Innovator for 2026, and a finalist in the Software Supply Chain Security category by Cyber Defense Magazine (CDM), the industry’s leading electronic information security magazine.

“RapidFort embodies three major features we judges look for with the potential to become winners: Understanding tomorrow’s threats, today; providing a cost-effective solution; and innovating in unexpected ways that can help mitigate cyber risk and get one step ahead of the next breach,” said Gary S. Miliefsky, Publisher of Cyber Defense Magazine.

RapidFort will unveil industry-first Software Supply Chain Security advancements in its award-winning solution at Black Hat USA in its Booth 5704.

RapidFort will showcase its award-winning solution at Black Hat USA 2026 in its Booth #5704, as well as launch industry-first advancements to help protect organizations through the entire SSCS lifecycle. Visitors will see the demo of the RapidFort continuous threat elimination model which spans intake to build to runtime and includes integrated malware-scanning and tamper-scanning for images and libraries.

“It’s validating to be recognized leading up to Black Hat in one of the most prestigious cybersecurity awards programs in the world from Cyber Defense Magazine, during their 14th anniversary as an independent cybersecurity news and information provider,” said Michael Wood, RapidFort CMO. “Black Hat is the perfect venue to make our significant announcement in the cybersecurity industry, including advancements no one has ever seen before that will best protect organizations from SSCS threats and extend RapidFort leadership ahead of the competition.”

Judging of the award finalists continues through October, when winners will be announced online, in print and during CyberDefenseCon 2026, taking place October 20-21 at The Ritz-Carlton in Orlando. There a select group of winners will showcase their innovative solutions to the Top Global CISOs during the invitation-only conference at https://www.cisoconference.com.

About Cyber Defense Awards

This is Cyber Defense Magazine’s thirteenth year of honoring InfoSec innovators from around the globe. Submission requirements are for any startup, early stage, later stage, or public companies in the information security space who believe they have a unique and compelling value proposition for their product or service. Learn more at www.cyberdefenseawards.com.

About Cyber Defense Magazine

Cyber Defense Magazine is the premier source of cyber security news and information for InfoSec professions in business and government. We are managed and published by and for ethical, honest, passionate information security professionals. Our mission is to share cutting-edge knowledge, real-world stories and awards on the best ideas, products, and services in the information technology industry. We deliver electronic magazines every month online for free, and special editions exclusively for the RSAC Conferences, Black Hat Conferences and Cyber Defense Conferences. CDM is a proud member of the Cyber Defense Media Group. Learn more at https://www.cyberdefensemagazine.com and visit https://www.cyberdefensetv.com and https://www.cyberdefenseradio.com to see and hear some of the most informative interviews of many of these award-winning company executives.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort and ReversingLabs Launch Industry's First Validated Open-Source Package Catalogs

Press Release

July 7, 2026

RapidFort and ReversingLabs Launch Industry's First Validated Open-Source Package Catalogs

Software Supply Chain Security

Compliance & Governance

RapidFort and ReversingLabs launch industry’s first independently validated open-source dependency libraries delivering safe package catalogs.

RapidFort and ReversingLabs Launch Industry’s First Independently Validated Open-Source Dependency Libraries Delivering Safe Package Catalogs

Partnership Verifies Packages are Free of Tampering, Malware and Vulnerabilities Across all Operating Systems, Frameworks and Application Stacks with no Proprietary Package Manager Migration Needed

SAN JOSE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security with the largest distribution of curated truly open-source software, and ReversingLabs (RL), the trusted name in file and software security, today announced a strategic partnership to deliver RapidFort Open-Source Dependency Libraries—the industry’s first and only open-source package catalog to combine RapidFort’s proven curation and hardening process with independent third-party validation powered by ReversingLabs’ Spectra Assure® platform.

RapidFort is the only vendor whose open-source library catalog is independently validated by a separate, named third-party security company—ReversingLabs—using enterprise-grade deep-binary malware detection. As a result of this partnership, every package in the catalog passes through RapidFort’s rigorous multi-stage hardening pipeline and is independently assessed by ReversingLabs to be free of tampering, malware, and known vulnerabilities before it reaches developers’ environments.

Strategic partnership creates industry’s first and only open-source package catalog to combine RapidFort’s proven curation and hardening process with independent third-party validation powered by ReversingLabs’ Spectra Assure® platform.

“ReversingLabs was built on the conviction that software security requires deep binary intelligence,” said ReversingLabs Founder and CEO Mario Vuksan. “Malicious actors are increasingly compromising open-source components, embedding threats deep within the layers of container images that traditional tooling cannot reach. By bringing Spectra Assure’s independent malware analysis to every package in the RapidFort library catalog, together we give enterprises access to open-source dependencies that are both rigorously hardened and independently assessed clean before they ever enter a build pipeline.”

Unlike competing approaches that require migration to proprietary package managers, custom operating system distributions, or vendor-specific toolchains, RapidFort Libraries work with any OS, any framework, and any application package manager through standard pip, Maven, npm, and OS package interfaces teams already use today. For customers, this means reducing time to compliance by three to six months without the migration and lock-in of proprietary package managers, without single-source liability, and without the friction that slows security and development teams down. RapidFort Libraries are a drop-in replacement—no migration, no disruption, no compromise. Existing vendor responses to the open-source supply chain crisis address only parts of this problem, but each imposes new constraints: proprietary OS distributions requiring platform migration, single-ecosystem library coverage, or build-from-source approaches with no independent integrity verification. No vendor prior to today has subjected every library in their catalog to named, independent third-party malware validation.

RapidFort Curation and Hardening Combined with ReversingLabs Validation

The RapidFort–ReversingLabs partnership brings together two complementary capabilities into a single, end-to-end security pipeline. RapidFort contributes its proven attack surface reduction and source-verified hardening process, which has helped enterprise customers eliminate up to 99.9% of CVEs from container images. ReversingLabs adds Spectra Assure, the industry’s leading deep-binary analysis platform for software supply chain security, bringing enterprise-scale malware detection, tampering identification, and independent onboarding governance to every package RapidFort releases.

“ReversingLabs is the gold standard for binary malware analysis,” said Mehran Farimani, CEO with RapidFort. “By embedding Spectra Assure analysis into our library release pipeline as an independent validation gate, we’ve created something the industry has been missing—a library catalog where the security claim is made by a separate company with its own reputation on the line. That’s a fundamentally different level of trust.”

ReversingLabs’ Spectra Assure performs deep binary analysis that goes far beyond signature-based scanning. As a result of this partnership, for public open-source repositories organizations now receive:

Deep malware detection: Binary-level analysis identifies obfuscated malware, hidden backdoors, and malicious payloads that evade traditional signature-based scanners—including novel threats with no prior CVE assignment.
Tampering verification: Cryptographic and structural analysis helps identify evidence of unauthorized modification, repackaging, or tampering within delivered software artifacts.
Threat intelligence correlation: Packages are checked against ReversingLabs’ authoritative Spectra Intelligence dataset covering billions of files and decades of malware research, providing context that no internal scan can replicate.
Differential version analysis: Spectra Assure compares a new package version against previous versions to identify newly introduced malware, tampering, risky behaviors, and unexpected changes in a new package update.
Policy-driven release gates: Packages that fail ReversingLabs’ security policies are blocked from the RapidFort catalog until risks are remediated, providing a preventative rather than reactive security control.
Evidence-backed audit trail: Every package release includes a ReversingLabs-generated security report, giving customers, their auditors, and regulators independently produced documentation of each artifact’s integrity status.

Availability

RapidFort Open-Source Dependency Libraries validated by ReversingLabs Spectra Assure are available today in general availability for Python and Java ecosystems, with JavaScript entering closed beta. OS package coverage for Red Hat, Ubuntu, Debian, and Alpine is available now. Additional language runtimes and application package catalogs are on an accelerated roadmap.

Existing RapidFort customers can enable library coverage immediately through the platform console or by contacting their account team. New customers can learn more and request access at rapidfort.com/libraries. Learn more about ReversingLabs Spectra Assure at https://www.reversinglabs.com/products/spectra-assure.

About ReversingLabs

ReversingLabs is the trusted name in file and software security. We provide the modern cybersecurity platform to verify and deliver safe binaries. Trusted by the Fortune 500 and leading cybersecurity vendors, RL Spectra Core powers the software supply chain and file security insights, tracking over 422 billion searchable files with the ability to deconstruct full software binaries in seconds to minutes. Only ReversingLabs provides that final exam to determine whether a single file or full software binary presents a risk to your organization and your customers. For more information, visit www.reversinglabs.com.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

Linux Foundation Launches Akrites to Defend Open Source Against AI-Enabled Cyber Threats

Press Release

June 25, 2026

Linux Foundation Launches Akrites to Defend Open Source Against AI-Enabled Cyber Threats

Threats

Software Supply Chain Security

Linux Foundation and Industry Leaders Launch Akrites to Defend Critical Open Source Software Against AI-Enabled Cyber Threats

Amazon Web Services, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone and Zscaler join coordinated effort to find, fix and responsibly disclose vulnerabilities in open source software the world runs on

The Linux Foundation, joined by leading organizations, today announced Akrites, a coordinated effort to remediate and disclose vulnerabilities in critical open source software.

Akrites establishes a shared Security Incident Response Team (SIRT) and a single, standardized Coordinated Vulnerability Disclosure (CVD) process, built on confidentiality-first principles and industry-standard tooling.

Founding members commit engineering talent, security expertise and funding to harden the shared open source software that banks, hospitals, power grids, telecoms, governments, and AI labs depend on.

Organizations that contribute engineering resources or funding to the security of critical open source are invited to participate and can learn more at https://akrites.org.

SAN FRANCISCO, June 25, 2026 /PRNewswire/ -- The Linux Foundation, the nonprofit organization enabling mass innovation through open source, today announced Akrites, a coordinated industry effort to harden the world's most critical open source software in the era of AI-assisted vulnerability discovery. Backed by founding commitments from Amazon Web Services, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone and Zscaler, the initiative unites major technology companies, AI labs, financial institutions, and security vendors around a shared mission: to coordinate the remediation of vulnerabilities in widely used open source projects with upstream maintainers before those vulnerabilities can be exploited.

Open source software underpins virtually every layer of the modern digital economy, from banking and healthcare to energy, transportation, telecommunication, and government. Akrites enables industry coordination to support and defend critical infrastructure users and consumers of open source. Previously, finding and fixing serious flaws in open source software demanded comparable expertise from attackers and defenders alike. Today, frontier AI models can scan a major open source project and surface vulnerabilities in minutes. Once access to these capabilities is broadly available, bad actors who previously lacked the technical expertise to mount sophisticated attacks will have the tools they need to do so quickly.

To mark the launch, the founding signatories published a joint open letter to the technology industry, "We All Depend on Open Source. We Will Defend It Together." The full letter is available at https://akrites.org/letter/.

In the past, security response involved a patchwork of organizations often working on the same problems independently, sometimes shipping conflicting patches or burying maintainers under duplicate reports. Akrites changes that model. The initiative provides a single, trusted place to coordinate, remediate and disclose, with a shared SIRT serving as a predictable partner for maintainers rather than a flood of uncoordinated reports. Akrites commits to working with critical infrastructure to support patch deployment before vulnerable systems can be targeted.

Confidentiality is central to the effort. Bug fixes flow back into each project's original home, on maintainers' terms. Where a critical package has no active maintainer, Akrites will serve as maintainer of last resort so fixes to the latest version reach everyone in a timely fashion. The initiative will also coordinate with government efforts so public and private defenders move together.

Alpha-Omega, a directed fund of the Linux Foundation, will provide seed funding to support Akrites. Other organizations that contribute engineering resources or funding to the security of critical open source are invited to participate. To learn more or to join, visit https://akrites.org.

Supporting Quotes

"Frontier AI models have given defenders the ability to find and fix vulnerabilities in open source software at a speed and scale that were never possible before. That's an enormous opportunity for defenders, and Akrites ensures we seize it together. Maintainers deserve a coordinated partnership, not a flood of reports. AWS is committed to securing the projects our customers depend on and building this shared infrastructure alongside the community."
– Matt Wilson, Vice President and Distinguished Engineer, Amazon Web Services

"Open source projects collectively underpin much of the internet, and the existing model for coordinated disclosure has been outpaced by how quickly AI can now find vulnerabilities. Getting ahead of that requires the industry to coordinate on findings and get fixes upstream before they're disclosed and exploited. Efforts like Akrites drive this level of coordination at the scale and speed this moment requires."
– Jason Clinton, Deputy Chief Information Security Officer, Anthropic

"The software supply chain is only as strong as the upstream it draws from, and we see how thin that layer really is. As AI finds more vulnerabilities, the industry will rush to patch them. Without coordination, those fixes will fragment across different patches and forks, and maintainers who are already overwhelmed, unreachable, or haven't touched a project in years. Akrites gives the industry one coordinated way to fix vulnerabilities upstream before they're exploited, with maintainers still in control. Now the work is making sure there's always someone on the other end to catch them."
– Dan Lorenc, CEO and Co-founder, Chainguard

"Finding a serious open source vulnerability used to take an expert weeks. It now takes a machine minutes. When maintainers lose that race, so does everyone else. No single company, no single maintainer, and no single government can close that gap alone. That is why Cisco is bringing its networking infrastructure, security expertise, and decades of open source contribution to Akrites - because defenders cannot afford to lose, and maintainers cannot be left to run this alone."
– Vijoy Pandey, SVP and GM, Outshift by Cisco

"Advances in AI models have significantly reduced the effort required to discover and exploit vulnerabilities. In partnership with the Linux Foundation and Project Akrites, Citi is committed to supporting the open-source ecosystem by helping to build a framework that identifies and remediates vulnerabilities and shares proposed patches. Focused on securing critical infrastructure, this initiative is a key part of our efforts to help the industry mitigate emerging threats."
– Al Tarasiuk, Chief Information Security Officer, Citi

"For years we have believed finding vulnerabilities was never the hard part. Fixing them was. AI has made that gap impossible to ignore. Of the thousands of validated open source vulnerabilities surfaced in recent months, fewer than 5% have been patched. Endor Labs is a founding member of Akrites because it is built for the response this moment needs: coordinated remediation upstream, handled confidentially, with maintainers in control, so one trusted fix reaches everyone who depends on the code."
– Varun Badhwar, CEO and Co-Founder, Endor Labs

"Vulnerability discovery is now moving at a speed that overwhelms both the maintainers who sustain open source projects and the users who rely on them. Uncoordinated reporting, patching, and disclosure create friction, putting the entire ecosystem at risk. No single organization can solve this alone. That is why Ericsson is joining Akrites as a Premier member, contributing funding and talent to a shared effort to keep open source software secure and thriving."
– Mikko Karikytö, Chief Product Security Officer, Ericsson

"As AI accelerates both the scale and speed of vulnerability discovery, defending the open source ecosystem requires an equally rapid, coordinated response. By joining Akrites, we are combining Google's long-standing commitment to open source security with industry-wide expertise to ensure that vulnerabilities are found, fixed, and responsibly disclosed before they can be exploited. Safeguarding the software that powers the world's critical infrastructure is essential to maintaining trust in our digital future."
– Heather Adkins, Vice President Security Engineering, Google

"Open source powers the systems we rely on every day—running everything from banks and hospitals to power grids and AI platforms. As frontier AI accelerates vulnerability discovery, the risk has grown too large for any one organization to address alone. That's why an ecosystem approach is critical, bringing the community, technology providers, and enterprises together to ensure vulnerabilities are addressed and at the new speed required today."
– Jamie Thomas, Enterprise Security Executive, IBM

"AI has massively compressed the time between vulnerability discovery and exploitation to near real time, which means we have to compress the time from fix to deployment. That's why we at JPMorganChase are helping to build this effort to measure success in patch deployment, not patch publication. We support a mechanism that enables downstream operators of critical infrastructure so that fixes reach real systems before adversaries can turn disclosures into exploits. And upstream, we owe maintainers a single, reliable signal: confirmed vulnerabilities, well-tested proposed fixes, and a predictable partner they can trust, rather than a flood of duplicative, conflicting reports."
– Pat Opet, Chief Information Security Officer, JPMorganChase

"OpenSSF and Alpha-Omega demonstrated what is possible when industry comes together to strengthen open source security. Building on our experience co-founding these organizations, Akrites was created to address the emerging inflection point of AI-powered vulnerability discovery and defense. As a founding member, Microsoft will contribute expertise, resources, and AI technologies to help responsibly identify and fix vulnerabilities across the open source software ecosystem that customers and organizations depend on."
– Mark Russinovich, Azure Chief Technology Officer, Deputy Chief Information Security Officer and Technical Fellow, Microsoft

"Transparency and open collaboration are how the cybersecurity community has kept infrastructure safe for decades. In the age of AI, these open source foundations have never been more critical. Open source AI is the engine of American innovation — and one of our most powerful tools for deploying AI with the security, trust, and transparency needed to power this industrial revolution."
– David Reber, Chief Security Officer, NVIDIA

"The world runs on open source, and securing it is a long-term commitment for us at OpenAI. Through Patch the Planet, we're putting our models and resources behind expert-led work that helps maintainers validate issues and land fixes, and we're proud to participate in Akrites to strengthen coordination across the industry and help defend the software we all depend on."
– Clint Gibler, Cyber Lead, OpenAI

"Open source only works when we keep the work open, upstream, and available to everyone who depends on it. The answer to the AI-driven vulnerability crisis is not to fragment the ecosystem behind proprietary walls or turn community foundations into closed products. It must be coordinated remediation that preserves the integrity of original software, works with maintainers, and returns fixes to the commons. We are proud to support the Akrites initiative which aligns with our belief of strengthening the open source ecosystem from within, helping organizations reduce risk without unnecessary code changes, and making the software we all share safer for everyone."
– Mehran Farimani, CEO, RapidFort

"Open source is the foundation of modern software innovation. Defending that foundation requires a coordinated, upstream community response capable of meeting threats at scale. Red Hat's participation in Akrites focuses on strengthening this upstream ecosystem. By collaborating openly to identify and patch vulnerabilities at the source, we help build a more resilient software supply chain for the entire industry."
– Chris Wright, Chief Technology Officer and Senior Vice President, Global Engineering, Red Hat

"For too long, the goodwill and sense of responsibility among upstream maintainers has been taken for granted in security response processes. Akrites promises meaningful coordination with upstream maintainers, financial, and full-time support to find, fix and disclose security vulnerabilities responsibly, and a genuine commitment from the most influential companies across tech and finance to solve this problem. The Rust Foundation looks forward to working with Akrites to develop security that is fit for the future."
– Rebecca Rumbul, Executive Director and CEO, Rust Foundation

"Sonatype sees the dependency graph of the modern world every day. A single vulnerable component can sit underneath thousands of organizations, which means one upstream fix can reduce risk across an entire ecosystem. AI may make vulnerability discovery dramatically easier, but it does not make coordinated repair automatic. Akrites is important because it gives the industry a confidential way to do that work together, upstream, before the same flaw becomes thousands of separate incidents."
– Brian Fox, Co-founder and Chief Technology Officer, Sonatype, and Steward of Maven Central

"With the increasing ability of AI to fast-track vulnerability discovery, now is the right time to come together and invest resources to safeguard critical open-source software on which telecommunications and many other industries rely on. As a founding member, Vodafone has committed both expertise and funding to Akrites. This unified initiative will drive a co-ordinated, industry-wide approach to responsibly identify and fix vulnerabilities in the software that runs the systems upon which the world depends."
– Paul Hopkins, Cyber & IT strategy and Architecture Director, Vodafone

"AI has changed the speed of both offense and defense. Vulnerabilities can now be found at machine speed, which means defenders have to move just as fast. Akrites helps turn that speed into an advantage for the open source ecosystem by finding issues earlier, coordinating remediation responsibly, and pushing fixes upstream. Zscaler is proud to be part of it."
– Deepen Desai, Executive Vice President and Chief Security Officer, Zscaler

About Akrites

Akrites is a coordinated confidential effort to remediate and disclose vulnerabilities in the open source software that critical infrastructure depends on. It provides a single, standardized Coordinated Vulnerability Disclosure (CVD) process operated by a shared Security Incident Response Team (SIRT), built on confidentiality-first principles and the industry's established standards and tooling (CVE, TLP, CWE, CVSS, EPSS, SSVC, VEX). To learn more or to join, visit https://akrites.org.

About the Linux Foundation

The Linux Foundation is the world's leading home for collaboration on open source software, hardware, standards, and data. Linux Foundation projects, including Linux, Kubernetes, Model Context Protocol (MCP), OpenChain, OpenSearch, OpenSSF, OpenStack, PyTorch, Ray, RISC-V, SPDX and Zephyr, provide the foundation for global infrastructure. The Linux Foundation is focused on leveraging best practices and addressing the needs of contributors, users, and solution providers to create sustainable models for open collaboration. For more information, please visit us at linuxfoundation.org.

The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of the Linux Foundation, please see its trademark usage page: www.linuxfoundation.org/trademark-usage. Linux is a registered trademark of Linus Torvalds.

‍

RapidFort and Legion Intelligence Unite to Secure AI Workloads for the Warfighter

Press Release

June 23, 2026

RapidFort and Legion Intelligence Unite to Secure AI Workloads for the Warfighter

Container Security

Threats

RapidFort and Legion Intelligence Unite to Secure AI Workloads for the Warfighter – Delivering Near-Zero CVE, Battle-Ready Artificial Intelligence from the Container Up

RapidFort curated, hardened, near-zero CVE container images are the security backbone of Legion’s battlefield AI platform — ensuring every AI workload deployed to the tactical edge is provably secure, continuously hardened, and mission-ready from the first line of code to the battlefield.

SUNNYVALE, Calif.--(BUSINESS WIRE)--Legion Intelligence, the governed AI platform trusted by U.S. Special Operations Command, the U.S. Department of War, and the U.S. Air Force, today announced a strategic partnership with RapidFort, the leader in software supply chain security for containers. Together, the two companies are redefining what it means to field AI on the battlefield — establishing that every AI workload running in support of the warfighter must be built on a provably secure, near-zero CVE software foundation, from forward-deployed edge systems to air-gapped command posts.

The Problem: AI Workloads Running on Vulnerable Containers Put Warfighters at Risk

Artificial intelligence is now at the center of modern warfighting — driving intelligence synthesis, mission planning, logistics, and real-time decision support. But AI workloads are only as secure as the container infrastructure they run on. Today, most AI systems — including large language models, inference engines, and agent orchestration platforms — are deployed inside containers that inherit thousands of CVEs (Common Vulnerabilities and Exposures) from base images and open-source dependencies.

On a commercial platform, an unpatched container vulnerability is a compliance finding. On the battlefield, it is an attack vector. A single exploitable CVE in an AI workload container can compromise the intelligence feeding a commander’s decision, corrupt a mission plan mid-execution, or hand an adversary a foothold inside the warfighter’s AI decision loop. The DoW cannot afford to field AI that is brilliant but breakable.

The Solution: RapidFort Secures the AI Stack — Legion Executes the Mission

The Legion-RapidFort partnership solves this problem at its root. Rather than patching CVEs after AI workloads are deployed, RapidFort eliminates them before a single AI model, inference container, or agent service ever reaches the battlefield. Legion Intelligence then builds its entire AI platform on this hardened foundation — delivering governed, auditable AI agent orchestration that warfighters can trust with their most sensitive operations.

“The AI workloads we deploy for the warfighter, from intelligence analysis agents to mission planning workflows, need to run inside containers that RapidFort has hardened to near-zero CVEs. That is not a nice-to-have. It is a prerequisite for fielding AI that the U.S. Department of War can trust with sensitive data and high-consequence operations,” said Ben Van Roo, CEO and co-founder, Legion Intelligence. “RapidFort strengthens the security foundation our AI stack is built on, helping Legion deliver governed AI that warfighters can rely on when it matters most.”

How RapidFort Secures Legion’s AI Workloads

Near-Zero CVE AI Container Images: RapidFort library of 35,000+ curated, production-grade container images serves as the secure base for every Legion AI service, including LLM inference engines, agent orchestration runtimes, and data pipeline containers. Built on trusted LTS Linux distributions — Ubuntu, Red Hat, Debian, and Alpine — these images eliminate up to 99.9% of CVEs before Legion’s AI workloads are deployed.
Continuous AI Workload Hardening: The RapidFort platform profiles real runtime behavior inside Legion’s AI containers, identifies unused software components, and automatically removes them — shrinking the exploitable attack surface of every AI workload by up to 90% without requiring code changes, OS changes, or pipeline modifications. Hardened images are rebuilt every 24 hours to stay ahead of emerging threats.
Battlefield-Grade Compliance Automation: RapidFort continuously validates Legion’s AI container stack against STIG, CIS, FedRAMP, and CMMC security benchmarks, generating audit-ready compliance reports that accelerate authorization to operate (ATO) for AI systems in classified and mission-critical environments.
Legion Intelligence AI Agent Orchestration: Built on RapidFort hardened container foundation, Legion’s FedRAMP High–authorized, IL6-capable platform deploys AI agents that automate current operations, intelligence analysis, mission planning, and secure process automation — with full auditability and human oversight — across on-premises, cloud, and air-gapped tactical edge environments.

The combined result is a fully secured AI stack: from the container image layer through the inference runtime to the governed AI agent — every component hardened, every CVE eliminated, and every AI workload continuously monitored and re-hardened as new threats emerge.

AI Workloads Warfighters Can Trust in the Most Contested Environments

Legion’s AI platform — secured end-to-end by RapidFort — delivers mission-critical AI capabilities across the full spectrum of battlefield operations:

AI-Powered Current Operations — real-time intelligence synthesis across all mission systems, accelerating OODA loops and enabling commanders to act faster than adversaries
AI Intelligence Analysis — automated report production and multi-source data fusion, so analysts spend time on judgment rather than chasing and formatting data
AI Mission Planning — situation report generation, training scenario simulation, and mission readiness analysis up to 75% faster than manual processes
Secure AI Process Automation — AI-driven drafting, querying, and content composition on classified networks at IL2 through IL6

All of these AI workloads run inside containers that RapidFort has hardened to near-zero CVEs — deployable on-premises, air-gapped, in a VPC, or at the forward tactical edge, with no vendor lock-in and no inherited vulnerability debt.

“AI workloads are the new high-value target. The models, inference engines, and agent runtimes that warfighters depend on are only as secure as the containers they run in — and most of those containers are shipping with thousands of inherited CVEs,” said Mehran Farimani, CEO and Founder at RapidFort. “RapidFort was built to eliminate that risk at the source. By securing the container foundation of Legion’s entire AI platform, we are ensuring that the AI reaching the battlefield is hardened, continuously monitored, and provably secure — not just powerful.”

Security Compliance and Certifications

The Legion-RapidFort stack is engineered to meet the most demanding government and defense security standards:

FedRAMP High Authorization (Legion Intelligence — January 2026)
IL2 through IL6 deployment support across on-premises, cloud, hybrid, and air-gapped environments
STIG and CIS benchmark-hardened container images (RapidFort)
CMMC, FedRAMP, SOC 2 Type 2, HIPAA, and GDPR compliance readiness acceleration
Continuous CVE remediation with automated compliance validation and audit-ready reporting

About Legion Intelligence

Legion Intelligence builds the Command Layer for mission-critical operations, helping defense, federal, and enterprise teams turn human intent into governed AI work across existing systems. Trusted by U.S. Special Operations Command, the U.S. Army, the U.S. Air Force, and the U.S. Department of Energy, Legion connects data, tools, models, and workflows through role-specific Mission Packs so agents can execute with auditability, governance, and human oversight. Legion deploys across cloud, on-premises, classified, air-gapped, edge, hybrid, and DDIL environments through Centurion, and is FedRAMP High authorized. Learn more at legionintel.com.

About RapidFort

RapidFort is the leader in Software Supply Chain Security, enabling organizations to eliminate risk across their software stack at scale. Its platform combines curated near-zero CVE container images, runtime profiling, and attack surface management to remove up to 99.9% of vulnerabilities within hours and reduce the attack surface by up to 90% without code changes. RapidFort was identified as a Gartner® Cool Vendor™ in 2025 and a Nutanix.Next Partner of the Year in 2026. For more information, visit www.RapidFort.com.

‍

RapidFort Recognized in 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security

Press Release

June 22, 2026

RapidFort Recognized in 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security

Software Supply Chain Security

RapidFort Platform

RapidFort recognized in 2026 Gartner Magic Quadrant for Software Supply Chain Security report for delivering mandatory features for the SSCS market.

RapidFort Recognized in 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security for Delivering Mandatory Features for SSCS Market

Gartner Magic Quadrant Highlights Vendors Delivering Third-Party Software Risk Protection, Software Bill of Materials and Threat Intelligence while Demonstrating Ability to Execute and Completeness of Vision

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, a leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced it has been recognized in the just-released 2026 Gartner Magic Quadrant for Software Supply Chain Security report 1, which provides evaluations of 18 vendors.

According to Gartner, “Software supply chain security has grown from a niche concern into a top enterprise priority, supported by a rapidly maturing market. Gartner estimates that SSCS market revenue exceeded $2.8 billion in 2025, up from $2.5 billion in 2024 and $2.2 billion in 2023. Gartner forecasts that the SSCS market will exceed $5 billion in revenue by 2030.” 1

RapidFort included in Gartner Magic Quadrant report that highlights vendors delivering third-party software risk protection, software bill of materials and threat intelligence while demonstrating ability to execute and completeness of vision.

For its report, Gartner considered SSCS products or services that deliver “software composition analysis, third-party software governance, software bill of materials life cycle management, continuous threat intelligence, third-party reputation analysis, and all other additional features.” 1

“We believe Gartner has specific requirements for the select vendors included in the SSCS Magic Quadrant, and we are pleased to be recognized as delivering the mandatory features for this market, including additional features such as protection from third-party AI components, including large language models (LLMs) and Model Context Protocol (MCP) servers,” said Michael Wood, CMO with RapidFort. “RapidFort is differentiated in the industry with the largest and most comprehensive catalogue of curated genuinely open-source software, and we see customers select RapidFort because of our end-to-end continuous threat elimination platform.”

According to Gartner, “SSCS products have recently evolved in five ways, including OS image security, curated registries and rebuild factories are growing, as vendors seek to harden the upstream supply and offer pre-vetted components.”1

A complimentary copy of the 2026 Gartner Magic Quadrant for Software Supply Chain Security is available at https://go.rapidfort.com/gartner-magic-quadrant-software-supply-chain-security.

1 Gartner, Magic Quadrant for Software Supply Chain Security, Aaron Lord, Johnny Walters, Jason Gross, 17 June, 2026.

Gartner and Magic Quadrant are trademarks of Gartner, Inc., and/or its affiliates.

Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner’s business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose.

About RapidFort

RapidFort is the leader in Software Supply Chain Security, enabling organizations to eliminate risk across their software stack at scale. Its platform combines curated near-zero CVE container images, runtime profiling, and attack surface management to remove up to 99.9% of vulnerabilities within hours and reduce the attack surface by up to 90% without code changes. RapidFort was identified as a Gartner® Cool Vendor™ in 2025 and a Nutanix.Next Partner of the Year in 2026. For more information, visit www.RapidFort.com.

‍

RapidFort Launches Curated Libraries to Stop Attacks Before They Reach the Pipeline

Press Release

June 11, 2026

RapidFort Launches Curated Libraries to Stop Attacks Before They Reach the Pipeline

Software Supply Chain Security

Secure Base Images

RapidFort Curated Libraries help organizations secure the software supply chain at the source without disrupting existing development processes.

RapidFort Launches Curated Libraries to Stop Supply Chain Attacks Before They Reach the Pipeline

RapidFort expands its security platform with curated, third-party malware-scanned libraries to enhance protection of software at the source

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security, today announced the availability of RapidFort Curated Libraries, a comprehensive catalog of malware-scanned open-source libraries to help organizations prevent supply chain malware before it reaches development pipelines or production environments.

RapidFort Curated Libraries give developers access to curated, malware-scanned open-source packages for npm, PyPI, Maven, RubyGems, and NuGet ecosystems. Developers are able to continue using the libraries they already know while reducing exposure to malicious binaries, backdoored dependencies, install-time payloads, typosquatted packages, credential stealers, droppers, downloaders, infostealers, keyloggers, rootkits, ransomware, and other supply chain threats.

“Modern software teams depend on open-source packages to move quickly, but every package downloaded into a development workflow introduces risk,” said Michael Wood, CMO at RapidFort. “RapidFort Curated Libraries give developers the power to move at DevOps speed while giving organizations the confidence that their applications and services have been vetted by the world’s most advanced threat intelligence solutions.”

RapidFort already provides more than 35,000 near-zero CVE curated images, runtime bill of material analysis, and the industry's most comprehensive software supply chain security platform. With RapidFort Curated Libraries, the company extends that protection to third-party application libraries, helping enterprises and public sector organizations secure the software supply chain at the source.

Mitigating Malware Before It Enters the Software Supply Chain

Recent software supply chain incidents have demonstrated how attackers increasingly target open-source ecosystems and developer workflows. Compromised packages and dependencies have affected widely used projects and repositories across popular application ecosystems.

RapidFort Curated Libraries are designed to stop these threats from entering an organization by ensuring developers access only open-source software that is curated and independently malware-scanned.

DevOps Velocity and SecOps Protection

RapidFort Curated Libraries leverage “The Power of And”: DevOps velocity and SecOps protection.

Developers can continue using the same pin-for-pin compatible libraries, packages, CLI syntax, interfaces, features, versions, and workflows they rely on today. RapidFort Curated Libraries work with existing operating systems, tools, artifactories, and software delivery processes without requiring teams to migrate to a proprietary operating system or vendor-specific development models.

Key benefits include:

Malware scanning at the source: RapidFort helps prevent malicious packages and compromised dependencies from entering software pipelines.
Existing workflow support: RapidFort Curated Libraries work with current operating systems, tools, artifactories, interfaces, and CLI syntax.
Reduced incident response burden: Security and engineering teams can spend less time hunting for malware and vulnerabilities after public disclosures of threats.
Continuous compliance visibility: RapidFort supports up-to-date compliance assessment and reporting based on frequent updates, helping organizations demonstrate security posture to internal stakeholders, auditors, customers, clients, and boards of directors.
Policy-driven security: Organizations can shift from reactive vulnerability response to a proactive, policy-driven model for open-source software consumption.

Helping Developers Ship With Confidence

Open-source software powers modern innovation, but its scale and speed create new challenges for today’s security teams. RapidFort Curated Libraries allow organizations to continue benefiting from the global open-source ecosystem while reducing the risk that compromised packages, malicious payloads, or newly introduced malware will impact production systems.

“RapidFort has really helped us get ahead of the curve in vulnerability management of our application images, which is critical to delivering ATO-ready software to our customers," said Wesley Smith, President and CTO at Tactical ID. "We're excited that we can now give developers the packages they need while ensuring those packages are curated, malware-scanned, and compatible with the way teams already build software.”

Availability

RapidFort Curated Libraries are available today for organizations seeking to secure open-source software consumption across package libraries, operating systems, images, middleware, and development workflows. Customers can use RapidFort Curated Libraries alongside the RapidFort Curated Images catalog, runtime bill of material analysis, and compliance reporting capabilities.

For more information, visit www.rapidfort.com/libraries

About RapidFort

RapidFort is the leader in Software Supply Chain Security, enabling organizations to eliminate risk across their software stack at scale. Its platform combines curated near-zero CVE container images, runtime profiling, and attack surface management to remove up to 99.9% of vulnerabilities within hours and reduce the attack surface by up to 90% without code changes. RapidFort was identified as a Gartner® Cool Vendor™ in 2025 and a Nutanix.Next Partner of the Year in 2026. For more information, visit www.RapidFort.com.

‍

Knox Systems & RapidFort Join Forces to Defend Against Mythos-Generated CVE Threats & Speed FedRAMP Compliance

Press Release

May 20, 2026

Knox Systems & RapidFort Join Forces to Defend Against Mythos-Generated CVE Threats & Speed FedRAMP Compliance

Threats

Compliance & Governance

Knox Systems and RapidFort Join Forces to Defend Against Mythos-Generated CVE Threats and Fast-Track FedRAMP Compliance

Alliance Provides SaaS Vendors with Bundled FedRAMP 20-Ready Images to Accelerate Authorization and Prepare for AI-Driven Attacks

SAN FRANCISCO & NEW YORK--(BUSINESS WIRE)--Knox Systems, the largest federal AI-managed cloud provider, and RapidFort, the leader in Software Supply Chain Security, today announced a significant expansion of their strategic partnership. Effective immediately, Knox subscribers gain bundled access to RapidFort Federal Information Processing Standards (FIPS) 140-3 curated container images as part of their existing subscription. This expanded offering eliminates a critical compliance bottleneck on the FedRAMP path and provides a hardened, continuously maintained security foundation designed to withstand the AI-accelerated vulnerability landscape.

Knox and RapidFort share a unified mission: unlock cutting-edge commercial software for federal agencies by streamlining compliance and reducing the attack surface. Through this partnership, customers receive:

Faster FedRAMP 20 Certification: Knox already enables vendors to inherit 60–80% of required FedRAMP controls on day one, compressing authorization timelines to approximately 90 days without requiring agency sponsorship. The addition of RapidFort FIPS 140-3 curated images removes the next largest obstacle — container image compliance — from the vendor's plate entirely. Teams that previously spent weeks hardening images, negotiating Security Technical Implementation Guide (STIG) and Center for Internet Security (CIS) benchmarks, and resolving FIPS cryptographic validation issues can now deploy against a pre-validated, continuously maintained foundation from first login.
Structural CVE Defense, Not Reactive Patching: RapidFort near-zero CVE images are maintained continuously. As attack vectors like Mythos, the Anthropic AI system that autonomously discovers and exploits zero-day vulnerabilities, emerge and accelerate vulnerability weaponization, Knox customers can operate from a baseline that is already hardened. When the next Mythos-discovered vulnerability surfaces, organizations on this stack present a dramatically reduced attack surface compared to those relying on unmanaged community images.
Simplified Adoption, Unified Cost: The bundled model eliminates the procurement complexity of managing separate image licensing. Knox subscribers gain access to both FIPS and non-FIPS variants across all major operating system (OS) distributions — Ubuntu, Red Hat, Alpine, and Debian, including Bitnami and official-image versions — under a single subscription and a single repository, with no per-image licensing fees and no vendor lock-in. Integration requires no source code changes and fits directly into existing Continuous Integration/Continuous Delivery (CI/CD) pipelines.

“FedRAMP 20x and the White House’s recent Memorandum 26-12 signal that the government wants to rapidly increase the use of commercial technology without sacrificing security,” said Irina Denisenko, CEO of Knox Systems. “At Knox, we are answering the call by enabling SaaS companies to achieve ATO faster and more cost-effectively. The addition of RapidFort’s FIPS images enables us to speed up the process even more while continuing to save valuable IT resources.”

“Since the outset of our partnership, we have proven that Knox and RapidFort are better together. Now we are making that combination the default,” said Mehran Farimani, CEO of RapidFort. “Every Knox customer automatically gets the most compliant and hardened container image foundation available anywhere - FIPS 140-3 validated, STIG and CIS benchmarked, and maintained at near-zero CVE. D.”

Existing Knox customers can activate RapidFort curated images through their Knox subscription portal. New customers receive access automatically upon onboarding.

About Knox Systems

Knox Systems operates the largest managed federal cloud, trusted by top agencies and partners across defense and civilian sectors. Built for speed, resilience, and compliance, Knox delivers FedRAMP authorization in 90 days - turning the biggest bottleneck in government IT into the fastest path to modernization. Knox proudly serves Adobe, Celonis, OutSystems, Armis, BigID and more AI and SaaS providers, accelerating secure innovation across the federal landscape. Learn more at www.knoxsystems.com.

About RapidFort

RapidFort is the leader in Software Supply Chain Security, enabling organizations to eliminate risk across their software stack at scale. Its platform combines curated near-zero CVE container images, runtime profiling, and attack surface management to remove up to 99.9% of vulnerabilities within hours and reduce the attack surface by up to 90% without code changes. RapidFort was identified as a Gartner® Cool Vendor™ in 2025 and a Nutanix .Next Partner of the Year in 2026. For more information visit www.RapidFort.com.

‍

RapidFort Named Nutanix Cloud Native Partner of the Year

Press Release

May 15, 2026

RapidFort Named Nutanix Cloud Native Partner of the Year

RapidFort Platform

Cloud Security Fundamentals

RapidFort Awarded Nutanix Cloud Native Partner of the Year at Nutanix’s .NEXT Event

Nutanix recognizes RapidFort for advancing secure, cloud-native application delivery with near-zero vulnerability software supply chain security

WASHINGTON--(BUSINESS WIRE)--RapidFort, the leading software supply chain security platform delivering near-zero CVE container images and continuous vulnerability remediation, announced today during Nutanix’s .NEXT conference that it has been awarded the Nutanix Cloud Native Partner of the Year Award.

Nutanix recognized RapidFort as the recipient of a 2026 partner award for its innovation in helping customers secure and optimize cloud-native applications across hybrid and multi-cloud environments. RapidFort was recognized for enabling organizations to dramatically reduce their attack surface through automated container image hardening, continuous vulnerability removal, and compliance assurance, helping enterprises deploy and run applications on Nutanix infrastructure.

Through its partnership with Nutanix, RapidFort empowers joint customers to accelerate secure application delivery by combining the Nutanix Kubernetes Platform with RapidFort’s end-to-end software supply chain security capabilities. This includes real-time vulnerability remediation, generation of SBOMs and RBOMs, and access to a curated catalog of near-zero CVE container images, allowing customers to build and operate secure, compliant, and production-ready applications faster.

“We are proud to have honored RapidFort at .NEXT this year for their outstanding efforts in enabling customer success with Nutanix,” said Tarkan Maner, President and Chief Commercial Officer at Nutanix. “At a time when Enterprise AI, cloud-native, and hybrid cloud technologies are reshaping industries, RapidFort’s commitment to the Nutanix vision ensures that our customers can truly ‘Run Anything, Anywhere’ on a secure, future-proof platform.”

“Winning the Nutanix Partner of the Year Award is a strong validation of our shared mission to help enterprises build and run secure, cloud-native applications without compromise,” said George Manuelian, Co-Founder and CSO of RapidFort. “Together with Nutanix, we are enabling organizations to eliminate vulnerabilities at the source, reduce operational risk, and accelerate innovation across hybrid and multi-cloud environments.”

RapidFort and Nutanix continue to collaborate to deliver integrated solutions that simplify security across the software lifecycle, from build through production, while ensuring compliance with frameworks such as FedRAMP and CMMC. This partnership enables organizations, including those in highly regulated sectors, to confidently deploy modern applications with reduced risk and increased operational efficiency.

About RapidFort

RapidFort is the industry’s leading software supply chain security platform, built to help organizations quickly ship safer software with less overhead across any operating system. RapidFort automates vulnerability remediation at scale, eliminating up to 95% of vulnerabilities without requiring code changes. Operating system–agnostic and vendor-neutral by design, the platform enables organizations to secure software across container environments without platform or vendor lock-in.

With a free tier and hardened community images, RapidFort makes secure development accessible to teams of any size. Learn more at rapidfort.com.

‍

RapidFort Partners with Nutanix to Deliver Secure Kubernetes for Enterprise AI

Press Release

March 25, 2026

RapidFort Partners with Nutanix to Deliver Secure Kubernetes for Enterprise AI

Container Security

Cloud Security Fundamentals

RapidFort partners with Nutanix to help enterprises scale Kubernetes for AI workloads while reducing risk, compliance burden, and operational burden.

RapidFort Partners with Nutanix to Deliver Secure, Compliant Kubernetes at Development Speed for Enterprise AI Workloads

Collaboration with Nutanix enables enterprise teams to innovate without compromise with hardened containers and accelerated compliance, at scale.

AMSTERDAM--(BUSINESS WIRE)--KubeCon + CloudNativeCon – RapidFort, the leader in end-to-end software supply chain security, today announced a strategic partnership with Nutanix, a leader in hybrid multicloud computing, to address a growing challenge for enterprises adopting Kubernetes at scale: maintaining speed and agility without expanding security and compliance risk.

Through this new partnership, RapidFort will integrate its automated software supply chain security capabilities with the Nutanix Kubernetes Platform (NKP) solution. RapidFort’s Platform and curated near-zero CVE images enable customers to deploy continuously hardened software artifacts remediated with every release across data center, edge, and public cloud environments. This integration will help organizations running NKP strengthen the security of their cloud-native workloads while maintaining the speed developers expect. By extending protection into the software supply chain, RapidFort enables customers to build and operate secure Kubernetes environments for modern applications, including AI and generative AI initiatives.

This integration builds on the strong security foundation Nutanix customers already expect, extending protection into the software supply chain for cloud‑native deployments running on the Nutanix Cloud Platform solution. With RapidFort’s curated near-zero CVE images and automated vulnerability remediation, organizations can deploy hardened cloud-native workloads with dramatically reduced attack surface across on-prem, edge, OEM partner platforms, and public cloud environments.

“Integrating RapidFort into the Nutanix Kubernetes Platform gives our customers access to a platform with hardened software artifacts. It’s a big step forward in making Kubernetes environments more secure everywhere they run,” said Dan Ciruli, vice president and general manager, Cloud Native, at Nutanix.

“The Nutanix Kubernetes Platform meets the enterprise foundation team’s need to run Kubernetes consistently across datacenter, edge, and public cloud,” said George Manuelian, Co-Founder and CSO of RapidFort. “RapidFort complements NKP by continuously eliminating vulnerabilities and reducing attack surface in the workloads deployed into those environments—so customers can move faster while reducing risk and accelerating compliance.”

Scaling Kubernetes More Securely

The partnership:

Enables containers and VMs to run consistently across data center, edge, and public cloud.
Reduces operational burden through automated vulnerability remediation.
Gives platform and security teams clear, auditable controls for compliance.

Extending Security Across NKP

The collaboration also:

Brings RapidFort’s hardened software supply chain protections to workloads running on NKP.
Delivers curated, near-zero-CVE hardened container images by default.
Aligns RapidFort’s automated remediation with NKP’s policy-driven guardrails.

Mitigating Rising Software Supply Chain Risk

With RapidFort integrated into NKP, organizations can:

Eliminate reactive patching by fostering a proactive, secure-by-design posture throughout the entire software lifecycle.
Secure the supply chain with cryptographic proof of provenance, ensuring the integrity of every library from source to deployment.
Protect production environments by mandating that only verified, hardened, and risk-reduced artifacts are deployed to production.

Analyst Commentary

"Sovereign AI and Sovereign Cloud demand more than just localized data; they demand a hardened, minimalist software supply chain. Container platforms must prioritize security optimized libraries to enable secure-by-default container management approaches, giving customers a streamlined path to compliance in the world’s most demanding digital environments,” said Gary Chen, Research Director, IDC.

The newly integrated RapidFort and Nutanix solution will be available to all NKP customers and users regardless of tier (Starter, Pro, and Ultimate). It is expected to be generally available to customers later this year.

About RapidFort

With a free tier and hardened community images, RapidFort makes secure development accessible to teams of any size. Learn more at rapidfort.com.

‍

Trellix Partners with RapidFort to Strengthen Supply Chain Security

Press Release

February 23, 2026

Trellix Partners with RapidFort to Strengthen Supply Chain Security

Software Supply Chain Security

RapidFort Platform

Trellix strengthens software supply chain security with RapidFort, delivering hardened images, reduced attack surface, and rapid CVE response.

Trellix Partners With RapidFort to Strengthen Software Supply Chain Security Across Product Portfolio

Strategic collaboration delivers hardened container images, reduced attack surface, and accelerated vulnerability response

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced Trellix, the company delivering the future of AI-powered cybersecurity, has selected the RapidFort platform and curated images to secure both first-party and third-party software components across its entire product ecosystem.

With a mission to address critical software supply chain security challenges, Trellix identified the need for a security partner capable of reducing software vulnerabilities in container images while maintaining operational efficiency. By adopting RapidFort's platform, Trellix benefits from hardened, curated images with minimized attack surfaces and automated remediation workflows across its comprehensive product suite.

"In today's threat landscape, securing the software supply chain is critical to delivering enterprise-grade security solutions our customers can trust,” said Randy Dougherty, Chief Information Officer at Trellix. "By hardening our software from the inside out, we're helping set a new security standard for product development and strengthening our cloud exposure management portfolio."

Key benefits for Trellix customers include:

Enhanced Software Supply Chain Security: Comprehensive protection for both proprietary and third-party software components throughout the development lifecycle
Rapid CVE Response: Accelerated identification, prioritization, and remediation of vulnerabilities, reducing exposure windows and strengthening security posture
Optimized Container Images: Significantly reduced image footprint and attack surface through intelligent removal of unnecessary components
Improved Operational Efficiency: Smaller, hardened images result in faster deployments, reduced storage costs, and streamlined maintenance

“Software supply chains have become a primary attack vector, and organizations need solutions that address vulnerabilities before they reach production," said Mehran Farimani, CEO of RapidFort. "Trellix's decision to adopt our platform ensures that enterprises start with a secure, dependable software foundation that supports their products at scale.”

The partnership delivers immediate value by further strengthening Trellix's security posture and optimizing deployment workflows. The RapidFort platform automatically patches and optimizes base images while intelligently removing unused components, resulting in container images that are 30% smaller than traditional distroless images and contain 20% fewer CVEs. After evaluating multiple solutions, Trellix replaced its previous vendor with RapidFort, achieving these measurable improvements with no migration efforts or software porting required through drop-in replacements for existing images.

For Trellix customers, this partnership translates into immediate security benefits: enhanced protection through products built with a fortified software foundation, reduced vulnerability exposure from hardened components, and faster security updates through rapid CVE identification and remediation. The implementation spans Trellix's comprehensive product suite, ensuring consistent security standards and supply chain integrity across all customer deployments.

This partnership reinforces Trellix's position as a trusted cybersecurity vendor that practices the same rigorous security principles it advocates for its customers. With a free tier and community-maintained images, RapidFort makes secure development accessible to teams of any size. Learn more at https://www.rapidfort.com.

About RapidFort

RapidFort delivers a modern software supply chain security platform built to help organizations ship safer software with less overhead. Its curated near-zero-CVE container images, automated vulnerability remediation, runtime intelligence, and built-in hardening tools reduce noise, shrink attack surfaces, and keep applications secure from build to production. Through intelligent analysis and optimization, RapidFort enables enterprises to deploy secure, efficient container images while maintaining full functionality. The platform serves Fortune 500 companies and security-conscious organizations worldwide.

‍

RapidFort Raises $42 Million Series A to Accelerate Supply Chain Security Innovation

Press Release

February 3, 2026

RapidFort Raises $42 Million Series A to Accelerate Supply Chain Security Innovation

RapidFort Platform

Software Supply Chain Security

RapidFort raises $42M to scale a new approach to automated software supply chain security, and combat increasing vulnerability exploitation.

RapidFort Raises $42M Series A Led by Blue Cloud Ventures and Forgepoint Capital to Power the Next Generation of Software Supply Chain Defense

Strategic collaboration delivers hardened container images, reduced attack surface, and accelerated vulnerability response

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the technical leader defining the next generation of software supply chain security, today announced $42 million in Series A funding led by Blue Cloud Ventures and Forgepoint Capital, with participation from prior lead investor Felicis Ventures. Additional participants include Alumni Ventures, Boulder Ventures, Brave Capital, Evolution Ventures, Florida Funders, Gaingels, and Mana Ventures.

This funding arrives at a defining moment for cybersecurity and software delivery. AI has dramatically accelerated how software is built and shipped, and attackers are moving just as fast. As the window between vulnerability disclosure and exploitation continues to shrink, organizations can’t rely on quarterly patch cycles, manual triage, or “scan-and-pray” security. RapidFort’s accelerating revenue momentum reflects the market’s shift toward continuous, automated vulnerability elimination. According to Verizon’s latest Data Breach Investigations Report, vulnerability exploitation now accounts for 20% of breaches, nearly matching credential abuse at 22%. The message is unmistakable: vulnerability management must shift from reactive detection to continuous elimination.

“Software teams are shipping faster than ever—and attackers are moving even faster. RapidFort is building what the market urgently needs: continuous vulnerability remediation that keeps pace with modern development. Their end-to-end platform doesn’t just surface risk—it eliminates it. We’re excited to partner with RapidFort as they define the next era of software supply chain security,” said Rami Rahal, Managing Partner at Blue Cloud Ventures.

A New Category: Continuous Remediation for the Software Supply Chain

RapidFort is setting a new standard: remediation at machine speed, built directly into the software delivery pipeline. RapidFort secures the entire software lifecycle—from build through runtime—by continuously analyzing, remediating, hardening, and protecting software artifacts so vulnerabilities don’t survive long enough to become incidents.

“The problem isn’t that organizations don’t know they have vulnerabilities, it’s that they can’t fix them fast enough,” said Mehran Farimani, Founder and CEO of RapidFort. “AI has accelerated software delivery and attacker capability at the same time. The window between disclosure and exploitation has collapsed. RapidFort exists to eliminate vulnerabilities continuously—at machine speed—before they reach production.”

RapidFort combines automated vulnerability remediation with one of the industry’s most comprehensive catalogs of hardened, near-zero-CVE container images across major Linux distributions, enabling teams to dramatically reduce risk in days, not months.

Why RapidFort Wins: From “Finding Fires” to “Stopping Them”

RapidFort goes beyond scanning and detection. The platform eliminates risk through:

Automated remediation: Continuous vulnerability removal embedded in CI/CD workflows, enabling teams to fix issues as software ships, not weeks later.
Near-zero-CVE containers: Drop-in, hardened images across major Linux distributions that dramatically reduce CVEs without code changes, eliminating security debt from day one.
Runtime intelligence: Behavioral analytics and image optimization that remove unused components, reducing attack surface by up to 90 percent.
End-to-end hardening: Automated hardening and validation from build through production for consistent security across environments.
Compliance-ready security: Built for regulated environments, supporting programs such as FedRAMP, CMMC, ATO, CRA and NIS2 with continuous risk reduction and auditable security controls.

Investing in the Future of Software Security for the AI Era

The Series A funding will accelerate RapidFort’s next phase of growth across product innovation, platform expansion, and enterprise adoption:

Go-to-Market Expansion: Scaling sales, marketing, and partnerships to meet increasing demand for automated remediation
Platform Innovation: Advancing automated remediation, near-zero-CVE software delivery, and continuous attack surface reduction
Enterprise Adoption: Supporting deployments in regulated industries with deeper integrations, smoother onboarding, and operational scalability
Software Supply Chain Assurance: Expanding end-to-end lifecycle security from build through runtime to ensure continuous protection and compliance

“RapidFort represents the evolution of software supply chain security from reactive to proactive,” said Ernie Bio, Managing Director at Forgepoint Capital. “In an AI-accelerated threat landscape, detection alone is table stakes. What matters is elimination. RapidFort is the only platform that combines comprehensive profiling, automated rebuilding, intelligent patching, and continuous validation at enterprise scale. We’re thrilled to partner with Mehran and the team as they define the new standard for software supply chain security.”

“What’s compelling about RapidFort is that it treats software artifacts as infrastructure. By hardening and validating images continuously, the platform creates a security foundation that scales across teams, tools, and environments—without forcing developers to change how they build,” said Jimmy Park, Vice President at Forgepoint Capital.

Learn more at rapidfort.com.

About RapidFort

RapidFort delivers the modern software supply chain security platform built for the AI era. Through automated vulnerability remediation, curated near-zero-CVE container images, runtime intelligence, and continuous hardening, RapidFort helps organizations eliminate vulnerabilities at the speed of development and accelerate compliance readiness. From startups to Fortune 500 enterprises, RapidFort enables teams to reduce attack surface, shrink security debt, and ship safer software with less overhead.

‍

Azul Launches Technology Alliance Partner Program to Accelerate Innovation and Expand the Ecosystem of Java Solutions

Press Release

January 21, 2026

Azul Launches Technology Alliance Partner Program to Accelerate Innovation and Expand the Ecosystem of Java Solutions

New program fosters deep collaboration between Azul and technology partners to deliver integrated solutions that improve developer productivity, DevOps efficiency, business productivity and cloud efficiency for Java customers worldwide.

No items found.

Azul Launches Technology Alliance Partner Program to Accelerate Innovation and Expand the Ecosystem of Java Solutions

SUNNYVALE, Calif.--(BUSINESS WIRE)--Azul, the only company 100% focused on Java, today announced the launch of the Azul Technology Alliance Partner (TAP) Program, a global initiative designed to strengthen collaboration with leading technology providers, accelerate innovation and expand the Java ecosystem.

The TAP program provides a formal framework for joint technical integrations, solution development, and go-to-market activities between Azul and its alliance partners. By joining the TAP program, partners gain access to Azul’s innovative products, Java expertise, joint marketing initiatives, sales team and channel to bring high-value, validated solutions to market faster for their shared customers. TAP is part of Azul’s overall PartnerConnect Program – in addition to technology alliance ISVs, Azul’s broader PartnerConnect ecosystem includes solution providers, authorized value-added resellers and authorized distributors.

New program fosters deep collaboration between Azul and technology partners to deliver integrated solutions that improve developer productivity, DevOps efficiency, business productivity and cloud efficiency for Java customers worldwide

Empowering ISVs with Java Innovations, Co-Sell Opportunities and Market Expansion

By partnering with Azul, ISVs realize several benefits, including:

Technical collaboration with Azul product managers and engineers to aid solution integration and optimization.
Accelerated innovation and development via access to cutting-edge Java technologies, expertise and resources that can accelerate product development.
Joint marketing initiatives, including co-branded content, events and campaigns.
Access to new markets and customer segments that can significantly boost sales and brand awareness.
Access to Azul’s ecosystem, connecting partners with the world’s leading Java innovators and community.

Maximizing Customer ROI Through Azul’s Technology Alliance Ecosystem

Azul’s Technology Alliance Partner Program delivers tangible customer value by integrating best-of-breed Java technologies to provide solutions in four key areas:

Developer Tools & Productivity – Enabling developers to be more productive — writing better code faster, deploying more frequently and responding rapidly to production security issues.
DevOps Efficiency – Improving the automation and optimization of key aspects of the development and IT operation lifecycle.
Business Benefit/Productivity Software – Driving the company’s top-line revenue growth through improved Java application performance and metrics (e.g., KPIs).
Cloud Cost Savings/Infrastructure Cost Reduction – Reducing Java’s infrastructure footprint and right-sizing compute resources without sacrificing performance.

Together, these benefits make Azul’s partner ecosystem a powerful force multiplier for enterprises seeking to maximize the value of their Java investments.

The inaugural TAP members include leading companies in supply chain security, development and modernization. Azul will continue expanding the program throughout 2025 with additional partners across key technology categories.

Real World Customer Impact from Working with Azul and its ISVs

Azul’s growing ecosystem of technology partners is delivering tangible business outcomes for customers – the following are real-world examples of how organizations across industries are benefiting from Azul’s integration with leading technology providers:

Moderne – A global online employment marketplace vendor using Azul Intelligence Cloud to surface unused and dead code estimated it would take 21 person-years to remove all their unused code. By applying Moderne’s OpenRewrite-based platform with Azul’s runtime intelligence, the company automated that remediation, doing in days what would have taken years. They were able to go from a project that was often ignored or handled sparingly to one that can be tackled decisively at scale.

“Modernizing enterprise Java applications is a massive challenge. Moderne enables our customers to tackle technical debt at scale — bringing entire fleets of applications forward in parallel,” said Jonathan Schneider, CEO and co-founder of Moderne. “Partnering with Azul gives us the real-time data to drive transformations across codebases faster and with greater confidence.”
‍
Payara – A large securities industry foundation needed to modernize its aging financial education platform used by thousands of users. By migrating to Payara Platform Enterprise, which includes Azul Platform Core and Azul Platform Prime as the default JVMs, the foundation increased user capacity per machine by 2.5 times while unlocking scalability opportunities.

“Payara is committed to delivering cloud-native Java solutions for global enterprises, from powerful runtimes to Payara Qube — our Kubernetes-native automation platform that simplifies and scales Java deployments,” said Steve Millidge, CEO and founder of Payara. “The Azul TAP program creates exciting opportunities for deeper collaboration that brings customers better performance, stronger security and more choice across their Java deployments.”
‍
RapidFort – A U.S. wealth management firm was struggling with CVE remediation. Instead of chasing enormous CVE patch backlogs, the firm chose to focus solely on the vulnerabilities within its applications, while RapidFort and Azul focused on the rest (e.g., RapidFort containers embedded with Azul Java runtimes). This resulted in a significant improvement in developer productivity and the velocity of new deployments.

“Performance and security go hand in hand, especially in cloud environments where efficiency is critical,” said George Manuelian, co-founder of RapidFort. “By joining Azul’s TAP program, we’re giving enterprises the ability to optimize Java workloads with a dramatically smaller attack surface and lower cloud costs.”

“Java remains the backbone of modern enterprise and cloud-native applications, and at Azul, our mission is to give enterprises more — more performance, more value and more choice,” said George Gould, senior vice president, Corporate Development and Strategic Alliances at Azul. “The Technology Alliance Partner Program is a powerful catalyst for innovation, enabling Azul and our ecosystem partners to co-create solutions that streamline development and operations, as well as make Java run more securely and more cost-effectively across today’s distributed environments. By aligning with technology leaders who share our vision, we can help our joint customers boost application performance, reduce costs and enhance security across their Java landscape.”

For more information about the Azul Technology Alliance Partner Program and how to participate, please visit https://www.azul.com/partners/type/technology-alliance-program.

About Azul Systems Inc.

Headquartered in Sunnyvale, California, Azul provides the Java platform for the modern cloud enterprise. Azul is the only company 100% focused on Java. Millions of Java developers, hundreds of millions of devices and the world’s most highly regarded businesses trust Azul to power their applications with exceptional capabilities, performance, security, value, and success. Azul customers include 36% of the Fortune 100, 50% of Forbes top 10 World’s Most Valuable Brands, 10 of the world’s top 10 banks and leading brands like Avaya, Bazaarvoice, BMW, Deutsche Telekom, LG, Mastercard, Mizuho, Priceline, Salesforce, Software AG, and Workday. Learn more at azul.com and follow us @azulsystems.

‍

RapidFort Achieves SOC 2 Type 2 Compliance, Reinforcing Trust-First Strategy

Press Release

January 20, 2026

RapidFort Achieves SOC 2 Type 2 Compliance, Reinforcing Trust-First Strategy

RapidFort achieves SOC 2 Type 2 compliance demonstrating the company’s commitment to security and privacy.

No items found.

RapidFort achieves SOC 2 Type 2 compliance demonstrating the company’s commitment to security and privacy

RapidFort Achieves SOC 2 Type 2 Compliance, Reinforcing Trust-First Strategy

Third-party auditors confirm the company’s mature security practices, reaffirming RapidFort’s commitment to their partners and customers

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a San Francisco-based container security company, today announced that it has successfully completed a Service Organization Controls (SOC) 2 Type 2 compliance audit, demonstrating the company’s commitment to maintaining all aspects of security and privacy. After an extensive review of RapidFort’s controls, practices, business processes, and more by a professional third-party auditor, RapidFort met more than 300 necessary requirements to achieve the certification.

The importance of vendor and partner security cannot be overstated in today’s business ecosystem. Security breaches from vendors or partners that directly affect companies and their clients are more prevalent now than ever before. SOC 2, developed by the American Institute of CPAs (AICPA), is a globally recognized auditing procedure that measures a service provider’s ability to securely manage its data and protect the privacy of its clientele. All audited organizations must meet the criteria across five trust service principles, including security, availability, processing integrity, confidentiality, and privacy.

“Trust is the currency of business today,” said Kevin Baldwin, Chief Revenue Officer at RapidFort. “Achieving SOC 2 Type 2 compliance makes RapidFort more than just a credible company, but a trusted and preferred business partner. Now companies of all sizes, from government organizations to major enterprises, can use the RapidFort platform with confidence knowing that their data will remain secure.”

Successfully completing the SOC 2 Type 2 Compliance audit reasserts RapidFort’s dedication to its current and future business partners. This certification also allows them to broaden their target audience to companies that will only work with SOC 2 Type 2 credited companies. RapidFort’s existing internal standards of security and compliance made the 3-month assessment process simple. They were able to demonstrate excellence in best practices for each of the audited categories and serve as an example that adherence to high standards begets positive outcomes.

To learn more about RapidFort’s platform, please visit https://www.rapidfort.com.

About RapidFort

RapidFort is a cloud-native cybersecurity company that provides a platform to optimize and secure modern cloud infrastructures. The company helps organizations monitor and minimize their software attack surface continuously. RapidFort’s free tier and free community images empower development and security teams to improve their security posture and operational efficiency. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort Launches Runtime Protection to Automatically Monitor and Secure Kubernetes Workloads

Press Release

January 20, 2026

RapidFort Launches Runtime Protection to Automatically Monitor and Secure Kubernetes Workloads

RapidFort launches Runtime Protection to enhance software visibility and automatically mitigate vulnerabilities.

No items found.

RapidFort launches Runtime Protection to enhance software visibility and automatically mitigate vulnerabilities.

RapidFort Launches Runtime Protection to Automatically Monitor and Secure Kubernetes Workloads

RapidFort Runtime Protection enhances software visibility, empowering security and development teams to easily mitigate software vulnerabilities

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), has launched RapidFort Runtime Protection, its flagship runtime toolset. Runtime Protection provides security teams with a deep understanding of their software and the tools needed to automatically mitigate vulnerabilities – significantly reducing the burden on development teams.

Securing trust among customers, stakeholders, and regulators has never been more critical. Government regulatory efforts and an increasingly interconnected technology landscape are driving companies to decrease their overall attack surface. Many are placing extra emphasis on container security as a key part of their risk reduction strategy in order to protect against malware, vulnerabilities, data leaks, human error, and more. Runtime Protection actively scans, profiles, monitors, and secures containers in lower and production environments, pinpointing the vulnerabilities within applications’ execution paths. This enables teams to protect their infrastructure by automatically securing unused components and unnecessary vulnerabilities, ultimately reducing software attack surfaces by 60-90%. With deep insights into their Kubernetes workloads, teams are able to prioritize vulnerabilities, streamline their remediation strategy, and make informed decisions across the board.

“Scaling the remediation of software vulnerabilities has become an intractable problem to solve," said Dave Neuman, Senior Analyst at Tag-Cyber. "Security professionals are burdened by an overabundance of vulnerabilities and developers are asked to chase CVEs instead of focusing on innovation and new product features. RapidFort is a quantum leap forward. Now security professionals are empowered to solve up to 90% of software vulnerabilities automatically without involving developers. RapidFort’s innovative technology has taken the complex and made it simple, ushering in a whole new way of managing the risk associated with software vulnerabilities at enterprise scale.”

With the addition of RapidFort Runtime Protection, the RapidFort platform is the first solution on the market that offers build time CI/CD tools and runtime Kubernetes features that work in unison, helping organizations reduce their software attack surface throughout the Software Development Life Cycle and facilitating efficient cooperation between security and development teams. Current industry runtime tools can require up to 30% of compute overhead, which can hinder high-performance cloud native environments. Runtime Protection was purpose-built to be environment agnostic and uses less than 1% compute overhead, allowing frictionless deployment in high-traffic Kubernetes environments.

“Trust and compliance are paramount to success in today's business landscape and RapidFort is fundamentally revolutionizing the cloud application security industry by solving one of the most important and complex issues facing organizations today – software vulnerability management,” said Kevin Baldwin, Chief Revenue Officer at RapidFort. “We realized early on we needed to look at the problem differently and that automation was key to solving this issue at scale. The addition of Runtime Protection to our platform’s tool set ensures that, with the push of a button, only the vulnerabilities that materially impact a company's unique environment are identified and remediated. This innovation doesn’t just eat around the edges of the problem. It simply eliminates it.”

RapidFort’s platform presents security teams with a simple, three-step process to optimize and secure their software attack surface:

Scan & Observe: Scan infrastructure, generate vulnerability reports, and measure risk
Profile & Understand: Understand your software attack surface, identify what packages are used and unused, and prioritize vulnerability remediation
Harden & Secure: Reduce your software attack surface, and improve security posture

A recent study conducted by RapidFort found that 60-90% of software in modern applications is unused and irrelevant to the execution path. Despite its irrelevance, the unused software is continuously maintained, bogging down security and dev teams while posing significant, unnecessary risk. Through its automatic scanning, monitoring, and hardening capabilities, Runtime Protection identifies this unnecessary code and gives security teams contextual insight into what vulnerabilities matter most so they can remediate risks more efficiently.

To learn more about Runtime Protection and the RapidFort platform, please visit http://runtime.rapidfort.com.

About RapidFort

‍

RapidFort Joins Microsoft for Startups Pegasus Program

Press Release

January 20, 2026

RapidFort Joins Microsoft for Startups Pegasus Program

RapidFort selected as a member of the prestigious Microsoft for Startups Pegasus Program.

No items found.

RapidFort selected as a member of the prestigious Microsoft for Startups Pegasus Program

RapidFort Joins Microsoft for Startups Pegasus Program

The program helps RapidFort drive growth and customer value

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), has been selected as a member of the prestigious Microsoft for Startups Pegasus Program. The program helps drive sales and accelerate growth for RapidFort’s advanced software security platform. As part of the program, Microsoft channels and customers now have easy access to RapidFort's market-leading platform, which includes RapidFort Runtime Protection. This tool empowers security teams to automatically scan, understand, and harden their software infrastructure. By leveraging Runtime Protection, companies can expect the automatic remediation of 60-90% of their software vulnerabilities without involving development teams.

“The Microsoft Pegasus Program is a critical part of our go-to-market strategy, and we’re thrilled to be working with such a stellar and capable team,” said Mehran Farimani, CEO at RapidFort. “Being selected as a member of the program validates our unique vision for the future of software attack surface management. With Microsoft's support, we will greatly accelerate our mission to help customers automatically secure and optimize their software, and enjoy the operational efficiency and security benefits that RapidFort enables.”

The Microsoft for Startups Pegasus Program extends the Microsoft for Startup Founders Hub platform with curated training and support for invited startups. The Pegasus Program is an ecosystem of startups with unique solutions to critical market needs and offers a range of resources and support. Participation in the program gives RapidFort access to a dedicated Success Manager, a Cloud Solutions Architect, and an Account Executive, who provide customers with personalized support and the technical assistance needed to make the most of RapidFort's offerings. RapidFort is well-positioned to accelerate top-line expansion and deliver innovative solutions that solve critical business problems for Microsoft and RapidFort's joint customers.

The program also enables RapidFort to serve its current and prospective customers better. Microsoft’s enterprise customers who are looking to streamline their security operations are now able to connect with RapidFort’s offerings and transact seamlessly. These companies can now meet one-on-one with RapidFort to collaborate on digital transformation and innovation opportunities.

“Remediation of software vulnerabilities is a considerable burden to engineering teams, and RapidFort has developed a patented and effective toolset to significantly reduce this cost. RapidFort's acceptance into the Pegasus Program is a testament to their unique approach to software security. We look forward to continuing our work together to drive growth for them, and increased security for our joint customers,” said Tom Davis, Senior Director at Microsoft for Startups.

To learn more about the Microsoft for Startups Pegasus Program, please visit: https://www.microsoft.com/en-us/startups/pegasus

To learn more about Runtime Protection and the RapidFort platform, please visit: http://runtime.rapidfort.com.

About RapidFort

‍

RapidFort Wins The Prestigious 2023 CISO Choice Award For Vulnerability Management

Press Release

January 20, 2026

RapidFort Wins The Prestigious 2023 CISO Choice Award For Vulnerability Management

RapidFort named a winner of the 2023 CISO Choice Awards in Vulnerability Management.

No items found.

RapidFort named a winner of the 2023 CISO Choice Awards in Vulnerability Management

RapidFort Wins The Prestigious 2023 CISO Choice Award For Vulnerability Management

RapidFort is recognized for its innovative approach to vulnerability management and automatic remediation.

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), has been named a winner of the prestigious 2023 CISO Choice Awards in the Vulnerability Management category. The awards honor leading security vendors who exemplify creative entrepreneurship and offer innovative solutions to today's growing security challenges. The board of judges is composed of distinguished CISOs from major organizations across multiple industries, and their choices were rooted in firsthand knowledge and insights from building and maintaining their own programs.

"I would like to congratulate RapidFort for winning the 2023 CISO Choice Awards Vulnerability Management Category. The field was exceptionally competitive this year, and our esteemed CISO Board of Judges was very impressed by the level of innovation that solution providers put forth to safeguard our organizations," said David Cass, CISOs Connect and Security Current President, and Global CISO at GSR.

It's common for large enterprises to find 10-20 million vulnerabilities in their software infrastructure after a scan. Uniquely, through a process of identifying used and unused components, RapidFort's platform can automatically remediate a majority of vulnerabilities. In a recent study conducted by Rapidfort, 73% of people said that their organizations spend up to 30 hours each week remediating each prioritized CVE, taking up a significant amount of time. RapidFort pinpoints these unused components and their associated vulnerabilities in all parts of the software development and deployment lifecycle and provides security and development teams with the tools to mitigate most vulnerabilities automatically.

The platform empowers organizations to:

Scan & Observe: Scan infrastructure, generate vulnerability reports, and measure risk
Profile & Understand: Understand their software attack surface, identify what packages are used and unused, and prioritize vulnerability remediation
Harden & Defend: Reduce their software attack surface and improve security posture

When using RapidFort, discussions between security and development teams change from fixing CVEs in open-source components (i.e., other people's code) to improving software hygiene with actionable reports and tools to eliminate unnecessary software components. This, in turn, frees up development teams to focus on building new software features and solving customer and business issues, resulting in a faster, leaner software organization.

"The CISO Choice Awards are a significant accolade to companies in the cybersecurity industry. The recognition from the highly respected CISO judges validates our unique and innovative approach to reducing organizations' software attack surface," said Mehran Farimani, CEO of RapidFort. "RapidFort is revolutionizing how security teams and developers work together to keep their organizations safe. By automatically identifying and remediating up to 90% of software vulnerabilities, we empower security teams to focus on defending while enabling developers to spend their precious time on innovations relevant to their businesses."

To learn more about RapidFort's platform, please visit https://www.rapidfort.com.

About RapidFort

RapidFort is a cloud-native cybersecurity company that provides a platform to optimize and secure modern cloud infrastructures. The company helps organizations monitor and minimize their software attack surface continuously. RapidFort's free tier and free community images empower development and security teams to improve their security posture and operational efficiency. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort’s Platform Now Available in Microsoft Azure Marketplace

Press Release

January 20, 2026

RapidFort’s Platform Now Available in Microsoft Azure Marketplace

RapidFort’s attack surface management platform now available on Microsoft Azure Marketplace

No items found.

RapidFort’s attack surface management platform now available on Microsoft Azure Marketplace

RapidFort’s Platform Now Available in Microsoft Azure Marketplace

Marketplace inclusion improves access to industry-leading software attack surface management technology

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), is now available in the Microsoft Azure Marketplace, an online repository containing IT software applications and services built by industry-leading technology companies. Customers now have access to the powerful -- Azure optimized -- features of the RapidFort platform to scan, monitor and harden workloads running in Microsoft Azure Kubernetes Services.

RapidFort’s technology will be the first of its kind available on the Azure marketplace and can be fully deployed on the Azure stack within a customer account. With no data leaving the customer account, customers remain secure and can enforce organizational security policies while leveraging the benefits of the RapidFort platform. The locality of the platform and RapidFort Runtime Protection features also allow for accelerated scanning of Common Vulnerabilities and Exposures (CVEs) as all data is local to customer workloads.

“Our inclusion in the Microsoft Azure Marketplace is another crucial step forward in our go-to-market strategy as we expand access to our powerful solution, and tackle the growing challenge of software security,” said Mehran Farimani, CEO at RapidFort. “This affirms our innovative approach to software attack surface management. As we expand access to our platform, we're expediting our mission, empowering customers to effortlessly secure and optimize their software with the operational efficiency and security benefits of RapidFort."

RapidFort’s inclusion in the marketplace serves as further testament to their mission of creating a seamless approach for customers to access its technology. The complete integration of the platform into the Azure Marketplace greatly benefits regulated industries such as financial services and healthcare, as it will allow customers to leverage their existing certifications alongside the benefits of the RapidFort platform.

RapidFort was also recently selected to be in the prestigious Microsoft For Startups Pegasus Program. This in addition to the listing demonstrates the company’s continued dedication to better serve its current and prospective customers by increasing access to its market-leading platform and making it easier than ever to remediate software vulnerabilities.

To find RapidFort on the Microsoft Azure Marketplace, please visit: https://azuremarketplace.microsoft.com/pt-br/marketplace/apps/rapidfortinc1678380358035.saas_sasm_platform?tab=overview

To learn more about RapidFort, please visit: https://www.rapidfort.com.

About RapidFort

‍

RapidFort Unveils New Software Bill of Materials Warehouse Feature

Press Release

January 20, 2026

RapidFort Unveils New Software Bill of Materials Warehouse Feature

RapidFort announces new SBOM warehouse feature, increasing software vulnerability identification and remediation efficiency

No items found.

RapidFort announces new SBOM warehouse feature, increasing software vulnerability identification and remediation efficiency

RapidFort Unveils New Software Bill of Materials Warehouse Feature

New capability increases efficiency in identifying and automatically remediating more than 80% of critical software vulnerabilities

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity, unveiled its Software Bill of Materials (SBOM) Warehouse feature, taking a major leap forward in Software Attack Surface Management (SASM). This innovative platform capability provides a centralized location for SBOMs for all of an organization’s containers, aligning with the National Institute of Standards and Technology’s (NIST) recommendation. The centralized view, coupled with additional benefits like enhanced risk visibility, ingestion and reporting capabilities, allows security teams to swiftly and effectively address critical vulnerabilities in any package and its dependencies, significantly enhancing organizations' cybersecurity posture. This new functionality is part of the process RapidFort uses to automatically eliminate more than 80% of software vulnerabilities, during development, with no code changes.

The Presidential Executive Orders new requirement for cyber devices to provide an SBOM for all software components and a proposal for federal contractors to develop and maintain an SBOM for any software are just two examples of recent compliance requirements making SBOMs among the most critical priorities for government agencies and commercial organizations. RapidFort’s SBOM Warehouse feature is helping to address this new priority by continuously monitoring for risks, updating risk profiles with new security advisories, and reducing the repetitive task of regenerating SBOMs for the same containers on a regular cadence, saving customers time and money.

"The landscape of vulnerabilities within SBOMs is dynamic, changing almost daily. To maintain an accurate risk profile, organizations would traditionally need to generate SBOMs manually every day, a time-consuming and costly process," explained Mehran Farimani, CEO and Co-Founder of RapidFort. "We are thrilled to be one of the only vendors offering a solution that is helping organizations address this growing priority by simplifying and automating the process, saving them valuable time and resources."

RapidFort’s SBOM Warehouse is incorporated within RapidFort's platform and scanning suite, making it simple for organizations to leverage the profiling and hardening feature to remediate risks quickly and automatically. Uniquely, the SBOM Warehouse enables the ingestion of SBOMs generated by scanners, including those not supported by RapidFort's platform. It then converts them to industry standard formats such as SPDX and Cyclone DX. With the SBOM Warehouse's container comparison feature, RapidFort can identify any new components or deficiencies found within containers and associated vulnerabilities. This results in organizations having the most accurate view of their SBOMs, specifically the components used in their containers and the actionable risk metrics based on current information.

RapidFort's SBOM Warehouse is just one of the many capabilities that make up its SASM platform, the first of its kind. This platform is designed to identify and remove unused components without altering the software's behavior, resulting in smaller, more performant and secure software. Its flagship runtime toolset, RapidFort Runtime, takes an active role in scanning, profiling, monitoring, and securing containers in production environments, pinpointing the vulnerabilities within applications' execution paths. This comprehensive approach enables teams to protect their infrastructure by automatically removing unused components and unnecessary vulnerabilities, and reducing software attack surfaces by an impressive 60-90%.

Large portions of the SBOM Warehouse were developed in partnership with and financed by SpaceWERX. SpaceWERX is the innovation arm of the United States Space Force and blends the best of commercial innovation with the needs of United States Space Guardians. The enterprise version is available on RapidFort’s website, while the Department of Defense version is available for download at USAF PlatformOne Ironbank.

To learn more about RapidFort and the SBOM Warehouse capability, please visit https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure cloud development. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort Enhances SASM Platform with Cutting-Edge STIG Compliance Toolset

Press Release

January 20, 2026

RapidFort Enhances SASM Platform with Cutting-Edge STIG Compliance Toolset

RapidFort adds compliance capability to help government and commercial organizations benchmark container images against the STIG framework.

No items found.

RapidFort adds compliance capability to help government and commercial organizations benchmark container images against the STIG framework.

RapidFort Enhances SASM Platform with Cutting-Edge STIG Compliance Toolset

New features will help government and commercial companies more easily achieve and maintain compliance with common industry benchmarks

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), has added a new compliance capability to its platform to help both government and commercial organizations benchmark their container images against the Security Technical Information Guide (STIG) framework. In thirty seconds or less RapidFort scans for and identifies configuration errors and vulnerabilities in code, generating an executable script and automatically remediating identified risks.

Compliance plays a critical role in regulated industries like fintech, healthcare, and critical infrastructure, and RapidFort customers now have access to tools that will help them identify, achieve, and maintain compliance with their necessary industry standards. Government organizations that work with the Department of Defense (DoD) must comply with STIG configuration standards for device hardware and software that help safeguard the DoD’s IT network and systems.

“Compliance benchmarking is essential for businesses within regulated industries as well as companies using containers with intellectual property or customer data,” said Mehran Farimani, CEO of RapidFort. “With regulatory requirements only growing, we recognize the challenge this can present to security and development teams, so we wanted to give our customers an easier way to achieve their compliance requirements. Our simple and easy-to-use tool can now quickly benchmark their containers, and automatically address any vulnerabilities within the code, reducing manual code changes and compliance headaches.”

The compliance features are built into RapidFort’s innovative SASM platform, designed to identify and remove unused components without altering the software's behavior, resulting in smaller, more performant and secure software. RapidFort’s flagship runtime toolset, RapidFort Runtime, scans, profiles, monitors, and secures containers in production environments, pinpointing vulnerabilities within applications' execution paths. This comprehensive approach enables teams to protect their infrastructure and maintain compliance by automatically removing unused components and undetected vulnerabilities, reducing software attack surfaces by more than 80%.

Large portions of the STIG Toolset were developed through contracts with SpaceWERX. SpaceWERX is the innovation arm of the United States Space Force and blends the best of commercial innovation with the needs of United States Space Guardians. The enterprise version is available on RapidFort’s website, while the Department of Defense version is available for download at USAF PlatformOne Ironbank.

For more information about RapidFort’s new compliance tool, visit https://www.rapidfort.com.

The views expressed are those of the author and do not necessarily reflect the official policy or position of the Department of the Air Force, the Department of Defense, or the U.S. government.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

About SpaceWERX

As the innovation arm of the U.S. Space Force and a unique division within AFWERX, SpaceWERX inspires and empowers collaboration with innovators to accelerate capabilities and shape our future in space. Headquartered in Los Angeles, SpaceWERX employs 40 military, civilian and contractor personnel executing an annual $457 million budget. Additionally, SpaceWERX partners with Space Systems Command's Commercial Space Office (COMSO) as a collaborative program. Since it was aligned under AFRL in Aug. 2021, SpaceWERX has executed 1106 contracts worth more than $897 million to strengthen the U.S. defense industrial base and drive faster technology transition to operational capability. For more information, visit spacewerx.us.

‍

RapidFort Launches Free Pre-Hardened Images on GitHub

Press Release

January 20, 2026

RapidFort Launches Free Pre-Hardened Images on GitHub

RapidFort launches GitHub repository with pre-hardened open-source images, offering developers free, secure, efficient, & reliable container solutions.

No items found.

RapidFort launches GitHub repository with pre-hardened open-source images, offering developers free, secure, efficient, & reliable container solutions

RapidFort Launches Free Pre-Hardened Images on GitHub

Repository will strengthen containerized open-source software for developer community

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), has launched their GitHub repository with hundreds of prehardened open-source images. This initiative offers developers free, secure, efficient, and reliable container solutions, transforming the DevSecOps landscape with over 1.85 million unique downloads from developers to date.

Open-source containers, while powerful and widely used, are often bloated with unnecessary code and hundreds of vulnerabilities, shifting the burden of remediation to developers and increasing the risk of insecure software. In a survey conducted by RapidFort, 73% of people said their organizations spend between 11 and 30 hours each week remediating CVEs. RapidFort is addressing this challenge head-on with their free pre-hardened images, giving developers a weekly updated catalog of slimmer, faster, less resource-intensive images, letting developers focus on what developers do best, building. This community-focused initiative provides cost-saving benefits and more efficient infrastructure, allowing developers to focus on innovation rather than vulnerability management, ultimately accelerating development cycles and enhancing their security posture.

“We believe that security should be accessible to everyone, regardless of the size of their organization or the resources they have,” said Mehran Farimani, CEO of RapidFort. “By offering these pre-hardened community images for free, we are not only helping developers save time and resources but also contributing to a safer, more secure digital ecosystem. It's our way of giving back to the open-source community that has given us so much.”

These images are hardened through RapidFort’s innovative SASM platform, with rebuilds to the repository each time a new image is released. RapidFort’s flagship runtime toolset, RapidFort Runtime allows container images to be scanned, profiled, monitored, and secured in a production environment. Its ability to pinpoint vulnerabilities within the execution path results in the automatic removal of unused components and unnecessary vulnerabilities, reducing software attack surfaces by an impressive 60-90%.

To access RapidFort’s hardened community images, please visit: https://github.com/rapidfort/community-images.

To connect with talented engineers worldwide and stay updated on the company's latest developments, join RapidFort's Slack community at: https://www.rapidfort.com/resources/community-center.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort Curated Images Help Organizations Achieve Zero CVEs

Press Release

January 20, 2026

RapidFort Curated Images Help Organizations Achieve Zero CVEs

RapidFort launches Curated Images, offering a secure foundation for software development and deployment as well as accelerated FedRAMP authorization.

No items found.

RapidFort launches Curated Images, offering a secure foundation for software development and deployment as well as accelerated FedRAMP authorization.

RapidFort Curated Images Help Organizations Achieve Zero CVEs

Curated container images provide a secure foundation for software development and accelerated FedRAMP authorization

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), has launched RapidFort Curated Images, helping organizations quickly reach near-zero common vulnerabilities and exposures (CVEs) within their software. Meticulously patched to reduce the number of total vulnerabilities, RapidFort Curated Images offer a secure foundation for software development and deployment, featuring daily rebuilds, FIPS readiness and accelerating FedRAMP compliance and saving enterprise development resources.

RapidFort Curated images is the first of a three step process leveraging the RapidFort Platform to remediate up to 95% of all CVEs across the application development process. RapidFort's secure container image repository includes three categories of curated images, available in both FIPS and non-FIPS versions: base images, framework images and third-party open-source images. All images are STIG-compliant, hardened and patched, and include RapidFort’s unique analysis providing contextual “Justification Advisory” to weed out real vs. false positive CVEs. The repository is updated several times per week and whenever a new patch for a known CVE is released. Historical versions of these images are retained for 6 months after they reach end-of-life, ensuring continued access. Unlike first generation near zero CVE image vendors in the market, RapidFort does not force customers to re-baseline to a proprietary operating system with no real community support. RapidFort images are based on the most mature and popular Linux distributions: Ubuntu, Red Hat, and Alpine to minimize the impact and ensure compatibility with our end customer’s existing software builds.

Organizations can significantly reduce costs and resource allocation dedicated to vulnerability management with RapidFort Curated Images. The need for a dedicated team of engineers to research and patch images is eliminated, reducing costs to a tenth. When combined with RapidFort’s SASM platform, users can remediate the majority of their software vulnerabilities automatically and early in the development cycle. When leveraging Rapidfort’s Platform, users can expect:

Up to a 10% reduction in development cycle time for patching unused components
An 88% reduction in software attack surface
A 2-3 week reduction in code release time for every major release
A 1-3% infrastructure cost savings from smaller size images
Up to 11x faster container boot time

“Software vulnerabilities are a perpetual challenge for developers, creating a relentless cycle of patching that can leave organizations vulnerable. Compliance regulations, like FedRAMP, DSS, PCI and public companies facing breach notification mandates, add another layer of complexity to this problem,” said Mehran Farimani, CEO of RapidFort. “Our new curated images offering is a game-changer for organizations striving to enhance their security posture while maintaining operational efficiency. By providing a secure, meticulously patched foundation for software development, we empower our clients to achieve near-zero CVEs and navigate the complexities of compliance with ease.”

RapidFort offers an end-to-end solution for CVE remediation, addressing all three lifecycle steps: starting with curated images, instrumenting and profiling, and hardening and monitoring. Unlike other offerings that rely on third parties and additional tools, RapidFort provides a comprehensive platform that manages the entire remediation process, from images to production. This unique capability positions RapidFort as a leader in the market, delivering unparalleled security and compliance solutions, as exemplified by the company’s inclusion in SpaceWERX’s Innovate to Accelerate cohort.

To learn more about RapidFort Curated Images, please visit: https://hub.rapidfort.com

For more information about the RapidFort platform, please visit: https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort Appoints Industry Veteran George Manuelian as Chief Strategy and Revenue Officer

Press Release

January 20, 2026

RapidFort Appoints Industry Veteran George Manuelian as Chief Strategy and Revenue Officer

RapidFort names George Manuelian as Chief Strategy and Revenue Officer to accelerate market expansion and adoption of its cybersecurity platform.

No items found.

RapidFort names George Manuelian as Chief Strategy and Revenue Officer to accelerate market expansion and adoption of its cybersecurity platform.

RapidFort Appoints Industry Veteran George Manuelian as Chief Strategy and Revenue Officer

Curated container images provide a secure foundation for software development and accelerated FedRAMP authorization

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), today announced the appointment of George Manuelian as Chief Strategy and Revenue Officer (CRO). With a proven track record of scaling high-growth technology companies, Manuelian brings nearly three decades of experience in the cybersecurity, cloud, and networking industries to his new role.

Prior to joining RapidFort, Manuelian held a pivotal position as Vice President of Worldwide SASE GTM (Go-to-Market) at Palo Alto Networks, where he led the business to impressive revenue growth exceeding $1.2 billion. Before his tenure at Palo Alto Networks, Manuelian was instrumental in building several key software partnerships at Amazon Web Services, fostering strategic alliances and expanding market reach. Following his role at AWS, Manuelian served as VP of Sales Engineering at Versa Networks, where he successfully grew the business to over $100 million ARR. His instrumental role in driving sales strategy and execution contributed significantly to Versa Networks' rapid expansion. Prior to Versa Networks, Manuelian held leadership roles at Cisco for over 20 years, where he spearheaded innovation in mobile and cloud services.

“George's deep understanding of the cybersecurity landscape, coupled with his exceptional leadership abilities, make him an invaluable asset to RapidFort,” said Mehran Farimani, CEO of RapidFort. “His proven success in scaling high-growth companies aligns perfectly with our ambitious growth plans. We are confident that George’s expertise will be instrumental in accelerating our market expansion and delivering exceptional value to our customers.”

“I am thrilled to join RapidFort at this pivotal stage of its growth journey,” said Manuelian. “The company’s innovative cybersecurity platform has the potential to revolutionize the way organizations approach software security. I look forward to leveraging my experience to drive strategic partnerships, expand market reach, and contribute to RapidFort’s continued success.”

RapidFort is a cybersecurity platform that revolutionizes software development by streamlining vulnerability remediation. The platform empowers developers to secure applications effortlessly in just three steps: Curated base image, container instrumentation and profiling, and ongoing hardening and monitoring. By automating vulnerability remediation, RapidFort offers customers a near zero CVE foundation for their base, framework and 3rd party application open source software. This innovative approach delivers substantial cost savings, including a 10% reduction in software development expenses, a 2-3 week decrease in time-to-market for major releases, and a 3% decrease in infrastructure costs. Ultimately, RapidFort dramatically lowers the overall cost of securing software while ensuring compliance with industry standards.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort Appoints Proven Leader Ben de Waal as Vice President of Research and Development

Press Release

January 20, 2026

RapidFort Appoints Proven Leader Ben de Waal as Vice President of Research and Development

RapidFort names Ben de Waal as VP of Research & Development to ensure next generation products meet the demands of security & development teams.

No items found.

RapidFort names Ben de Waal as VP of Research & Development to ensure next generation products meet the demands of security & development teams.

RapidFort Appoints Proven Leader Ben de Waal as Vice President of Research and Development

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), today announced the appointment of Ben de Waal as Vice President of Research and Development. De Waal joins RapidFort as a highly skilled engineer and entrepreneur with more than 65 patents to his name and a proven track record of leading and growing teams in both large organizations and startups.

At RapidFort, de Waal will be responsible for next-generation product development, focusing on enhancing RapidFort’s offerings to meet the evolving demands of security and development teams. Prior to joining RapidFort, de Waal held various senior roles at technology companies, most notably serving as Vice President of GPU Software at NVIDIA. There he led the development of GPU and CUDA products and worked closely with industry partners to help shape the direction of modern GPU technology, significantly improving graphics processing performance for both consumer and enterprise markets.

After his time at NVIDIA, de Waal co-founded IonGrid, where he served as CTO and developed a secure platform for remote document access. His work addressed the critical security challenges of “Bring Your Own Device” (BYOD) policies, which led to IonGrid’s acquisition by NetApp in 2013. Later, as Founding CTO of HintMD, de Waal created an innovative FinTech platform tailored to the medical aesthetics industry, streamlining client-provider interactions and facilitating HintMD’s acquisition by Revance Therapeutics in 2020.

“We’re working to develop our next-generation capabilities at RapidFort, and Ben is exactly the leader we need to make this vision a reality,” said Russ Andersson, Chief Operating Officer of RapidFort. “His unique blend of technical expertise, strategic insight, and entrepreneurial spirit makes him an exceptional fit for this role, and we’re thrilled for him to lead the projects that will shape our future.”

RapidFort is a cybersecurity platform revolutionizing software development through streamlining vulnerability remediation. The platform empowers developers to secure applications effortlessly in three steps with: Curated base images, container instrumentation and profiling, and continual hardening and monitoring. By automating vulnerability remediation, RapidFort offers customers a near zero CVE foundation for their base, framework and 3rd party application open-source software. This innovative approach delivers substantial cost savings, including a 10% reduction in software development expenses, a 2-3 week decrease in time-to-market for major releases, and a 3% decrease in infrastructure costs. Ultimately, RapidFort dramatically lowers the overall cost of securing software while ensuring compliance with industry standards like NIST Zero Trust, DoD requirements, FedRAMP and SOC 2.

“I’m thrilled to be joining RapidFort at this inflection point in the company’s journey,” said de Waal. “I’ve always felt security should be an integral part of the development process, not an afterthought, and at RapidFort they’re making that happen. I’m looking forward to working with this talented team to enhance our solutions and make securing software easier and more accessible.”

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort Now Available in AWS Marketplace

Press Release

January 20, 2026

RapidFort Now Available in AWS Marketplace

RapidFort's SASM platform & curated images available in AWS Marketplace, offering enhanced security, compliance, cost savings, & more to AWS users.

No items found.

RapidFort's SASM platform & curated images available in AWS Marketplace, offering enhanced security, compliance, cost savings, & more to AWS users.

RapidFort Now Available in AWS Marketplace

Inclusion in the marketplace enhances availability of the industry’s premier attack surface management solution

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), is now available in AWS Marketplace, a tailored online marketplace enabling businesses of all sizes to discover, evaluate, purchase, implement, and manage solutions from AWS Partners. Customers now have greater access to the latest and powerful RapidFort SASM platform and curated near zero CVE images, which remove up to 95% of vulnerabilities with no code changes in the CI/CD pipeline.

RapidFort’s solution will be the first of its kind available within the AWS ecosystem and can be purchased directly through private offering and special pricing, meeting AWS spending obligations. By participating in AWS Marketplace RapidFort offers customers within the ecosystem unique benefits like simplified billing, cost savings, streamlined compliance, simple procurement, reduced risk and faster tool deployment. While most SASM solutions target specific stages of the software development lifecycle and cybersecurity, RapidFort stands out as the only proven end-to-end vulnerability management solution which includes curated zero-CVE images trusted by the DOD.

“We're excited to officially join the AWS Partner Network, offering AWS customers a comprehensive software vulnerability management solution that accelerates SOC-2 and FedRAMP compliance. Our solution accelerates AWS production deployments by at least three months,” said George Manuelian, CRO, Chief Strategy & Revenue Officer at RapidFort. “This partnership will empower more organizations to seamlessly secure their software infrastructure, and significantly reduce their attack surface meeting FedRAMP and NIS-2 software hardening requirements. We look forward to expanding our reach and continuing to deliver innovative solutions that fortify software security at scale.”

RapidFort's impact on the open-source community is significant. It has thousands of free hardened container images, over 6 million downloads, and more than 1.6 million active users, highlighting the critical need for its vulnerability remediation solution. As part of the AWS Marketplace, RapidFort provides a comprehensive and proven solution to AWS ecosystem customers globally.

RapidFort's innovative approach helps organizations remediate up to 95% of CVEs across the application development process, reduce their software attack surface by up to 90%, and speed up code release times by more than 3 weeks. This results in at least 10% reduction in software development expenses and a 3% decrease on average in infrastructure costs. RapidFort also accelerates compliance with industry standards like NIST Zero Trust requirements such as FedRAMP, SOC 2, NIS2, PCI, and HIPPA.

To find RapidFort on AWS Marketplace, please visit: https://aws.amazon.com/marketplace/seller-profile?id=a006c02c-541f-4dda-99b5-2706f70d5c11

To learn more about RapidFort, please visit: https://www.rapidfort.com.

About RapidFort

‍

RapidFort Expedites FedRAMP and SOC 2 Compliance - Now Available on Google Cloud Marketplace

Press Release

January 20, 2026

RapidFort Expedites FedRAMP and SOC 2 Compliance - Now Available on Google Cloud Marketplace

RapidFort's innovative SASM platform now available on Google Cloud Marketplace.

No items found.

RapidFort's innovative SASM platform now available on Google Cloud Marketplace.

RapidFort Expedites FedRAMP and SOC 2 Compliance - Now Available on Google Cloud Marketplace

Marketplace listing expands access to the industry's leading software attack surface management solution and near-zero CVE images

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), is now available in Google Cloud Marketplace, a unified marketplace of Google and partner solutions, designed to help customers easily explore, test, acquire, and deploy products. Organizations now have even greater access to RapidFort’s SASM platform and curated near zero CVE images, that when used together, remove up to 95% of vulnerabilities with no code changes in the CI/CD pipeline.

RapidFort can be purchased directly through private offering and special pricing within Google Cloud Marketplace, meeting any required spending obligations. Customers within the marketplace now have unfettered access to unique benefits such as simplified billing, cost savings, streamlined compliance, simple procurement, reduced risk and faster tool deployment. Most SASM solutions on the market are limited, targeting only specific stages of the software development lifecycle and cybersecurity. RapidFort stands out within the industry as the only proven end-to-end vulnerability management solution that includes curated zero-CVE images trusted by the DOD.

“We’re thrilled to join Google Cloud Marketplace, enabling greater access to RapidForts’ solutions,” said George Manuelian, CRO, Chief Strategy and Revenue Officer at RapidFort. “Our collaboration will allow more organizations to effectively and efficiently secure their software infrastructure, achieve SOC-2 and FedRAMP compliance, and accelerate GCP production deployments. As we grow our market presence, we look forward to continuing our mission of providing innovative solutions that enhance software security for all.”

RapidFort has had a major impact on the open-source community providing thousands of free hardened container images. With over 6 million downloads and more than 1.6 million active users, there's a clear need for RapidFort’s vulnerability remediation solution. RapidFort's innovative approach to SASM helps organizations remediate up to 95% of CVEs across their application development pipeline, reducing their software attack surface by up to 90%, and speeding up code release times by more than 3 weeks. These efficiencies result in a 10% or more reduction in software development expenses and a 3% decrease on average in infrastructure costs. RapidFort also accelerates compliance with industry standards like NIST Zero Trust requirements for FedRAMP, SOC 2, NIS2, PCI, and HIPPA.

To find RapidFort on Google Cloud Market Place, please visit: https://console.cloud.google.com/marketplace/product/rapidfort-public/rapidfort-near-zero-cve-images-and-sasm-platform

To learn more about RapidFort, please visit: https://www.rapidfort.com.

About RapidFort

Beyond Identity Accelerates Path to FedRAMP Certification with RapidFort, Slashing Time and Costs

Press Release

January 20, 2026

Beyond Identity Accelerates Path to FedRAMP Certification with RapidFort, Slashing Time and Costs

Beyond Identity cut FedRAMP costs by 50% and shortened the certification process by 3 months using RapidFort’s platform.

No items found.

Beyond Identity cut FedRAMP costs by 50% and shortened the certification process by 3 months using RapidFort’s platform.

Beyond Identity Accelerates Path to FedRAMP Certification with RapidFort, Slashing Time and Costs

Partnership fast-tracks access to government markets and simplifies compliance

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, has partnered with Beyond Identity, a leading provider of identity and access management solutions, to reduce the time and costs of FedRAMP certification. By working together with RapidFort, Beyond Identity shortened the certification process by three months and cut associated costs by 50%, outperforming alternative approaches and cementing its credibility in the government sector.

"RapidFort was an excellent and comprehensive partner during our FedRAMP journey,” says Borislav Ivanov, Engineering Manager, Site Reliability Engineering at Beyond Identity. “They cut the cost of image hardening and SSDLC efforts by 50%, shaved three months off our overall compliance timeline, and delivered outstanding support every step of the way."

Achieving FedRAMP certification is a crucial and complex process for any organization looking to provide solutions to the federal government, demanding extensive documentation, security testing, and ongoing compliance efforts. Beyond Identity wanted to streamline this process and reduce overall certification costs, all without overburdening its engineering team.

RapidFort played a critical role in helping Beyond Identity earn its certification, while achieving its budgetary and process goals in 3 key ways:

Simplified the compliance process with pre-hardened, near-zero CVE Curated Images aligned with NIST 800-70, FIPS 140-2, and 140-3 standards, establishing a secure foundation, and cutting through a significant portion of the initial compliance work.
Streamlined the benchmarking process with their automated scanning tools, ensuring Security Technical Implementation Guide (STIG) hardened applications.
Automatically generated the necessary compliance documentation, including Plan of Action and Milestones (POAM) and Software Bill of Materials (SBOM), further reducing labor-intensive work.

“Our customers are developing cutting-edge security solutions for both the private and public sectors, so it’s imperative that their offerings are approved for government use as quickly as possible,” said Mehran Farimani, CEO of RapidFort. “We’re proud to be setting the industry standard for FedRAMP certification support, streamlining a traditionally formidable process, and strengthening the infrastructure that helps secure our nation.”

RapidFort, already available through Platform One, Tradewind Marketplace, AWS Marketplace, Microsoft Azure Marketplace, Google Cloud Marketplace, and Carahsoft, provides a reliable and efficient pathway for organizations looking to enter the federal marketplace and drive growth in the government sector. For more information about the RapidFort platform, please visit: https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort to Showcase at RSA Conference 2025

Press Release

January 20, 2026

RapidFort to Showcase at RSA Conference 2025

RapidFort will showcase its Software Attack Surface Management platform at RSA 2025, enabling 95% vulnerability remediation with no code changes.

No items found.

RapidFort will showcase its Software Attack Surface Management platform at RSA 2025, enabling 95% vulnerability remediation with no code changes.

RapidFort to Showcase at RSA Conference 2025

Remediate 95% of vulnerabilities, shrink software attack surfaces up to 90% with no code changes and speed up software releases by 2 - 3 weeks

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, will be exhibiting at RSA 2025.

Meet Face-to-Face:

Visit the company's live demo spotlight at booth #0867, Moscone South Expo., as they highlight their cutting-edge, global software supply chain security solution, the RapidFort Software Attack Surface Management (SASM) platform.

RapidFort is also hosting a series of exclusive networking events to engage with customers, partners, and industry leaders. Space is limited and attendance is by invitation only. Attendees interested in requesting an invitation can visit RapidFort’s Booth (#0867) during RSA or contact us ahead of the event.

Opening Yachting Day on the Bay | Expert panel discussion on evolving DoD security, Authority to Operate (ATO), and procurement standards (In partnership with the Spades Institute)
RapidFort Customer Networking Event
Cloud Meets Wine: A Women & Colleagues Cybersecurity Event (In partnership with Firstboard.io)

“At RSA Conference 2025, we’re excited to demonstrate how RapidFort is transforming vulnerability management, compliance acceleration, and cost reduction, with our end-to-end platform and near-zero CVE images,” said George Manuelian, CRO RapidFort. “Organizations need a proactive, automated approach to securing their environments, and that’s exactly what we deliver.”

The RapidFort Platform

Software vulnerabilities are a constant challenge for developers, creating an ongoing cycle of patching that leaves organizations unnecessarily exposed. At the same time, compliance requirements like FedRAMP, cATO, CMMC, and SOC 2 add operational and financial overhead, especially for government and defense. To achieve compliance and effectively secure software, businesses need a proactive, scalable approach to vulnerability management that reduces risks without adding unnecessary complexity. Specifically designed to secure modern software infrastructure, RapidFort’s Software Attack Surface Management (SASM) platform automatically remediates 95% of vulnerabilities, streamlines compliance efforts, and speeds up software releases by 2 - 3 weeks, all while reducing the overall cost of securing software by 10%. RapidFort provides an end-to-end solution that empowers organizations to secure their software supply chain and developers to secure applications effortlessly in three steps with curated images, instrumenting and profiling, and continual hardening and monitoring.

At the core of RapidFort’s platform are thousands of curated Near-Zero CVE images. Meticulously patched to reduce the number of total vulnerabilities, RapidFort’s curated images feature daily rebuilds, FIPS readiness and FedRAMP acceleration, providing unmatched savings on enterprise development resources. Trusted by the U.S. Department of Defense (DoD) and IronBank, they provide organizations with a secure foundation to build and deploy applications. Combined with automated vulnerability remediation, the platform can shrink software attack surfaces up to 90% with no code changes. Unlike traditional vulnerability management tools, RapidFort integrates effortlessly into your existing CI/CD pipelines, requiring minimal adjustments, leveraging community-supported operating systems, and avoiding vendor lock-in. Ultimately, RapidFort dramatically lowers the overall cost of securing software while ensuring compliance with industry standards like NIST Zero Trust, DoD requirements, FedRAMP, CMMC, FIPS, CIS/STIG and SOC 2.

Upcoming

Following RSA, RapidFort will be at FeinDef 2025, booth 6A08, from May 12th-14th in Madrid, a premier European defense event where the team will demonstrate how European organizations can fast-track compliance for the European market. Additionally, RapidFort will participate in CMMC Day 2025 on May 5th, in College Park, MD, reinforcing RapidFort’s commitment to helping organizations streamline compliance in the U.S.

For more information about the RapidFort platform, please visit: https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

Press Release

January 20, 2026

RapidFort to Showcase at FeinDef 2025

RapidFort, the fastest growing cybersecurity company securing the global software supply chain, exhibiting at FeinDef 2025.

No items found.

RapidFort, the fastest growing cybersecurity company securing the global software supply chain, exhibiting at FeinDef 2025.

RapidFort to Showcase at FeinDef 2025

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, will be exhibiting at FeinDef 2025 in Madrid, Spain.

Meet At FeinDef:

Attendees can visit the company at booth 6A08 to see how their platform is securing supply chains across the globe by remediating up to 95% of vulnerabilities and shrinking software attack surfaces by as much as 90% with no code changes.

RapidFort is participating in AFCEA TechNet Augusta, CrowdStrike fal.con, Billington CyberSecurity Summit 2026, and DevOpsDays Dallas later this quarter.

Already trusted by the U.S. Department of Defense (DoD), IronBank, P1 Marketplace and Carahsoft, RapidFort has a proven track record of helping government agencies and contractors secure their software infrastructure, streamline compliance efforts, and accelerate the deployment of critical solutions. RapidFort provides the most efficient pathway for organizations looking to enter the federal marketplace and drive growth in the government sector by fast-tracking compliance processes like FedRAMP by months, slashing developer workloads by 30%, and speeding up software releases by 2-3 weeks.

“Our work with U.S. government agencies and federal contractors has demonstrated how organizations can secure their software and achieve compliance requirements quicker than ever before by leveraging RapidFort,” said George Manuelian, CRO RapidFort. “Our platform helps organizations reduce the burden of compliance processes felt by development and security teams. As we continue to expand globally, we’re helping organizations expedite certification, harden their software, and streamline their path to operational readiness.”

The RapidFort Platform

Developers are in a constant battle against software vulnerabilities, often caught in endless patch cycles, increasing organizational risk. At the same time, compliance frameworks like FedRAMP, FIPS 140-3, cATO, CMMC, and SOC 2 place financial and operational burdens on government agencies and the defense sector. To meet these demands and secure their software effectively, organizations need a proactive, streamlined approach to vulnerability management that strengthens software security without introducing unnecessary roadblocks.

Designed to secure modern software infrastructure, RapidFort’s Software Attack Surface Management (SASM) platform automatically remediates most vulnerabilities, streamlines compliance efforts, and speeds up software releases while reducing the overall cost of securing software by 10%. In just three steps—curated images, instrumenting and profiling, and continual hardening and monitoring—RapidFort provides a comprehensive solution that enables organizations to protect their software supply chain and developers to more easily build secure applications.

At the core of RapidFort’s platform are thousands of curated Near-Zero CVE images. Meticulously patched to reduce the number of total vulnerabilities, RapidFort’s curated images feature daily rebuilds, providing unmatched savings on enterprise resources and a secure foundation to build and deploy applications. Combined with automated vulnerability remediation, the platform drastically reduces attack surfaces. Unlike traditional vulnerability management tools, RapidFort integrates effortlessly into your existing CI/CD pipelines, requiring minimal adjustments, leveraging community-supported operating systems, and avoiding vendor lock-in. Ultimately, RapidFort dramatically lowers the overall cost of securing software while ensuring compliance with industry standards like NIST Zero Trust, DoD requirements, CIS/STIG and more.

For more information about the RapidFort platform, please visit: https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

CyberShark Pitch Competition Names Finalists from Second Round of 2025 Event Series

Press Release

January 20, 2026

CyberShark Pitch Competition Names Finalists from Second Round of 2025 Event Series

Congratulations to Sandfly Security and Senteon for joining Dropzone AI and RapidFort as finalists in the 2025 CyberShark Pitch Competition.

No items found.

Congratulations to Sandfly Security and Senteon for joining Dropzone AI and RapidFort as finalists in the 2025 CyberShark Pitch Competition.

CyberShark Pitch Competition Names Finalists from Second Round of 2025 Event Series

While on site at Black Hat, a panel of CISO judges evaluated pitches from emerging cybersecurity companies – congratulations to finalists Sandfly Security and Senteon

BALTIMORE--(BUSINESS WIRE)--LaunchTech Communications, a CyberRisk Alliance (CRA) resource specializing in PR and AR services for the cybersecurity industry, today announced the next two finalists to advance in the 2025 CyberShark Pitch Competition.

RSA Conference marked the launch of the 2025 program, where Dropzone AI and RapidFort advanced as finalists. Building on that momentum, Black Hat provided the stage for the next round of pitches, further expanding the pool of innovative companies advancing toward the final competition.

Sandfly & Senteon will advance to the final round of the competition, scheduled for October 16, where they will compete head-to-head with Dropzone AI & RapidFort in a live virtual broadcast. All members of CyberRisk Collaborative will be invited to judge.

2025 CyberShark Pitch Competition “Round 2” Finalists (Black Hat 2025):

Sandfly Security: Agentless Endpoint Detection and Response (EDR) for Linux.
Senteon: Continuous configuration remediation and enforcement for workstations, servers, and browsers that delivers audit ready endpoint compliance.

Other strong competitors in this round included Mimic, Bytewhisper, and Stream Security, who impressed judges with innovative approaches and advanced capabilities.

The CISO judges represented a range of industries, including technology infrastructure, financial and investment services, healthcare and pharmaceuticals, and retail and grocery. They voted to determine which presentation conveyed the most distinct value proposition and clear messaging.

Just as RSA set the tone for this year’s CyberShark series by identifying the first set of standout solutions, Black Hat reinforced the competition’s role as a proving ground for cutting-edge startups – highlighting the diverse ways innovators are tackling today’s cybersecurity challenges.

"The CyberShark Pitch Competition gives early-growth cybersecurity vendors a unique opportunity to validate their solutions in front of decision makers, while receiving candid, actionable feedback on their messaging, positioning, and product-market fit,” said Wayne Schepens, Chief Cyber Market Analyst at CyberRisk Alliance. “What makes this program so valuable is the collaborative spirit – our judges not only bring their deep expertise, but also an enthusiasm to engage in a supportive, low-pressure environment. The result is a win-win: vendors gain champions, grow relationships, refine their go-to-market strategy, and test their solutions against peers, while CISOs gain early insight into innovations that could shape the future of the industry."

Sandfly and Senteon will advance to the final round of the competition, scheduled for October 16, 2025, where they will compete head-to-head with Dropzone AI and RapidFort in a live virtual broadcast. All 3,000+ members of CyberRisk Collaborative will be invited to participate as judges in the final round.

For more information about LaunchTech Communications, visit https://golaunchtech.com.

About CyberRisk Alliance (CRA)

CyberRisk Alliance provides business intelligence that helps the cybersecurity ecosystem connect, share knowledge, accelerate careers, and make smarter and faster decisions. Through our trusted information brands, network of experts, and more than 250 innovative annual events we provide cybersecurity professionals with actionable insights and act as a powerful extension of cybersecurity marketing teams. Our brands include SC Media, the Official Cybersecurity Summits, Security Weekly, InfoSec World, Identiverse, CyberRisk Collaborative, ChannelE2E, MSSP Alert, LaunchTech Communications, TECHEXPO Top Secret and CyberRisk TV. Learn more at www.cyberriskalliance.com.

The Modern Data Company Selects RapidFort’s Curated Images and Platform to Enhance and Accelerate Customer Data Security

Press Release

January 20, 2026

The Modern Data Company Selects RapidFort’s Curated Images and Platform to Enhance and Accelerate Customer Data Security

The Modern Data Company enhances security and accelerates compliance with RapidFort's platform and curated images.

No items found.

The Modern Data Company enhances security and accelerates compliance with RapidFort's platform and curated images.

The Modern Data Company Selects RapidFort’s Curated Images and Platform to Enhance and Accelerate Customer Data Security

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced that The Modern Data Company, a pioneer in data products that radically simplify how enterprises activate their data, has chosen the RapidFort platform and curated images to enhance and accelerate its customer data security deployments across its environments.

With a mission to deliver reliable and scalable solutions for its customers, Modern identified the need for a security partner capable of reducing software vulnerabilities at the source. By adopting RapidFort’s curated images, Modern ensures its development teams and customers benefit from optimized, hardened containers with minimized attack surfaces, enhancing security and accelerating compliance across cloud and hybrid environments.

“Security is critical to the trust we build with our customers,” said Saurabh Gupta, Chief Strategy and Revenue Officer at The Modern Data Company. “RapidFort gives us a faster, more reliable way to enhance and accelerate secure deployments, empowering us to deliver safe, compliant, and resilient solutions, establishing trust from the start.”

RapidFort’s AI-powered platform offers Modern:

Curated Hardened Images: Continuously optimized, near-zero CVE images to enhance security posture from the start.
Automated Vulnerability Management: Real-time visibility and remediation to accelerate compliance with standards such as FedRAMP and CMMC.
Accelerated Time-to-Secure Deployment: Security embedded by default, enabling quick delivery of data-driven solutions to customers.

“There’s a growing demand for secure-by-design approaches to software deployment as security and compliance regulations evolve,” said Mehran Farimani, CEO of RapidFort. “We’re proud to partner with Modern to provide solutions that enhance and accelerate security while reducing vulnerabilities at scale.”

This partnership underscores a shared commitment between Modern and RapidFort to advance data security, compliance readiness, and customer trust. Schedule a call to learn more about how you can become a RapidFort partner.

About The Modern Data Company

The Modern Data Company is revolutionizing how businesses use data as a strategic asset. Its flagship platform, DataOS, is a cloud-native solution that solves complex data challenges 90% faster than traditional methods, at substantial cost savings. DataOS simplifies the entire data product lifecycle—from creation to deployment and maintenance—while uniquely supporting AI/ML era demands, including LLM and GenAI use cases, beyond conventional architectures. This empowers businesses to democratize data access for true self-service, accelerate time-to-market for data initiatives, and unlock data's full potential across the organization. By bringing software best practices to the data world, Modern is transforming data management with a focus on business outcomes. For more information visit: www.themoderndatacompany.com.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with curated near-zero CVE images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort Achieves Red Hat Certification, Strengthening Security for Enterprise Container Workloads

Press Release

January 13, 2026

RapidFort Achieves Red Hat Certification, Strengthening Security for Enterprise Container Workloads

RapidFort Analyzer has achieved the Red Hat Vulnerability Scanner Certification, validating compatibility, reliability, and performance.

No items found.

RapidFort Analyzer has achieved the Red Hat Vulnerability Scanner Certification, validating compatibility, reliability, and performance.

RapidFort Achieves Red Hat Certification, Strengthening Security for Enterprise Container Workloads

Certification validates accuracy, interoperability, and performance across Red Hat environments

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced that RapidFort Analyzer has achieved the Red Hat Vulnerability Scanner Certification, validating its compatibility, reliability, and performance across Red Hat platforms. This milestone underscores RapidFort’s commitment to delivering secure, high-performance container analysis and vulnerability management for enterprise workloads across Red Hat environments. Customers now gain increased confidence that their Red Hat–based container images are analyzed with exceptional precision, speed, and depth. This certification ensures seamless integration with Red Hat ecosystems, enabling organizations to trust that vulnerability scan results are accurate, reliable, and aligned with Red Hat’s rigorous quality standards.

As enterprises face an unprecedented surge in software vulnerabilities and supply chain risks, the challenge is more than operational, it’s systemic. According to the WEF Global Cybersecurity Outlook 2025, more than half of large organizations identify supply chain interdependencies as the top barrier to achieving cyber resilience, highlighting how hidden vulnerabilities in third-party software and vendors can ripple across entire ecosystems. Customers now benefit from RapidFort’s ability to eliminate noise from false positives, deliver research-backed vulnerability insights, and generate comprehensive SBOMs that improve software supply chain transparency. Combined with its ability to scan registries and Kubernetes clusters at scale, organizations can rapidly surface real risks, prioritize what truly matters, and strengthen compliance and security posture across their cloud-native environments, all while reducing operational overhead and accelerating secure software delivery.

The certification also demonstrates that RapidFort Analyzer seamlessly integrates with Red Hat platforms, leveraging Red Hat’s authoritative security data to accurately identify affected components, apply Red Hat–specific severity ratings, and exclude vulnerabilities that are not applicable or have already been resolved through backported fixes. This reduces false positives and enables teams to focus on actionable security findings.

“Developers are asked to do more than ever, and they need clear, reliable information so they can focus on the work that matters,” said Rajeev Thakur, CTO and Co-Founder of RapidFort. “As developers ourselves, the goal is to give teams accurate results they can trust, so they can move quickly and build with confidence. This certification reinforces that commitment and ensures we’re meeting the standards Red Hat teams depend on.”

Unlike other scanners, RapidFort Analyzer’s deep binary-level visibility and alignment with Red Hat security practices help organizations strengthen their security posture, reduce noise, and accelerate remediation across their containerized environments. For more information on RapidFort’s Analyzer, please visit: https://www.rapidfort.com/blog/inside-rapidfort-analyzer-precision-vulnerability-intelligence-for-containers.

For additional details on the Red Hat Vulnerability Scanner Certification, view Red Hat’s official listing here: https://catalog.redhat.com/en/software/vulnerability-scanner/detail/297217.

About RapidFort

With a free tier and community-maintained images, RapidFort makes secure development accessible to teams of any size. Learn more at rapidfort.com.

RapidFort Introduces Kimia Open Source Project

Press Release

January 13, 2026

RapidFort Introduces Kimia Open Source Project

Kimia provides an actively maintained alternative to Kaniko, enabling secure, verifiable, and compliant container builds.

No items found.

Kimia provides an actively maintained alternative to Kaniko, enabling secure, verifiable, and compliant container builds.

RapidFort Introduces Kimia Open Source Project

New container build platform replaces Kaniko with enterprise-grade security, 100% backward compatibility, and 90% attack surface reduction

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced the release of the Kimia open source project, a next-generation, daemon-less container build system, developed in collaboration with SOSi. Kimia is the natural successor to Kaniko—which is no longer maintained—and delivers 100% backward compatibility for Kaniko users while dramatically improving performance and security.

As organizations look for a secure, actively maintained alternative to Kaniko, Kimia steps in to fill the gap. Building on Kaniko’s innovation of removing Docker daemon dependencies, Kimia adds enterprise-grade security features and complete Dockerfile support. While maintaining Kaniko’s ease of use, Kimia introduces true rootless operation, and real-time Software Bill of Material (SBOM) generation, giving teams a secure, compliant, and efficient build pipeline for modern cloud environments. By running entirely as a non-root process and using minimal Linux capabilities (SETUID and SETGID), Kimia provides complete privilege isolation through user namespaces and is fully compliant with Kubernetes Pod Security Standards “Restricted” policy.

“Kaniko solves a critical challenge for developers, building containers securely without privileged mode,” said George Manuelian, Chief Strategist at RapidFort. “With Kimia, we take that foundation further by embedding attestation, signing, and continuous validation directly into the build process, transforming container builds into verifiable, supply chain–secure operations.”

Key highlights of Kimia include:

Drop in replacement for Kaniko
Reproducible builds: Ensures consistent, bit-for-bit identical outputs
Image Signing: Cryptographic signatures for verification
Attestation (SBOM & Provenance)
SBOM: Lists all software components in the image
Provenance: Documents how/when/where the image was built

“Collaborating on Kimia reinforces our commitment to advancing secure, modern software delivery,” said Kyle Fox, Chief Technology Officer at SOSi. “Kimia gives our teams — and the customers we serve — a hardened, fully verifiable build process with strong attestation that finally closes long-standing gaps in supply-chain security. It offers a seamless path forward for organizations that need both speed and compliance.”

Kimia is available immediately for download from ghcr.io, and organizations currently using Kaniko can migrate within minutes using existing configurations. For detailed migration guides, documentation, and deployment examples, visit https://us01.rapidfort.com/docs/smithy or the project’s GitHub repository at https://github.com/rapidfort/kimia.

About RapidFort

With a free tier and community-maintained images, RapidFort makes secure development accessible to teams of any size. Learn more at rapidfort.com.

RapidFort Strengthens Market Leadership and Gains Industry Recognition: Surpasses 100 Customers, 15,000 Curated, Near-zero CVE hardened images, and inclusion in Gartner® Research

Press Release

January 13, 2026

RapidFort Strengthens Market Leadership and Gains Industry Recognition: Surpasses 100 Customers, 15,000 Curated, Near-zero CVE hardened images, and inclusion in Gartner® Research

RapidFort advances software supply chain security, surpasses 100 customers, 15k hardened images, and earns 2025 Gartner Cool Vendor recognition.

No items found.

RapidFort advances software supply chain security, surpasses 100 customers, 15k hardened images, and earns 2025 Gartner Cool Vendor recognition.

RapidFort Strengthens Market Leadership and Gains Industry Recognition: Surpasses 100 Customers, 15,000 Curated, Near-zero CVE hardened images, and inclusion in Gartner® Research

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced major milestones that mark a surge in adoption, positioning the company for accelerated momentum and market expansion in 2026. The company has now exceeded 100 customers worldwide, including 40 that achieved FedRAMP or ATO certification through RapidFort’s platform and curated images. This continued traction underscores RapidFort’s leadership in trusted, compliant software delivery, reflected by a catalog of more than 15,000 Curated, near-zero CVE hardened images. RapidFort was also recognized in the 2025 Gartner® Cool Vendors™ in Container Management report.

“We maintain that our success reflects the trust our customers place in RapidFort to help them move faster and stay secure,” said George Manuelian, Chief Strategy and Sales Officer at RapidFort. “Our mission has always been to make secure software delivery a natural part of how modern teams build. The momentum we’re seeing today is proof that our approach resonates, and that RapidFort is becoming a trusted foundation for building software with confidence.”

Customer Trust Drives RapidFort’s Momentum

RapidFort’s growth is fueled by its ability to help teams build and ship secure software faster while reducing attack surfaces. Through a powerful combination of automated CVE remediation, continuous scanning, intelligent profiling, and automated hardening tools, RapidFort eliminates unnecessary vulnerabilities, streamlines compliance, and accelerates deployment cycles. Customers routinely achieve up to 95% fewer CVEs, reduced exposure across their software supply chain, and simplified audit readiness, all without code changes or pipeline disruption.

Expanding Customer Impact Across Regulated and Enterprise Markets

With over 100 organizations now leveraging RapidFort, the platform has become trusted across defense, federal, and enterprise sectors, with over 40 customers achieving FedRAMP or ATO certification. By automating vulnerability remediation, integrating runtime hardening, and providing Runtime Bill of Materials (RBOM™) visibility, RapidFort empowers teams to meet federal and enterprise standards with unprecedented speed. RapidFort’s customers include organizations such as:

Defense Unicorns - Used RapidFort to harden and deploy secure software in classified environments, eliminating over 98% of critical and high CVEs and reducing image sizes by a total of 140MB (5.9%).
ColorTokens - Accelerated federal certification timelines by three months after reducing its attack surface by 77% and cutting their vulnerability backlog.
Beyond Identity - Reduced compliance costs by 50% while shortening its path to FedRAMP approval by three months.

Expanding the Industry’s Most Comprehensive Hardened Image Catalog

In addition, RapidFort’s 15,000 curated near-zero CVE, hardened images represent the most comprehensive secure image catalog available today. Each image is FIPS 140-3 validated, and STIG/CIS benchmarked, ensuring enterprise-grade compliance from the start. Beyond images, RapidFort provides end-to-end supply chain protection, securing both first and third-party software with RBOM™ insights, runtime monitoring, and automatic workload hardening, all of which is designed to reduce vulnerabilities and strengthen software security across the software development lifecycle.

Industry Recognition and a Look Ahead

RapidFort’s recognition in the 2025 Gartner® Cool Vendors™ in Container Management report comes at a time where software supply chains have become central to national and enterprise resilience. It’s clear to us that, RapidFort is setting the standard for delivering hardened, compliant, and open-source-based software, faster and confidently.

For reference requirements for any listed customers, please email: [email protected]

For more information about the RapidFort platform, please visit: https://www.RapidFort.com.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with curated near-zero CVE images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

‍

CyberShark Pitch Competition Names RapidFort as 2025 Winner

Press Release

January 13, 2026

CyberShark Pitch Competition Names RapidFort as 2025 Winner

RapidFort is the winner of the 2025 CyberShark Pitch Competition, determined by CISO voting in the final round of the event series.

No items found.

RapidFort is the winner of the 2025 CyberShark Pitch Competition, determined by CISO voting in the final round of the event series.

CyberShark Pitch Competition Names RapidFort as 2025 Winner

LaunchTech extends gratitude to the CISOs who served as judges and provided expert insights and guidance throughout the 2025 CyberShark season

BALTIMORE--(BUSINESS WIRE)--LaunchTech Communications, a CyberRisk Alliance (CRA) resource specializing in PR and AR services for the cybersecurity industry, today announced RapidFort as the winner of the 2025 CyberShark Pitch Competition.

The 2025 event series spotlighting innovation and excellence in cybersecurity brought together promising growth-stage companies from across the market landscape, offering them a platform to demonstrate their technology and vision to a panel of CISOs and experienced industry experts.

The 2025 CyberShark Pitch Competition highlighted the innovative strength of cybersecurity vendors and reinforced CyberRisk Alliance’s commitment to advancing collaboration, thought leadership, and technological innovation across the industry.

RapidFort emerged as the 2025 winner as a result of presenting a compelling pitch during the final round, held virtually on Oct. 16. The event featured dedicated CISO members of the CyberRisk Collaborative and broader industry who participated as judges to vote for the winner.

Earlier rounds of this year’s CyberShark competition saw strong performances from a diverse field of competitors. At RSA Conference 2025, Dropzone AI, represented by Edward Wu, advanced as a finalist alongside RapidFort. At Black Hat USA 2025, Sandfly Security, represented by Craig Rowland, and Senteon, represented by Henry Zhang, joined the finalist lineup following standout presentations.

“We are honored to be named the winner of the 2025 CyberShark Pitch Competition,” said George Manuelian, Chief Strategy and Sales Officer at RapidFort. “This recognition reinforces our commitment to helping organizations build secure software, faster and with confidence. As security and compliance requirements evolve, it’s clear that integrating security from the start is no longer optional. The CyberShark experience has been incredible, connecting us directly with CISOs, providing valuable insights, and validating our mission to make secure software delivery a natural, continuous part of how modern teams build.”

Wayne Schepens, Chief Cyber Market Analyst at CyberRisk Alliance, added, “The CyberShark Pitch Competition is one of the most exciting projects I’ve had the fortune to lead. CyberShark gives growth-stage cybersecurity vendors a unique opportunity to validate their solutions, while receiving candid, actionable feedback on their messaging, positioning, and product-market fit. What makes this program so valuable is the collaborative spirit; our judges not only bring their deep expertise, but also an enthusiasm to engage in a supportive, low-pressure environment. It's a win-win: vendors gain champions, grow relationships, refine their go-to-market strategy, and test their solutions against peers, while CISOs gain early insight into innovations that could shape the future of the industry.”

The 2025 CyberShark Pitch Competition highlighted the innovative strength of cybersecurity vendors and reinforced CyberRisk Alliance’s commitment to advancing collaboration, thought leadership, and technological innovation across the industry.

If you are an emerging cybersecurity vendor and would like to be considered for a pitch slot in the 2026 CyberShark event series, please submit your self-nomination to [email protected].

For more information about LaunchTech Communications, visit https://golaunchtech.com.

About CyberRisk Alliance (CRA)

CyberRisk Alliance provides business intelligence that helps the cybersecurity ecosystem connect, share knowledge, accelerate careers, and make smarter and faster decisions. Through our trusted information brands, network of experts, and more than 250 innovative annual events we provide cybersecurity professionals with actionable insights and act as a powerful extension of cybersecurity marketing teams. Our brands include SC Media, the Official Cybersecurity Summits, Security Weekly, Identiverse, CyberRisk Collaborative, LaunchTech Communications, Execweb, InfoSec World, ChannelE2E, MSSP Alert, and TECHEXPO Top Secret. Learn more at www.cyberriskalliance.com.

‍

Krumware and RapidFort Partner to Deliver Comprehensive Container Security Solutions with Near-Zero CVE Images

Press Release

January 13, 2026

Krumware and RapidFort Partner to Deliver Comprehensive Container Security Solutions with Near-Zero CVE Images

RapidFort and Krumware partner to deliver near-zero CVE images, 60% faster deployments, and streamlined compliance for enterprise container security.

No items found.

RapidFort and Krumware partner to deliver near-zero CVE images, 60% faster deployments, and streamlined compliance for enterprise container security.

Krumware and RapidFort Partner to Deliver Comprehensive Container Security Solutions with Near-Zero CVE Images

New container build platform replaces Kaniko with enterprise-grade security, 100% backward compatibility, and 90% attack surface reduction

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced a strategic partnership with Krumware, a leading platform engineering and cloud-native application development company, to provide enterprises with secure, optimized container workloads. By combining Krumware’s platform engineering expertise with RapidFort's container hardening technology and AI-powered software security platform, the two companies are addressing the critical security challenges enterprises face deploying containerized applications at scale.

According to the SecurityVulnerability.io database there have been 33,969 vulnerabilities published so far in 2025, a 21% YoY increase when compared to this time in 2024, highlighting common enterprise security challenges like image sprawl, vulnerability management, and upstream supply chain risk. These challenges only represent a portion of the issues modern enterprises face when securing and deploying containerized applications across their environments and underscore the urgency of adopting comprehensive software supply chain security solutions. With RapidFort's curated near-zero CVE Images, DevTime profiling, and RunTime protection, organizations can reduce up to 95% of vulnerabilities and shrink their attack surface by 90%. Complementing this, Krumware’s platform engineering expertise ensures quick, seamless integration and enterprise-wide adoption.

"Modern enterprises need more than just vulnerability scanning; they need proactive security that's built into their development lifecycle," said Colin Griffin, Founder & CEO of Krumware. "Our partnership with RapidFort enables us to deliver hardened, optimized container workloads that dramatically reduce security risk while accelerating time-to-market for our clients' applications."

The integrated solution combines:

RapidFort's Near-Zero CVE Images: Hardened container images based on trusted LTS Linux distributions like Ubuntu, RHEL, Debian, and Alpine, with no vendor lock-in to proprietary OS.
Automated Attack Surface Reduction: Automatically secure unused components and shrink your software attack surface by 90% without burdening your development teams.
Krumware's Implementation Expertise: Industry leading cloud-native application development, Kubernetes deployment strategies, and platform engineering practices.
Continuous Security Optimization: Runtime protection and DevTime profiling for ongoing security posture improvement.

"Container security can't be an afterthought in today's threat landscape," said Mehran Farimani, CEO of RapidFort. "Our partnership with Krumware ensures that enterprises not only have access to secure container images, but also the engineering expertise and implementation support needed to deploy and maintain truly secure container environments."

The partnership delivers immediate value by accelerating deployment timelines and strengthening enterprise security posture. Early implementations have shown up to 95% fewer vulnerabilities and deployment time improvements of 60% compared to traditional container security approaches. Enterprises also benefit from faster compliance with hardened NIST 800-70 images, FIPS 140-2 validation, and integrated CIS/STIG benchmarks, as well as lower infrastructure costs through smaller, more efficient containers.

The joint solution is immediately available to enterprise customers through both companies' professional services organizations.

For more information about the RapidFort platform, please visit: https://www.RapidFort.com

About Krumware:

Krumware specializes in cloud-native software and platform engineering and provides services, software, and technical resources. By leading with developer advocacy and expertise developed through practice, Krumware helps companies build better software. For more information, visit: https://www.krum.io.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort the Leading Replacement for Bitnami Helm Charts Compatible Images

Press Release

January 13, 2026

RapidFort the Leading Replacement for Bitnami Helm Charts Compatible Images

RapidFort emerges as the leading replacement for Bitnami helm charts compatible images.

No items found.

RapidFort emerges as the leading replacement for Bitnami helm charts compatible images.

RapidFort the Leading Replacement for Bitnami Helm Charts Compatible Images

RapidFort’s hardened, near-zero CVE, image catalog offers Bitnami compatibility and simple migration, reducing CVEs by up to 100% while helping maintain compliance, strengthen security, and reduce costs

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, emerges as the clear leader in this transition, offering curated near-zero CVE images compatible with Bitnami helm charts, as enterprises seek alternatives to Bitnami’s recently deprecated image registry. With a catalog of Bitnami-compatible, production-grade container images, RapidFort enables organizations to maintain operational continuity while strengthening security and streamlining compliance.

Bitnami’s transition to a subscription-based image catalog has affected more than 500 million image pulls, forcing teams to remediate sudden risks in operational stability, compliance, and security. Many organizations project replacement costs to be between $100,000 and $500,000 annually. RapidFort’s curated images offer a cost-effective replacement that preserves existing workflows while strengthening long-term security and compliance.

RapidFort’s curated images offer a cost-effective replacement that preserves existing workflows while strengthening long-term security and compliance.

“We started RapidFort with the purpose of giving organizations the confidence to scale without sacrificing security,” said Mehran Farimani, CEO of RapidFort. “As the container ecosystem continues to evolve, teams need reliable tools that they can trust. We remain focused on helping teams adapt quickly and securely without compromising the standards they rely on.”

RapidFort’s AI-powered platform analyzes runtime to remove unused components, producing smaller, faster containers with an average ~95% CVE reduction and up to ~80% smaller images; for many popular stacks it eliminates all known vulnerabilities. Each SLSA Level 3, non-root image includes continuous monitoring and hardening, zero-day protection, cryptographic signing, provenance, SBOMs and VEX, and the catalog spans 200+ hardened images across common infrastructure, developer stacks and DevOps tooling.

RapidFort’s runtime scanner integrates with Helm charts, GitOps and Kubernetes operators with no app changes, inventories images to flag safe replacements, and enables validation and rollout in under four weeks with automated tests and blue-green deployment with rollback, supporting no-downtime migration and compliance with SOC 2, PCI DSS and NIST through minimized scope, distroless execution, audit trails and continuous control validation.

To begin your transition, schedule a 30-minute assessment to evaluate current Bitnami image usage and identify compatible RapidFort alternatives. With the help of RapidFort’s team, organizations can develop a customized transition strategy and complete rollout in under four weeks, resulting in long term improvements in security, compliance, and operational efficiency.

For more information about the RapidFort platform, please visit: https://www.RapidFort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

Defense Unicorns Accelerates Secure Software Delivery for Defense Missions with RapidFort

Press Release

January 13, 2026

Defense Unicorns Accelerates Secure Software Delivery for Defense Missions with RapidFort

Defense Unicorns achieves near-zero CVEs, delivers FIPS-validated modules, and accelerates secure software deployment using RapidFort’s platform.

No items found.

Defense Unicorns achieves near-zero CVEs, delivers FIPS-validated modules, and accelerates secure software deployment using RapidFort’s platform.

Defense Unicorns Accelerates Secure Software Delivery for Defense Missions with RapidFort

Partnership strengthens software security posture and enables faster deployments for defense environments

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, has partnered with Defense Unicorns, a veteran-owned defense tech startup, to scale and strengthen its container infrastructure while accelerating deployment of its secure runtime platform for defense missions, Unicorn Delivery Service (UDS). By leveraging RapidFort’s platform and Curated Near-Zero CVE Images, Defense Unicorns achieved a near-zero CVE state across the UDS platform, accelerated delivery, enhanced compliance, and optimized deployment without the overhead of building internal hardening pipelines.

“RapidFort’s experience within classified environments and collaborative approach has made them a trusted partner in helping us deliver secure, reliable software to the teams who need it most, without slowing down mission-critical deployments,” said Rob Slaughter, CEO of Defense Unicorns. “Their curated images, FIPS-validated modules, and hands-on support enabled our teams to meet compliance requirements effortlessly while accelerating delivery.”

Like many organizations delivering software in classified environments, Defense Unicorns faced the challenge of hardening software containers at scale, without delaying delivery. This prompted them to make a “build vs. buy” decision and, after evaluating multiple options and the current ecosystem of secure container vendors, they selected RapidFort as the most effective partner to meet their operational and security goals.

RapidFort and Defense Unicorns addressed these challenges by:

Eliminating over 98% of critical and high CVEs in the UDS Core platform compared to upstream images.
Delivering FIPS-validated modules across all 32 UDS Core images to support deployments in compliance-sensitive environments.
Reducing image sizes by a total of 140MB (5.9%), accelerating deployment in low-bandwidth and tactical edge environments.
Providing engineering collaboration to support fast turnaround on FIPS-compliant builds and resolve emerging issues.
Enabling Defense Unicorns to harden containers for its proprietary products, such as the UDS Registry, an OCI-compliant registry launched in June 2025.

“Security and speed are equally mission-critical in defense environments, but for many companies, achieving both can feel impossible,” said Mehran Farimani, CEO of RapidFort. “By leveraging RapidFort’s platform and Curated Near-Zero CVE Images, Defense Unicorns proved that it’s possible to accelerate the delivery of secure, compliant software, without compromising mission readiness.”

RapidFort, available through Platform One, Tradewind Marketplace, AWS Marketplace, Microsoft Azure Marketplace, Google Cloud Marketplace, Carahsoft, and now Azul provides organizations with a reliable and efficient pathway to secure their software supply chain. For more information about the RapidFort platform, please visit: https://www.rapidfort.com

To get started using UDS with RapidFort’s Curated Near-Zero CVE Images to securely deliver software for national security missions, reach out to Defense Unicorns at [email protected] or https://defenseunicorns.com/contact-us.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

About Defense Unicorns

Defense Unicorns is a veteran-owned defense tech startup founded in 2021 to make software a strategic deterrent for the U.S. Department of Defense. They build innovative technical solutions to securely develop and deploy mission software across cloud, on-premises, and tactical edge environments. ‘Defense Unicorns’ is trusted by the operators of some of the most critical systems in the world, including the U.S. Navy, Army, Air Force, and Space Force. Learn more about Defense Unicorns at https://defenseunicorns.com.

Azul and RapidFort Partner to Deliver Near-Zero CVE Enterprise Grade Java Container Images, Backed by Commercial Java Support

Press Release

January 13, 2026

Azul and RapidFort Partner to Deliver Near-Zero CVE Enterprise Grade Java Container Images, Backed by Commercial Java Support

Strategic collaboration aims to dramatically reduce security patching burden and strengthen software supply chain security for enterprise Java customers

No items found.

Azul and RapidFort Partner to Deliver Near-Zero CVE Enterprise Grade Java Container Images, Backed by Commercial Java Support

Strategic collaboration aims to dramatically reduce security patching burden and strengthen software supply chain security for enterprise Java customers

SUNNYVALE, Calif. & PALO ALTO, Calif.--(BUSINESS WIRE)--Azul, the only company 100% focused on Java, and RapidFort, the industry leader in software supply chain security, today announced a strategic partnership to deliver near-zero Common Vulnerabilities and Exposures (CVEs) third-party container images backed by Azul’s world-class Java support. This partnership, which combines Azul’s entire commercial Java portfolio, including Azul Platform Core and Azul Platform Prime, with RapidFort Curated Images, will accelerate developer productivity and reduce the burden of security patching while enabling secure software development practices to protect the software supply chain.

The partnership comes at a critical time as organizations face mounting pressure to secure their software supply chains amid escalating cyber threats. According to Verizon’s 2025 Data Breach Investigations Report, the exploitation of vulnerabilities (CVEs) has seen another year of growth and will surpass credential abuse as the #1 security attack vector by 2026. This places an enormous burden on both security and developer teams who must continuously patch and update systems.

Strategic collaboration between Azul and RapidFort aims to dramatically reduce security patching burden and strengthen software supply chain security for enterprise Java customers.

Transforming Container Security

RapidFort and Azul have joined forces to redefine how enterprises secure and run Java workloads in containers. By combining RapidFort’s advanced container optimization technology with Azul’s Platform Core and Platform Prime runtimes for Java 8 and later, organizations can now deploy hardened Java containers with unprecedented efficiency and security. These jointly curated images reduce vulnerabilities by up to 90%, significantly shrinking the attack surface. As a result, development teams benefit from less frequent patching and greater productivity, accelerating innovation without compromising security.

Unlocking Value Across Security, Speed, and Costs

The Azul/RapidFort partnership delivers several significant advantages for enterprise customers, including:

Reduced Patching Burden: Near-zero CVE container images mean fewer vulnerabilities to patch, allowing security teams to focus on more strategic initiatives.
Enhanced Supply Chain Security: Hardened container images provide a secure foundation for the entire software development lifecycle.
Accelerated Development: Developers can build applications faster without compromising security.
Regulatory Compliance: Compliance is made easier despite increasingly stringent security regulations and frameworks such as NIS2, CMMC and FedRAMP.
Lower Operational Costs: Maintenance burden and risk of security incidents is dramatically reduced.

”Enterprises are drowning in security vulnerabilities and patches,” said Mehran Farimani, founder and CEO of RapidFort. “Our partnership with Azul allows us to provide customers with hardened container images that are not only more secure by design but require significantly less ongoing maintenance. This is a game-changer for organizations looking to strengthen their security posture while reducing operational overhead.”

“Java remains the backbone of enterprise applications worldwide, and securing the Java ecosystem is critical to protecting the software supply chain,” said Scott Sellers, co-founder and CEO at Azul. “By partnering with RapidFort, we’re enabling organizations to deploy Java applications with confidence, knowing they’re backed by Azul’s world-class support organization and built on a foundation of security-hardened container images with minimal vulnerability exposure.”

Availability

The first set of jointly developed hardened container images is available immediately. These images will include all Java LTS (Long Term Support) releases starting with Java 8, and popular Java applications such as Apache Spark, Apache Kafka and Apache Tomcat. Interested customers can request more information here.

For more information:

About Azul

Headquartered in Sunnyvale, California, Azul provides the Java platform for the modern cloud enterprise. Azul is the only company 100% focused on Java. Millions of Java developers, hundreds of millions of devices and the world’s most highly regarded businesses trust Azul to power their applications with exceptional capabilities, performance, security, value, and success. Azul customers include 36% of the Fortune 100, 50% of Forbes top 10 World’s Most Valuable Brands, all 10 of the world’s top 10 financial trading companies. and leading brands like Avaya, Bazaarvoice, BMW, Deutsche Telekom, LG, Mastercard, Mizuho, Priceline, Salesforce, Software AG, and Workday. Learn more at azul.com and follow us @azulsystems.

About RapidFort

RapidFort is a software supply chain security platform that secures and optimizes modern infrastructure by reducing the attack surface of containerized applications and near-zero CVE, curated base images. Through continuous monitoring and intelligent removal of unnecessary components from container images, RapidFort significantly minimizes vulnerability exposure and patching requirements. This innovative approach enhances security posture, improves operational efficiency, and ensures end-to-end protection across the global software supply chain. The company's innovative approach has been recognized by leading industry analysts and is trusted by Global 2000 companies across finance, healthcare, and government sectors. For more information, visit www.rapidfort.com

RapidFort Assessed “Awardable” for Department of Defense work in the P1 Solutions Marketplace

Press Release

January 13, 2026

RapidFort Assessed “Awardable” for Department of Defense work in the P1 Solutions Marketplace

RapidFort now available in the P1 Solutions Marketplace, enabling government agencies and contractors to streamline software security and compliance.

No items found.

RapidFort now available in the P1 Solutions Marketplace, enabling government agencies and contractors to streamline software security and compliance.

RapidFort Assessed “Awardable” for Department of Defense work in the P1 Solutions Marketplace

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM) today announced that it has achieved “Awardable” status through the Platform One (P1) Solutions Marketplace.

The P1 Solutions Marketplace is a digital repository of post-competition, 5-minute long readily awardable pitch videos, which address the Government’s greatest requirements in hardware, software and service solutions. RapidFort’s solutions are designed to help developers significantly reduce the time and cost by at least 50% to achieve cATO and FedRAMP with near Zero CVE Curated Images and a broad set software hardening tools. RapidFort is used by a wide range of businesses, including Beyond Identity, Avalara, and Blue Cycle as well as government agencies such as the U.S. Air Force and Space Force.

“Our inclusion in the P1 Marketplace is a major step forward as we continue to strengthen our relationship with the Department of Defense,” said Mehran Farimani, CEO of RapidFort. “This milestone allows us to better support government agencies and contractors as they secure their software infrastructure, streamline compliance efforts, and accelerate the deployment of critical solutions. We’re excited to continue supporting the defense community with our innovative solutions, enhancing software security for all.”

RapidFort’s video, RapidFort CVE Management Platform with SCA Scanner, Profiler, Automated Image Hardening and Near Zero CVE Image Catalog, accessible only by government customers on the P1 Solutions Marketplace, presents an actual use case in which the company provides a complete software supply chain toolset for containerized workloads that includes image scanner, profiler, hardening tools along with FIPS compliant, STIGed Near Zero CVE Images. RapidFort was recognized among a competitive field of applicants to the P1 Solutions Marketplace whose solutions demonstrated innovation, scalability, and potential impact on DoD missions. Government customers interested in viewing the video solution can create a P1 Solutions Marketplace account at https://p1-marketplace.com.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

About the P1 Solutions Marketplace:

The P1 Solutions Marketplace is a digital repository of post-competition, readily awardable pitch videos that address the Department of Defense’s (DoD) most significant challenges in hardware, software and service solutions. All awardable solutions have been assessed through complex scoring rubrics and competitive procedures and are available to Government customers with a Marketplace account. Government customers can create an account at https://p1-marketplace.com.

For more information or media requests, contact: [email protected].

Contact RapidFort for additional information.

CyberShark Pitch Competition Names Finalists from First Round of 2025 Event Series

Press Release

January 13, 2026

CyberShark Pitch Competition Names Finalists from First Round of 2025 Event Series

Congratulations to Dropzone AI and RapidFort, the "Round 1" Finalists in the 2025 CyberShark Pitch Competition

No items found.

Congratulations to Dropzone AI and RapidFort, the "Round 1" Finalists in the 2025 CyberShark Pitch Competition

CyberShark Pitch Competition Names Finalists from First Round of 2025 Event Series

While on site at the 2025 RSA Conference, a panel of 10 CISO judges evaluated pitches from emerging cybersecurity companies in search of stand-out solutions – Congratulations to finalists Dropzone AI and RapidFort

BALTIMORE--(BUSINESS WIRE)--Hosted by LaunchTech Communications, a CyberRisk Alliance (CRA) resource specializing in PR and AR services for the cybersecurity industry, the CyberShark Pitch Competition today announced the first two finalists to advance in the 2025 program.

The CyberShark Pitch Competition provides emerging cybersecurity companies with an opportunity to pitch their product and receive feedback from Chief Information Security Officers (CISOs). During the in-person event held the week of RSA Conference, CISO judges from a variety of industries – including insurance, technology, food and beverage, pharmaceutical distribution, manufacturing, financial services, and more – voted to determine which presentation conveyed the most distinct value proposition and clear messaging.

By providing a platform for emerging companies to showcase their innovative solutions, we're not just identifying potential game-changers, we're actively investing in the future of cybersecurity.

“Not only did our exceptional panel of judges generously offer their time and deep cybersecurity expertise, but they also brought an incredibly meaningful level of enthusiasm to engage with the early-stage participants,” said Taylor Hadley, Vice President, LaunchTech Communications. “Their thoughtful post-pitch feedback ensured that each pitching company received immediate, actionable feedback on their messaging, positioning, and product-market fit in a supportive, low-pressure environment.”

Congratulations to the finalists!

2025 CyberShark Pitch Competition “Round 1” Finalists:

Dropzone AI – Provides pre-trained autonomous AI SOC analysts that work tirelessly alongside human teams.
RapidFort – Eliminates 95% of software vulnerabilities without code changes through its attack surface management platform and near-zero CVE images.

This round of the pitch event was particularly competitive, with each participating company demonstrating exceptional preparedness and exciting technological advancements. During the judging process, the CISO panel consistently commented on a few key elements of a strong pitch. These included: the value of delivering a clear problem statement, while avoiding FUD (fear, uncertainty and doubt); addressing how the product integrates with other systems and how it fits into the broader cybersecurity landscape; and providing examples of how the product performs in real-world scenarios demonstrates measurable benefits.

"The CyberShark Pitch Competition exemplifies the community spirit of our CISO network," said Dustin Sachs, Chief Technologist and Senior Director of Programs with the CyberRisk Collaborative. "By providing a platform for emerging companies to showcase their innovative solutions, we're not just identifying potential game-changers, we're actively investing in the future of cybersecurity. This program is a win-win; cybersecurity vendors gain invaluable feedback to inform their go to market strategy and exposure to potential word of mouth referrals, and our CISO community gains insight into breakthrough solutions and serve to potentially influence how these companies ultimately meet market needs."

"We established this program to ensure our clients have the opportunity to validate their solutions and interact directly with industry decision makers,” said Wayne Schepens, Chief Cyber Market Analyst of CyberRisk Alliance. "CyberShark allows vendors to gather valuable input, identify champions, validate their messaging and test their solutions against others. For vendors, there is no better test than pitching industry CISOs in a competitive environment; and for buyers there is no better way for them to play a role in the direction of future innovation. We look forward to continuing this initiative while making it available to more and more practitioners and technology producers.”

A second opportunity to pitch CISO judges in person will take place during the week of Black Hat USA 2025, where two more finalists will advance in the CyberShark Pitch Competition. Those finalists, and the finalists from RSA Conference, will go head-to-head in the final round of the competition taking place virtually as part of a live broadcast in the fall of 2025. All 2,000+ members of CyberRisk Collaborative will be invited to participate as judges in the final round. More information about CyberShark can be found here.

For more information about LaunchTech Communications, visit https://golaunchtech.com.

About CyberRisk Alliance (CRA)

ColorTokens Slashes Federal Compliance Timelines and Enhances Container Security with RapidFort

Press Release

January 13, 2026

ColorTokens Slashes Federal Compliance Timelines and Enhances Container Security with RapidFort

RapidFort optimizes ColorTokens federal compliance efforts and containerized infrastructure security.

No items found.

RapidFort optimizes ColorTokens federal compliance efforts and containerized infrastructure security.

ColorTokens Slashes Federal Compliance Timelines and Enhances Container Security with RapidFort

Partnership significantly improved company’s operational efficiency by eliminating critical software vulnerabilities and fast-tracking certification audits by three months

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, has partnered with ColorTokens Inc., a pioneer in Zero Trust security and leader in microsegmentation, to strengthen its containerized infrastructure security and optimize its federal compliance efforts. By leveraging RapidFort’s platform, ColorTokens notably reduced its attack surface by 77%, minimizing its security risks and improving security operations.

“RapidFort has measurably strengthened the security of both our cloud‑hosted SaaS platform and our on‑premise product,” said Harish Akali, CTO of ColorTokens, “It’s hardened container images, continuous scanning, and clear remediation guidance have cut our vulnerability backlog and supplied the evidence we needed to fast‑track FedRAMP, IRAP, and other certification audits.”

Like many organizations who enter the federal marketplace, ColorTokens was challenged by diverse third-party base images and complex DevSecOps workflows. The constant need to maintain stringent federal compliance standards, including FIPS and STIG, required a solution that would reduce vulnerabilities without overburdening engineering resources.

RapidFort helped ColorTokens address these challenges by:

Deploying FIPS and STIG aligned pre-hardened, near-zero CVE images for Ubuntu, Redis, Golang, and Node.js.
Reducing vulnerabilities through intelligent runtime profiling and automated removal of unused software components, dramatically reducing exposure and cutting down on manual patching efforts.
Embedding RapidFort’s runtime-aware scanner into CI/CD pipelines, providing continuous visibility, real-time vulnerability insights, and proactive control.
Accelerating compliance readiness by three months using built-in benchmarking and STIGing tools, simplifying the path to federal certifications like FedRAMP.

“Far too often, organizations must divert critical resources to remediate vulnerabilities and meet compliance requirements, rather than advancing core business priorities,” said Mehran Farimani, CEO of RapidFort. “By leveraging the RapidFort platform to optimize vulnerability management and minimize their security risks, ColorTokens was able to secure their software faster and with less strain on their teams, reducing the burden of meeting stringent federal compliance requirements.”

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort Simplifies FedRAMP Certification with Curated Images Supporting FIPS 140-3 Compliance

Press Release

January 13, 2026

RapidFort Simplifies FedRAMP Certification with Curated Images Supporting FIPS 140-3 Compliance

RapidFort adds FIPS 140-3 compliance to Curated Images, providing a secure foundation for software development, deployment, and FedRAMP authorization.

No items found.

RapidFort adds FIPS 140-3 compliance to Curated Images, providing a secure foundation for software development, deployment, and FedRAMP authorization.

RapidFort Simplifies FedRAMP Certification with Curated Images Supporting FIPS 140-3 Compliance

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), has announced support for FIPS (Federal Information Processing Standards) 140-3 compliance through its industry-first curated images offering. This leading-edge capability enables customers to easily meet the stringent security and compliance requirements of federal agencies and contractors. RapidFort is the first in the industry to achieve this milestone, accelerating the company’s leadership in zero Common Vulnerabilities and Exposure (CVE) images.

Replacing the widely adopted FIPS 140-2 cryptographic standard, FIPS 140-3 introduces enhanced protection against modern threats and aligns with international ISO/IEC (International Organization for Standardization/International Electrotechnical Commission) standards. FIPS 140-3 compliance is critical for organizations in government and regulated markets, securing sensitive data and meeting modern security requirements. A necessary step for companies looking to enter the federal marketplace, RapidFort streamlines FIPS readiness by providing FIPS 140-3 compliance across its entire portfolio of curated images, going beyond any other offering in the market. This ensures federal agencies and contractors can deploy secure and compliant software faster and more efficiently, accelerating time to market and saving enterprise development resources. When leveraging RapidFort’s Curated Images, users can expect:

Broad community support and no vendor lock-in: RapidFort allows customers to retain access to a wide range of major operating system (OS) distributions like Ubuntu, Red Hat, Alpine, and Debian (both FIPS and non-FIPS), with active community support. This ensures flexibility and cutting-edge functionality without compromise.
Minimal disruption to existing software pipelines: RapidFort integrates seamlessly into current workflows, allowing users to address vulnerabilities without requiring changes to existing tools or distributions. This reduces risks and avoids the disruptions typically associated with switching to unfamiliar operating systems, frameworks or platforms.
Cost-effective Enterprise License Agreement (ELA) model for comprehensive use: With a simplified pricing structure, RapidFort provides access to both FIPS and non-FIPS variants, including Bitnami and official-image versions, under a single repository. This unified model offers significant cost savings compared to competitors that charge separately for each variant, making it ideal for both Federal Risk and Authorization Management Program (FedRAMP) and commercial environments.
Streamlined compliance for FedRAMP and other standards: RapidFort simplifies regulatory compliance by including essential Center for Internet Security (CIS) and Security Technical Implementation Guides (STIG) benchmarking tools. Unlike competitors, RapidFort supports Defense Information Systems Agency (DISA) -approved distributions like Ubuntu and Red Hat, ensuring compliance even when configurations change during the build process.

“Meeting strict security and compliance requirements, especially in the federal space, can be an overwhelming challenge for organizations,” said Mehran Farimani, CEO of RapidFort. “We believe the path to compliance shouldn’t have to be complicated or restrictive. Our curated images streamline this process, allowing our customers to focus on their core mission, while we handle the rest.”

RapidFort offers an end-to-end solution for CVE remediation, addressing all three lifecycle steps: curated images, instrumenting and profiling, and hardening and monitoring. Unlike other offerings that rely on third parties and additional tools, RapidFort provides a comprehensive platform that manages the entire remediation process, from images to production.

To learn more about RapidFort Curated Images, please visit: https://hub.rapidfort.com

For more information about the RapidFort platform, please visit: https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

Solution Brief

July 13, 2026

RapidFort Curated Libraries

No items found.

Solution brief | Software supply chain security

RapidFort Curated Libraries

A comprehensive catalog of malware-scanned and curated libraries

Extends RapidFort protection beyond operating systems, software images, and packages to independently deployable libraries.

npm

PyPI

Maven

RubyGems

NuGet

WHERE RAPIDFORT CURATED LIBRARIES FIT

Curated Libraries sit early in the software delivery process - before untrusted packages enter the build, artifacts, or production.

Open Source Ecosystems

npm PypI Maven RubyGems NuGet

RapidFort Curated Libraries
Trusted libraries consumed through existing workflows

Build & CI/CD
Buid pipelines packages

Images & Artifacts

Container images internal artifacts

Delivered through existing package and artifact workflows no new security friction while security teams set policy on approved packages, versions, and images.

The Challenge

Attackers compromise maintainer accounts, publish malicious updates, or typosquat popular packages.

Attackers compromise maintainer accounts, publish malicious updates, or typosquat popular packages.
‍
The RapidFort Solution

Malware-scanned libraries developers can trust.

Same versions, interfaces, features, and CLI syntax already in use.

Consumed earlier in development - a preventive, not reactive, model.

The Result

Lower likelihood that malware reaches build pipelines, artifacts, or production.

Prevention up front instead of reaction after public disclosure.

KEY CAPABILITIES

Malware scanning at the source

Helps prevent malicious packages and compromised dependencies from entering pipelines.

Existing workflow support

Works with current operating systems, tools, artifact repositories, interfaces, and CLI syntax.

Reduced incident response burden

Less time hunting for malware and vulnerabilities after public disclosures.

Continuous compliance visibility

Up-to-date assessment and reporting for auditors, customers, and boards.

Policy-driven security

Shift from reactive vulnerability response to a proactive consumption model.

COMMON USE CASES

Secure open-source package consumption

Protected libraries for npm, PyPI, Maven, RubyGems, and NuGet ecosystems.

Reduce incident-response churn

Limit recurring "are we exposed?" investigationsafter a newly disclosed malicious package.

Protect CI/CD and production environments

Reduce the risk that malware enters a build,
artifact, image, or runtime through a dependency.

Support audits and customer assurance

Current compliance reporting to demonstrate security controls are in place.

Standardize approved software intake

A shared process across engineering and security
for consuming open-source libraries, packages,
and images.

THREATS ADDRESSED

Helps mitigate supply-chain malware in compromised packages and dependencies, including:

Malicious binaries

Backdoored dependencies

Install-time payloads

Typosquatted packages

Credential-stealing code

Downloaders

Cryptominers

Rootkits

Ransomware

…and other unauthorized changes introduced into open-source components.

BUSINESS OUTCOMES

Developer velocity

Maintain velocity while consuming trusted libraries.

Reduced malware risk

Lower chance of malware entering development and production.

Less incident churn

Less time responding to supply-chain incidents.

Audit-ready posture

Current reporting for customer, auditor, and board-level assurance.

No vendor lock-in

Keep familiar tools and operating systems.

SUMMARY

RapidFort Curated Libraries shift open-source security from detection and response to prevention -giving developers malware-scanned, compatible libraries that reduce the risk of compromised dependencies reaching production.

Solution Brief

July 7, 2026

RapidFort Supply Chain Risk Analysis

No items found.

Solution brief

RapidFort Supply Chain Risk Analysis

Independent, deep-binary malware and tampering detection across every image, library, file, and package before it ever reaches your environment.

Software supply chains run components that organizations did not build and cannot fully see. Malicious actors increasingly compromise open-source packages and container layers, embedding threats deep inside artifacts that signature-based scanners and vulnerability lists never reach. Self-reported fixes in new versions are not independently verifiable, and by the time a compromised package is discovered, it is often already running in production.

Security teams need a way to assess every artifact entering their environment, including images, open-source libraries, files, and packages, for malware and tampering before onboarding, not after an incident.

Solution

Supply Chain Risk mitigation is an integrated profiling and risk assessment capability built into the RapidFort platform. For RapidFort Curated Images (for Red Hat, Ubuntu, Debian, and Alpine) it automatically scans open-source libraries, files, and packages across ecosystems (including npm, PyPI, Maven, and RubyGems) for malware, tampering, and hidden threats, and surfaces the results in a dedicated Supply Chain Risk view.

This assessment is independently powered by ReversingLabs Spectra Assure, giving businesses a security claim backed by an independent, named third-party company rather than a self-reported scan result.

Up to 99.9%

CVE elimination in open-source images

422B+

files tracked by ReversingLabs threat intelligence

3-6 Months

faster time to compliance vs. platform migration

Key Capabilities

Malware-Scanned : Eliminate malicious binaries and install-time payloads at the source, across images, libraries, files, and packages.

Differential Version Analysis : Compares new package versions against prior releases to catch newly introduced malware or risky behavior changes.

Evidence-Backed Audit Trail : Every release includes an independently generated security report for customers, auditors, and regulators.

Tampering Verification : Cryptographic andstructural analysis helps identify unauthorizedmodification or repackaging of delivered artifacts.

Policy-Driven Release Gates : Packages that failsecurity policy are automatically blocked from the catalog until risks are remediated.

Pin-for-Pin Compatibility : Drop-in replacement that works with existing OS, tools, and CLI syntax. No migration or proprietary package manager.

How It Works

Assess before inclusion

Open-source packages from a
public repository are automatically
scanned for malware, tampering,
and hidden threats before they
are included, giving security
teams a full risk profile.

Identify risky updates
automatically

Version-to-version analysis
verifies that a new version
actually reduces risk instead of
introducing a new supply chain
risk.

Security becomes an
enabler, not a bottleneck

Policy-driven assessments
embedded directly in the
workflow let teams understand
risks to enable rapid decisions.

Why RapidFort

Named, independent validationRapidFort is the only vendor whose open-source library catalog is independently validated by a separate, namedthird-party security company using enterprise-grade deep-binary malware detection.

Hardening and risk assessment in one pipeline.The RapidFort hardening pipeline has helped enterprise customers eliminate up to 99.9% of CVEs from containerimages combined with continuous malware and tampering assessment across the same artifacts.

No migration, no lock-inWorks with standard pip, Maven, npm, and OS package interfaces that teams already use with no proprietarypackage manager, custom OS distribution, or vendor-specific toolchain required.

Availability

RapidFort Supply Chain Risk, with open-source library validation powered by ReversingLabs Spectra Assure, is generally available today for Python and Java ecosystems, with JavaScript in closed beta. OS package coverage spans Red Hat, Ubuntu, Debian, and Alpine, with additional language runtimes and application package catalogs on an accelerated roadmap. Existing RapidFort customers can enable Supply Chain Risk and library coverage through the platform console or by contacting their account team.

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software, enabling organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and independently malware-scanned open-source images. RapidFort is headquartered in Sunnyvale, California.