What is an RBOM® (Runtime Bill of Materials)?

Runtime Bill of Materials (RBOMs®) operate as a dynamic, execution-aware refinement of the Software Bill of Materials (SBOM). SBOMs record all software artifacts associated with a build, whereas RBOMs® capture only the components that are actually executed or loaded into memory at runtime. Thinking about how an RBOM improves compliance requires analyzing large codebases, identifying unused components, isolating what is truly essential, and reducing SBOM elements that unnecessarily expand the attack surface.

SBOM

Records all software artifacts associated with a build.

RBOM®

Captures only the components that are actually executed or loaded into memory at runtime.

RBOM® as a Risk Reduction Tool

One of the best ways to think about RBOM® is in terms of risk reduction. In many DevSecOps pipelines, teams believe security has been fully integrated once scanning is enabled and builds are passing. However, if a scanner is configured too permissively or lacks meaningful baselining, there may be no effective comparison between versions or visibility into what truly changed. Simply comparing one build to the next does not always provide actionable insight. RBOM® goes further by establishing a runtime baseline and evaluating which libraries, binaries, dependencies, and other code elements are actually executed. This approach ensures that organizations do not spend time managing vulnerabilities in code their product does not use.

RBOM® and FedRAMP CM-8 Compliance

FedRAMP, under CM-8 guidance, requires a complete and up-to-date inventory of all system components. This process often begins with an SBOM. However, just because you can include every possible item does not mean you should. In creating the RBOM®, the first step is analyzing all components within the codebase. Comparing the SBOM to the RBOM® brings clarity to what is actually required versus what merely exists.

Why Dependency Trees Keep Growing

The rise of open-source usage, AI-assisted development, and rapid coding practices has significantly expanded dependency trees. Many projects include just-in-case libraries that are never used at runtime. RBOM® comparison identifies unused components within the overall package, uncovering what might otherwise take engineers hundreds of hours to manually analyze and resolve.

Finding What's Actually Unused

The next RBOM® step highlights unused components for further evaluation and potential removal. These elements are flagged for deeper analysis within the platform. For example, one Python graphics library used by a bank had over 3,200 packages installed, yet only 200 were actually used at runtime. This does not imply that the remaining packages were malicious or without value, only that they were not used in that deployment. Many production environments lack a systematic way to surface these inactive components.

3,200+Packages installed in one bank's Python graphics library

200Packages actually used at runtime

Highlighting which packages are actually used can significantly reduce security vulnerabilities. In this case, eliminating unused packages reduced Common Vulnerabilities and Exposures (CVEs) associated with dormant code while shrinking the overall attack surface. Beyond lowering security risk, this reduction also improved build times and increased efficiency within production pipelines.

Aligning the RBOM® with the Final SBOM

RBOM® supports a specific approach for eliminating excess SBOM components. This approach removes unused code (such as the 3,000 dormant Python packages) to streamline the artifact down to essential runtime components. Ultimately, the RBOM® should closely align with the final SBOM. This means no explaining discrepancies to auditors, no securing unused code, and no engineering time wasted on non-essential elimination efforts.

Is It Time to Deploy an RBOM®?

Overall, RBOM® is an efficient tool for evaluating the SBOM at runtime, ensuring that everything listed in the inventory is actually being used. If your platform or product uses 80% of its footprint for unused components, and 95% of your vulnerabilities reside there, it may be time to deploy an RBOM®.

80%Of platform footprint made up of unused components

95%Of vulnerabilities residing in that unused footprint

1

Break down large codebases

2

Identify unused components

3

Isolate essential runtime elements

4

Eliminate unnecessary vulnerabilities

If you want to dramatically reduce CVEs and strengthen your compliance posture, RapidFort does this.

Key Takeaways

• RBOM® captures only the components actually executed or loaded into memory at runtime, unlike an SBOM, which records all software artifacts associated with a build.
• RBOM® establishes a runtime baseline, evaluating which libraries, binaries, and dependencies are actually executed.
• FedRAMP CM-8 requires a complete, up-to-date inventory of system components, and comparing the SBOM to the RBOM® clarifies what is actually required versus what merely exists.
• In one example, a bank's Python graphics library had over 3,200 packages installed, yet only 200 were actually used at runtime.
• Eliminating unused packages reduced CVEs associated with dormant code, shrank the attack surface, and improved build times.
• Ultimately, the RBOM® should closely align with the final SBOM, removing the need to explain discrepancies to auditors or secure unused code.

‍

RapidFort Recognized as a CRN ® 2026 Stellar Startup for Delivery of Software

Supply Chain Security to the Channel

RapidFort Recognized as Channel’s Most Comprehensive End-to-End Software Supply Chain Security

Solution from Intake to Runtime

Sunnyvale, Calif. — Nov. 9, 2026 — RapidFort, the leader in Software Supply Chain Security (SSCS) with
the largest distribution of curated truly open-source software, today announced that CRN ® , a brand of
The Channel Company, has named RapidFort as a 2026 Stellar Startup for its leading SSCS solution. This
prestigious list highlights fast-rising technology vendors that are driving innovation and fostering growth
in the IT channel with groundbreaking products.
Each technology vendor featured on the CRN 2026 Stellar Startups list is distinguished by its
commitment to innovation and to delivering cutting-edge offerings that help solution providers stand
out in today’s fast-changing IT landscape. This annual list serves as an invaluable resource for solution
providers making business-critical strategic decisions and exploring new technologies and services to
add to their portfolios to give them a competitive advantage and drive success.
“We’re proud to recognize the innovative companies featured on this year’s Stellar Startups list,” said
Jennifer Follett, Vice President, U.S. Content, Executive Editor at CRN, The Channel Company. “These
organizations are redefining what’s possible in the IT channel by bringing fresh ideas, transformative
technologies and a strong commitment to partner success. We look forward to seeing the impact they
continue to make across the industry.”
RapidFort has a growing presence in the channel, due to the solution’s easy installation in end user sites
and revenue opportunities realized by partners. Partnerships have increased 50 percent year-over-year
over the past three years, and RapidFort is becoming an important solution in partners’ suite of security
offerings. Partners are able to add on services such as running RapidFort as a managed service, and offer
leading Software Supply Chain Security functionality in their portfolios.
“RapidFort is deeply committed to our channel partners,” said Avery Lyford, VP of Commercial
Partnerships at RapidFort. “It’s gratifying to be recognized by CRN for our innovation in delivering a
channel-friendly leading Software Supply Chain Security Solution from intake to runtime. RapidFort

works closely with our partners to develop easily deployed solutions that provide customer value and
channel opportunities.”
RapidFort is a comprehensive, end-to-end platform that secures the entire software lifecycle from
intake to runtime. It delivers near-zero CVE images, malware scanning, and production runtime
protection, enabling organizations to eliminate up to 99.9% of security vulnerabilities. RapidFort
empowers development teams to innovate quickly with industry-standard open-source and AI
technologies while abiding by organizations’ security requirements, providing continuous security and
compliance without vendor lock-in or operational bottlenecks.
Coverage of the 2026 CRN Stellar Startups can be found at crn.com/StellarStartups.
About The Channel Company
The Channel Company (TCC) is the global leader in channel growth for the world’s top technology
brands. We accelerate success across strategic channels for tech vendors, solution providers and end
users with premier media brands, integrated marketing and event services, strategic consulting, and
exclusive market and audience insights. TCC is a portfolio company of investment funds managed by
EagleTree Capital, a New York City-based private equity firm. For more information,
visit thechannelco.com. Follow The Channel Company at LinkedIn and X.
About RapidFort
RapidFort leads the Software Supply Chain Security market with the largest distribution of curated,
genuinely open-source software. Its platform enables organizations to eliminate risk at scale through
hardened near-zero CVE container images, runtime profiling, attack surface management, and the
industry’s first independently malware-scanned open-source images – cutting CVE exposure by up to
99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner®
Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as
a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint
Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

‍

RapidFort to Deliver Hardened Container Images for GitLab Regulated Self-Managed Deployments

SUNNYVALE, Calif. — Nov. 3, 2026 — RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced a new strategic partnership with GitLab to deliver hardened container images for GitLab regulated Self-Managed Deployments. The offering enables development and security teams to identify and eliminate vulnerabilities within the GitLab workflows they already use, without requiring changes to application code or migration to a proprietary operating system. 

The partnership combines GitLab’s DevSecOps platform with RapidFort’s industry-first combination of minimal and near-zero CVE container images, attack surface management, and continuous runtime monitoring. The images retain GitLab’s existing functionality and version tags, so teams can adopt them without changing how they build and ship software. 

“Regulated organizations need confidence in what they deploy and flexibility to meet their security requirements,” said Omer Azaria, VP of Product Management, GitLab. “Through our strategic partnership with RapidFort, regulated and air-gapped customers have a new way to get hardened, continuously patched GitLab images, along with audit-ready evidence, without slowing development.” 

“This partnership is designed to let joint customers establish a golden image pipeline for GitLab – a single, centrally governed, hardened source of GitLab images that flows through the customer's build, security scanning, and deployment stages,” said George Manuelian, Chief Strategy Officer at RapidFort. “It moves the industry from detecting vulnerabilities to eliminating them at the source, making secure-by-default software achievable at scale inside the platform where code is built. 

“For self-managed customers, security doesn’t stop at the application layer. As AI accelerates vulnerability discovery, customers need to apply the same security scrutiny to the container images they use to deploy GitLab. This partnership gives customers a traceable path to hardened images and supporting security evidence,” said Martin Brümmer, Senior Product Manager, GitLab.

Today’s announcement builds on RapidFort existing public-sector work; it already publishes an optimized, hardened image for GitLab Runner Iron Bank, and compiles security benchmarks into audit-ready evidence for FedRAMP, Authorization to Operate (ATO), Cybersecurity Maturity Model Certification (CMMC), the EU’s Digital Operational Resilience Act (DORA), and the Cyber Resilience Act (CRA), while still moving at commercial development speed.

Under the partnership, GitLab’s on-premises images are now available through the RapidFort Curated Catalog, a library of more than 48,000 base and third-party container images spanning every major Linux distribution. Curated GitLab images will retain GitLab’s existing functionality, version tags, and configuration surface. Key characteristics of curated GitLab images from this partnership include:

●      Near-zero CVE posture, updated daily. Images are continuously patched as upstream fixes land, with published SLAs of seven calendar days for Critical/High severity CVEs, 21 days for Medium severity CVEs, and 28 days for Low severity CVEs, once an upstream patch is available.

●      FIPS 140-2/140-3 alignment. FIPS-validated OpenSSL providers (covering downstream consumers such as cURL) are built into applicable images, with images tested against a FIPS-enabled kernel helping customers meet a prerequisite for federal and defense deployments.

●      Security Technical Implementation Guide (STIG)-hardened configurations. These reduce the manual effort security teams spend remediating baseline findings before GitLab can be authorized for use in regulated environments.

●      Minimal attack surface. Hardened/community image variants strip out unused packages, shells, and debug utilities, reducing image size and CVE count well beyond the base curated image.

●      Audit-ready compliance evidence. RapidFort’s Compliance and Remediation Tool (CART) component continuously validates images against security baselines and generates compliance reports usable in support of FedRAMP, CMMC, CRA, SOC 2, and CIS Benchmark assessments – reducing the manual evidence-gathering burden during ATO and audit cycles.

Availability
Multiple GitLab images are available immediately in the RapidFort Curated Images catalog, giving joint customers a ready-to-use starting point for hardened, on-prem GitLab deployments. To buy or for more information, visit https://www.rapidfort.com/schedule-a-call.

About RapidFort
RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

‍

RapidFort Selected to Present on Software Supply Chain Security and Exhibiting During Important Events Next Quarter

Share

Company Participating in SF Tech Week, OWASP Global AppSec USA, KubeCon+CloudNativeCon N.A., and FutureCon

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced that it will present on Software Supply Chain Security and exhibit during a number of important industry events next quarter.

RapidFort participating in SF Tech Week, OWASP Global AppSec USA, KubeCon+CloudNativeCon N.A., and FutureCon in Q4.

Share

RapidFort will participate in the following important upcoming industry events in Q4:

• SF Tech Week, San Francisco. RapidFort is hosting an evening event for defense technologists during Tech Week, including a speaker panel titled Bridging Innovation and Defense announcing the SpaceWERX Transition Program on Oct. 6 from 6 pm – 8 pm PDT.
• OWASP Global AppSec USA, San Francisco. RapidFort is a Silver sponsor of the leading event for application security professionals, and will exhibit in Booth S21 during the event from Nov. 5 – 6.
• KubeCon+CloudNativeCon N.A., Salt Lake City. RapidFort is a Silver sponsor of this flagship Linux Foundation event, and will exhibit in Booth 310 during the event from Nov. 9 – 12.
• FutureCon, Boston, Mass. RapidFort is a Silver sponsor of this cybersecurity industry event and will exhibit during the Nov. 19 event.

RapidFort is a comprehensive, end-to-end platform that secures the entire software lifecycle from intake to runtime. RapidFort integrates smart profiling, near-zero CVE images, code reduction, malware scanning, and production runtime protection, enabling organizations to eliminate up to 99.9% of security vulnerabilities. RapidFort empowers development teams to innovate quickly with industry-standard open-source and AI technologies while abiding by organizations’ security requirements, providing continuous security and compliance without vendor lock-in or operational bottlenecks.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry’s first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort Wins Top InfoSec Innovator Award for 2026 as Market Leader in

Software Supply Chain Security

RapidFort Recognized for Delivering Industry’s Most Comprehensive End-to-End Software Supply Chain

Security Solution from Intake to Runtime

Sunnyvale, Calif. — Oct. 20, 2026 — RapidFort, the leader in Software Supply Chain Security (SSCS) with
the largest distribution of curated truly open-source software, today announced it has been named the
Market Leader in Software Supply Chain Security and winner of the Top InfoSec Innovator Award for
2026 by Cyber Defense Magazine (CDM), the industry’s leading electronic information security
magazine.
“We scoured the globe looking for cybersecurity innovators that could make a huge difference and
potentially help turn the tide against the exponential growth in cyber-crime,” said Yan Ross, Editor of
Cyber Defense Magazine. “RapidFort is worthy of being named a winner of these coveted awards and
consideration for deployment in organizations’ environments.”
This is CDM’s 14th year of honoring cybersecurity innovators. Judges for these prestigious awards
include cybersecurity industry veterans, trailblazers and market makers Ron Gula of Gula Tech
Adventures, Gary Miliefsky of CDMG, Dr. Lindsey Polley de Lopez of VentureScope, Katie Gray of In-Q-
Tel, Robert R. Ackerman Jr. of DataTribe, Ira Winkler from CruiseCon, Dino Boukouris of AltitudeCyber;
and with much appreciation to emeritus judges Robert Herjavec of Cyderes, Dr. Peter Stephenson of
CDMG, and David DeWalt of NightDragon. The full list of the Top InfoSec Innovators for 2026 is found
here: https://cyberdefenseawards.com/top-infosec-innovators-for-2026/ .
“It’s rewarding to be validated as the market leader in Software Supply Chain Security in one of the
world’s most prestigious cybersecurity awards programs from Cyber Defense Magazine,” said Michael
Wood, RapidFort CMO. “This award stands out in the industry because winners are determined by a
judging panel of leading experts, not vendor content submissions. 2026 has been a record-setting year
for RapidFort as organizations across the globe turn to us to best protect themselves from SSCS threats
and secure their development operations.”

RapidFort is a comprehensive, end-to-end platform that secures the entire software lifecycle from
intake to runtime. RapidFort integrates smart profiling, near-zero CVE images, code reduction, malware
scanning, and production runtime protection, enabling organizations to eliminate up to 99.9% of
security vulnerabilities. RapidFort empowers development teams to innovate quickly with industry-
standard open-source and AI technologies while abiding by organizations’ security requirements,
providing continuous security and compliance without vendor lock-in or operational bottlenecks.
About Cyber Defense Magazine
Cyber Defense Magazine was founded in 2012 by Gary S. Miliefsky, globally recognized cyber security
thought leader, inventor and entrepreneur, and continues to be the premier source of IT Security
information. It is managed and published by and for ethical, honest, passionate information security
professionals. Its mission is to share cutting-edge knowledge, real-world stories and awards on the best
ideas, products and services in the information technology industry. It delivers electronic magazines
every month online for free, and limited special editions exclusively for the RSAC, Black Hat and Cyber
Defense Conferences. Learn more at http://www.cyberdefensemagazine.com. Cyber Defense Magazine
is a proud member of the Cyber Defense Media Group.
About RapidFort
RapidFort leads the Software Supply Chain Security market with the largest distribution of curated,
genuinely open-source software. Its platform enables organizations to eliminate risk at scale through
hardened near-zero CVE container images, runtime profiling, attack surface management, and the
industry’s first independently malware-scanned open-source images – cutting CVE exposure by up to
99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner®
Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as
a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint
Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

‍

RapidFort and SpaceWERX Convene Industry Leaders in San Antonio to Secure America’s AI Software Supply Chain

Event Brings Together Government and Industry to Address AI Software Exploitation, Accelerated Mission Software Delivery, and Emerging Quantum Threats

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, and SpaceWERX, the innovation arm of the United States Space Force, today announced a conference focused on securing America’s AI software supply chain and strengthening national security mission assurance. The conference is being held Thursday, Oct. 8, at the University of Texas at San Antonio’s San Pedro 1 Building, in partnership with the university and its National Security Collaboration Center.

The event convenes industry innovators and national security practitioners to examine how to eliminate software attack vectors at the source, accelerate secure mission software delivery, and prepare critical infrastructure for emerging AI and quantum threats.

RapidFort and SpaceWERX event brings together government and industry to address AI software exploitation, accelerated mission software delivery, and emerging quantum threats.

Building on the Cooperative Research and Development Agreement (CRADA) between RapidFort and SpaceWERX, the conference will provide a forum for connecting commercial expertise with operational requirements. Participants will share technical perspectives and implementation practices to address software security challenges across the national security ecosystem.

Discussions will examine how national security organizations can advance the objectives of DoW Instruction 8430.01, “Accelerated Mission Software,” while maintaining software supply chain security and mission assurance. Participants will explore how commercial capabilities can support faster software delivery, reduce vulnerability exposure, and provide verifiable security evidence to inform mission decisions.

The conference focuses on five areas related to emerging threats and opportunities:

1. Defensive AI: Outpacing the AI Exploit Window
2. How The AI Supply Chain Is the New National Security Perimeter
3. From SBOM to Mission Assurance: Evidence That Actually Changes Risk
4. Securing the Agentic Enterprise: Identity, Authority, and Blast Radius Best Practices
5. The 2030 Problem Arrives Early: AI, Quantum, and Critical Infrastructure Best Practices

Across these panels, participants will examine how software transparency and operational evidence can support risk reduction, how identity and authority controls can limit the impact of compromised agentic systems, and how critical infrastructure organizations can prepare for migration to post-quantum cryptography.

“America’s ability to field AI capabilities depends on trust in the software that powers them,” said Austin Sedaghatpour, National Security Lead at RapidFort. “Speed and security must advance together. Our goal is to move beyond discussing risk and focus on practical ways to eliminate software attack vectors at the source. Building on our CRADA with SpaceWERX, this conference connects commercial expertise with operational priorities so warfighters and Guardians can benefit from American innovation without inheriting avoidable software risk.”

RapidFort has a proven commitment to open source and community collaboration, including participation in the Silicon Valley AI and cybersecurity communities and service on the governing board of the Akrites Project. The conference extends this commitment by bringing government and industry practitioners together around shared security priorities.

The conference helps participants identify shared security challenges and opportunities for continued technical collaboration, with a practical focus on reducing software exploitation risk and accelerating secure mission delivery.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images - cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

About SpaceWERX

As the innovation arm of the United States Space Force and a unique division within AFWERX, SpaceWERX inspires and empowers collaboration with innovators to accelerate capabilities and shape the future in space. SpaceWERX identifies, validates, and transitions dual use technologies from across the commercial space ecosystem to deliver capabilities at speed and scale in a contested domain. In partnership with Space Systems Command’s Commercial Space Office, SpaceWERX connects innovative technology developers with operational experts, acquisition professionals, and Guardian talent to bridge innovation and acquisition.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort and SpaceWERX Enter Cooperative Research and Development Agreement to Improve Cyber Readiness and Reduce ATO Timescales for U.S. Space Force

Relationship Addresses Improvement of USSF Cyber Readiness, Reduction of AI Software Exploitation Risk, Rapid Acceleration of ATOs, Fast-Tracking of Security Clearances, and Cybersecurity Protection of Space Systems from Post-Quantum Encryption Risk

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced it has signed a Cooperative Research and Development Agreement (CRADA) with SpaceWERX, the innovation arm of the United States Space Force (USSF) and a division of the Air Force Research Laboratory (AFRL).

This strategic partnership establishes a collaborative framework to build a larger industry consortium to enable SpaceWERX to co-develop, test, and evaluate next-generation capabilities that reduce AI software vulnerability exploitation risk, improve cyber readiness, accelerate ATOs, and reduce post-quantum encryption risk across critical space systems. For the USSF, the CRADA is designed to improve cyber readiness, allowing USSF Guardian personnel to field new software capabilities securely, while having them approved and deployed at operational speed. Under the terms of the CRADA, industry organizations will share technical expertise, infrastructure, and operational insights to accelerate commercialization and cybersecurity mission readiness for space systems.

New RapidFort and SpaceWERX relationship addresses improvement of US Space Force cyber readiness, reduction of AI software exploitation risk, rapid acceleration of ATOs, and cybersecurity protection of space systems from post-quantum encryption risk.

As a CRADA partner, RapidFort now has access to SpaceWERX’s network of operational experts, acquisition professionals, and Guardian talent. Likewise, SpaceWERX has access to RapidFort’s ecosystem of software industry and open-source partners. This collaborative feedback loop will enable the Space Force to validate and refine its capabilities in near real time, ensuring commercial solutions map directly to the dynamic requirements of the contested space domain.

“Partnering with SpaceWERX through this CRADA represents a major milestone in our mission to bridge commercial breakthroughs with national security priorities,” said Mehran Farimani, CEO of RapidFort. “Our focus is clear: Empower the guardians to eliminate AI-driven software attack vectors at the source, accelerate ATOs so Guardians can field next-generation software without trading speed for security, and prepare space systems for emerging post-quantum threats. Through this CRADA we can bring best of industry software into the heart of USSF operations, leveraging the benefits of AI while reducing the security risks of AI.”

RapidFort has been a key member of the Silicon Valley AI and cybersecurity communities and serves on the governing board of the Akrites Project, among other community-based software initiatives.

The joint research under this CRADA will focus primarily on:

• Efforts to continuously reduce AI software vulnerability exploitation risk for the Department of War, aligned with the recent presidential executive order on Promoting Advanced Artificial Intelligence Innovation and Security.
• Development and evaluation of capabilities to reduce post-quantum encryption risk, aligned with the presidential order on Securing the Nation Against Advanced Cryptographic Attacks.
• Expansion of RapidFort complimentary Rapid ATO education and “Ask an Approving Officer Program,” providing industry and Guardians a repeatable pattern to deliver reduced ATO timescales. This is especially important for AI software, which is now a national Department of War priority.
• RapidFort publishes a patch-time SLA once an upstream fix exists: Seven calendar days for Critical/High, 21 for Medium, 28 for Low.
• Expansion of the complimentary “Ask a Facilities Security Officer (FSO)” education program to help accelerate clearances for key projects within the SpaceWERX ecosystem.

This CRADA underscores SpaceWERX’s ongoing commitment to cultivating partnerships with the community of leading software, AI, cybersecurity, and defense startups, thus leveraging commercial agility to rebuild the nation’s technological arsenal for the modern era.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images - cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

About SpaceWERX

As the innovation arm of the United States Space Force and a unique division within AFWERX, SpaceWERX inspires and empowers collaboration with innovators to accelerate capabilities and shape the future in space. SpaceWERX identifies, validates, and transitions dual use technologies from across the commercial space ecosystem to deliver capabilities at speed and scale in a contested domain. In partnership with Space Systems Command’s Commercial Space Office, SpaceWERX connects innovative technology developers with operational experts, acquisition professionals, and Guardian talent to bridge innovation and acquisition.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort Integrates with Wiz, Closing the Loop Between Cloud Vulnerability Detection and Near-Zero CVE Remediation

Joint Customers Can Now Utilize RapidFort Leading Set of Curated Hardened Container Images, Enriching CVE Findings from Wiz with RapidFort Evidence-Backed Advisories and Direct Path to Near-Zero CVE Remediation

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced interoperability with Wiz, a leading cloud and AI security platform that’s now part of Google Cloud. With this integration, joint customers can now scan and identify RapidFort industry-largest set of curated and hardened images for the presence of CVEs, and leverage RapidFort advisory-backed remediation status alongside those findings – without leaving the Wiz platform or changing how they scan today.

“We’re happy to welcome RapidFort to the Wiz Integration Network,” said Oron Noah, VP of Product, Extensibility and Partnerships at Wiz. “Managing cloud vulnerabilities isn’t just about identifying risk, it’s about making remediation as seamless as possible. By surfacing RapidFort advisory feed directly within the Wiz platform, we’re helping joint customers clear out false positives and fix CVEs quickly.”

Joint RapidFort and Wiz customers can now utilize RapidFort leading set of curated hardened container images, enriching CVE findings from Wiz with RapidFort evidence-backed advisories and direct path to near-zero CVE remediation.

While Wiz identifies CVEs across cloud and container estates, this integration provides joint customers with a streamlined remediation path. When a CVE finding touches a RapidFort-curated or -hardened image, Wiz surfaces RapidFort advisory context, and the near-zero CVE curated equivalent is available as a direct, typically one-line, remediation. RapidFort curated images retain the same OS, language stack, size, and version tags Wiz customers already use. Its advisory determinations are backed by primary sources and applied consistently across scanners, which gives Wiz customers a documented reason for each false-positive determination rather than a black-box suppression.

“This important integration extends the stated scanner-agnostic strategy of RapidFort into a named, directory-listed partnership with one of the most prominent players in the category,” said George Manuelian, Chief Strategy Officer at RapidFort. “Joint Wiz customers can now spend fewer hours triaging CVEs that were never exploitable in the first place, and have a documented remediation path the moment a real CVE is found, all inside the scanning tool they already run. Now they do not have to choose between their existing scanner investment and adopting a near-zero CVE image supply chain – these two solutions now work together natively.”

Joint customers can now leverage RapidFort industry-leading vulnerability remediation.

• RapidFort is the only curated-image distributor that supports all major LTS OS releases in one catalog (Ubuntu, Debian, Red Hat/UBI, and Alpine) rather than standardizing customers onto a single distribution.
• RapidFort Curated Images retain the joint customer existing OS, size, and version tags, as a drop-in replacement for CVE remediation not a migration; customers change a FROM line rather than re-platforming. This lowers total cost of ownership and removes the main adoption barrier for both developers (no re-testing a new base) and security teams (no new tooling to learn).
• RapidFort Advisory determinations are evidence-backed (NVD, distro trackers, upstream commits) and apply consistently regardless of which scanner reported the finding.
• RapidFort publishes a patch-time SLA once an upstream fix exists: Seven calendar days for Critical/High, 21 for Medium, 28 for Low.
• RapidFort images are DISA STIG-verified and support full FIPS 140-3 requirements.

For partners building on or alongside RapidFort, this latest integration is a proof point that RapidFort advisory feeds and RapidFort curated catalogs are designed to plug into the tools partners already provide, rather than requiring a closed, single-vendor stack.

Availability

The RapidFort and Wiz integration is currently available and listed live today in the Wiz Integrations directory. For more information visit https://www.wiz.io/integrations?q=rapidfort.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

RapidFort and Aqua Security Partner to Enhance Aqua Trivy Scanner with RapidFort Curated Images, Advisories and Remediation Data

Trivy Connect Partnership Enables Development and Security Teams to Start with Near-zero CVE Images, Reduce Operational Burden of Vulnerability Management, and Spend Less Time Sorting Through Scanner Noise

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced its new partnership with Aqua Security, the company delivering Aqua Trivy, a comprehensive, open-source cloud native security scanner that unifies vulnerability detection, misconfiguration scanning, and secret identification across the entire software development lifecycle.

Under Trivy Partner Connect, Trivy integrates RapidFort security advisories, enabling it to accurately report the status of packages in RapidFort Curated Images. This includes access to enhanced information including when RapidFort uses fixes extracted from other distributions or adapted from otherwise incompatible versions to patch affected packages. This new integration ensures Trivy recognizes each fix and is able to accurately report the near-zero CVE status of RapidFort Curated Images.

RapidFort's new Trivy Connect partnership enables development and security teams to start with near-zero CVE images, reduce operational burden of vulnerability management, and spend less time sorting through scanner noise.

As a result, development and security teams can start with near-zero CVE images, reduce the operational burden of vulnerability management, and spend less time sorting through scanner noise. Instead of managing false positives, developers can focus on building and releasing their products with greater confidence.

“Joint customers benefit from more accurate vulnerability results, less noise, and greater confidence in the security of the images they deploy,” said Matt Richards, Chief Operating Officer at Aqua Security. “RapidFort brings differentiated remediation capabilities and a level of advisory detail that enables Trivy to recognize packages RapidFort has already patched even when those fixes are sourced from other distributions or adapted from versions that would otherwise be incompatible. By combining Trivy’s trusted open-source scanning with RapidFort near-zero CVE images and transparent remediation data, we are helping development and security teams spend less time investigating false positives and more time delivering secure software.”

Even when an application is well-built, teams can spend countless hours chasing vulnerabilities in base images, dependencies, libraries, and operating system packages, many of which turn out to be false positives or already mitigated in ways traditional scanners do not understand. RapidFort Curated Images shift vulnerability elimination left without shifting more work onto developers. Combined with Trivy’s support for RapidFort advisories, teams get cleaner third-party scan results, more accurate security posture, and a faster path from development to production.

“Trivy is one of the most downloaded open-source security scanners, and we are pleased to partner with Aqua Security to enhance the productivity of developers, who get a true assessment of security risks and can now focus on development without worrying about fixing CVEs,” said George Manuelian, Chief Strategy Officer at RapidFort. “RapidFort is truly transparent about its curated images and enables partners to accurately assess images for any CVE risks. Partnering with companies like Aqua Security gives developers confidence that they are working with up to 99.9 percent CVE-free code before applications are ever deployed into production.”

This new integration is generally available immediately. Schedule a demo here https://www.rapidfort.com/schedule-a-call.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort integration with CrowdStrike Falcon Cloud Security accelerates container vulnerability remediation.

RapidFort Announces Integration with CrowdStrike Falcon Cloud Security to Accelerate Container Vulnerability Remediation

Integration Helps Joint Customers Identify, Prioritize, and Remediate Container Vulnerabilities across Kubernetes Environments

LAS VEGAS--(BUSINESS WIRE)--Fal.Con 2026 – RapidFort today at Fal.Con 2026 announced a new integration with CrowdStrike Falcon® Cloud Security. The integration helps joint customers accelerate container vulnerability remediation across Kubernetes environments by combining the comprehensive cloud security capabilities of Falcon Cloud Security with RapidFort automated container image hardening.

As AI accelerates vulnerability discovery and shortens the window between CVE disclosure and potential exploitation, organizations running Kubernetes at scale face increasing pressure to address vulnerabilities faster. Containerized workloads can inherit vulnerabilities from open-source base images and packages, creating significant remediation demands across large environments.

New integration helps joint customers accelerate container vulnerability remediation across Kubernetes environments by combining the comprehensive cloud security capabilities of Falcon Cloud Security with RapidFort automated container image hardening.

The integration enables RapidFort to ingest vulnerability and software bill of materials (SBOM) data from Falcon Cloud Security and use it to automate container image hardening. RapidFort curated image library and runtime profiling capabilities help eliminate identified vulnerabilities and remove unnecessary components without requiring changes to application code. Together, CrowdStrike and RapidFort help joint customers streamline vulnerability management and accelerate risk reduction across Kubernetes environments.

“AI-accelerated vulnerability discovery has made speed increasingly critical for organizations running Kubernetes at scale,” said George Manuelian, CSO, RapidFort. “Our integration with CrowdStrike brings RapidFort automated image hardening into the vulnerability management workflow, helping joint customers move faster from identifying risk to reducing it. RapidFort customers have reduced CVEs by up to 99.9% with our hardening technology, without requiring changes to application code.”

For organizations with stringent security and compliance requirements, including Department of Defense environments, RapidFort supports hardened container images, compliance reporting, and deployment across restricted and air-gapped environments.

To learn more about the integration, visit the CrowdStrike Marketplace listing or visit RapidFort at ReversingLabs Booth #2113 during Fal.Con 2026 in Las Vegas this week.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry’s first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. CrowdStrike and Falcon are registered trademarks of CrowdStrike, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort selected to present on Software Supply Chain Security and is exhibiting during important industry events this quarter.

RapidFort Selected to Present on Software Supply Chain Security and Exhibiting During Important Events This Quarter

Company Participating in AFCEA TechNet Augusta, CrowdStrike fal.con, Billington CyberSecurity Summit 2026, and DevOpsDays Dallas

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced that it will present on Software Supply Chain Security and exhibit during a number of important industry events this quarter.

RapidFort will participate in the following important upcoming industry events:

• AFCEA TechNet Augusta, Augusta, Ga. RapidFort is exhibiting in booth No. K14 at this event for military and private sector partnerships to accelerate the delivery of innovative and interoperable systems from Aug. 17 – 20.

RapidFort is participating in AFCEA TechNet Augusta, CrowdStrike fal.con, Billington CyberSecurity Summit 2026, and DevOpsDays Dallas later this quarter.

• fal.con, Las Vegas. Meet RapidFort at this CrowdStrike high-octane experience for security teams from Aug. 31 – Sept. 3. To book a meeting at the event with RapidFort, please see https://www.rapidfort.com/events/rapidfort-at-fal-con-2026.
• Billington CyberSecurity Summit 2026, Washington, D.C. RapidFort is a Gold Sponsor and will be exhibiting at the event in booth No. 215 from Sept. 8 – 10. Russ Andersson, COO and Co-founder of RapidFort, will participate in the breakout session panel titled “Trust but Verify: Assuring Integrity Across Foreign and High-Risk Vendors” on Sept. 9 from 11:40 am – 12:25 pm EDT.
• DevOpsDays Dallas, Dallas. RapidFort is a Gold Sponsor of this regional conference for DevOps practitioners and will be exhibiting and speaking at the event from Sept. 28 – 29.

RapidFort is a comprehensive, end-to-end platform that secures the entire software lifecycle from intake to runtime. RapidFort integrates smart profiling, near-zero CVE images, code reduction, malware scanning, and production runtime protection, enabling organizations to eliminate up to 99.9% of security vulnerabilities. RapidFort empowers development teams to innovate quickly with industry-standard open-source and AI technologies while abiding by organizations’ security requirements, providing continuous security and compliance without vendor lock-in or operational bottlenecks.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry’s first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort launches end-to-end continuous threat elimination by extending leading software supply chain security into live production environments.

RapidFort Launches Industry’s First End-to-End Continuous Threat Elimination by Extending Leading Software Supply Chain Security Into Live Production Environments

Unveiled at Black Hat USA 2026, RapidFort Runtime Uniquely Delivers End-to-End Continuous Monitoring of Live Environments to Detect and Address CVEs Emerging After Software Deployment

LAS VEGAS--(BUSINESS WIRE)--(Black Hat USA 2026 Booth #5704) -- RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today at Black Hat USA 2026 launched RapidFort Runtime, a real-time-based security solution that extends RapidFort’s leading SSCS functionalities into live production environments, creating the industry’s first genuinely end-to-end continuous threat elimination solution – from curated, independently malware-scanned open-source software before deployment to continuous CVE monitoring and tamper detection in live production environments.

Unveiled in Black Hat booth No. 5704 and demonstrated publicly for the first time, RapidFort Runtime operates inside an organization’s production environment continuously monitoring deployed software, detecting unauthorized or unexpected changes, and proactively tracking newly discovered CVEs. It notifies administrators and developers of relevant security impacts and provides actionable mitigation recommendations. This industry-first capability delivers top-level visibility that distinguishes between first-party and third-party software, generates a precise Runtime Bill of Materials (RBOM®), and provides evidence of the software and processes executing in production. It integrates into existing CI/CD pipelines without requiring code changes, effectively bridging the gap between pre-production security and live runtime protection.

Unveiled in Black Hat booth No. 5704, RapidFort Runtime operates inside an organization’s production environment continuously monitoring deployed software, detecting unauthorized or unexpected changes, and proactively tracking newly discovered CVEs.

Together with RapidFort curated open-source software catalog and hardened images validated through ReversingLabs deep-binary malware analysis, RapidFort Runtime enables organizations to verify both what enters production and whether deployed software remains intact once it is running.

“Maintaining an accurate, real-time inventory of what is actually executing in production has been a consistent audit and compliance hurdle,” said Sangram Dash, CISO and VP of IT, Sisense. “RapidFort Runtime’s ability to generate a precise, dynamic RBOM provides us with undeniable evidence of our software’s state. We can now verify integrity and confirm our compliance in real-time, which is a total game-changer for our security operations.”

RapidFort Runtime differentiating new capabilities include:

• End-to-End Continuous Monitoring: Monitors live production environments to detect and address CVEs that emerge after software deployment, solving the “production obsolescence” problem where software is often “born outdated” and immediately vulnerable when it hits production due to new CVE disclosures.
• Agent-Based Runtime Profiling: Uses BPF/ptrace instrumentation to map system calls, network/memory usage, and process execution, providing cryptographic evidence of what is truly running.
• Proactive Mitigation Recommendations: Beyond just detection, the platform notifies administrators of new relevant security impacts and offers actionable mitigation recommendations to fix them in live environments.
• Automated Runtime Bills of Materials Generation: Continuously produces dynamic RBOMs for audit-ready compliance.
• Curated, Independently Malware-Scanned Software: Integrates with the RapidFort extensive catalog of curated open-source libraries and hardened container images, validated through ReversingLabs deep-binary malware analysis, to reduce the risk of compromised or unverified software reaching production.
• Runtime Tamper Detection and Integrity Monitoring: Establishes a verifiable baseline of approved software and continuously detects changes to packages, binaries, libraries, processes, and runtime behavior, providing evidence of what changed and where the change occurred.

“While most software supply chain security tools stop at build-time or deployment, RapidFort continuously monitors live production environments for newly disclosed CVEs that impact deployed software,” said Rajeev Thakur, CTO of RapidFort. “By automatically correlating new vulnerabilities with running workloads, RapidFort eliminates the manual effort of tracking CVEs and determining real production exposure, enabling organizations to respond faster and with greater confidence.”

RapidFort Runtime leverages lightweight agents that utilize BPF and ptrace technology to continuously monitor the software running in live production environments where threats and anomalies are most critical. Only RapidFort uses BPF/ptrace to deliver true runtime intelligence and actual evidence of execution, which drastically reduces false positives and vulnerability noise over relying solely on static analysis or scanning.

Unlike competitors that force migration to proprietary package managers or “distroless” images, RapidFort provides zero-overhead integration with drop-in replacement that supports standard package managers (pip, npm, apk). It is fully aligned with BSI TR-03183 Part 2, NIS2 (enforcement Dec 2025), and EU Cyber Resilience Act (CRA) requirements; and supports CIS Benchmarks and STIG validation, ensuring suitability for defense and mission-critical cloud-native deployments.

Availability

RapidFort Runtime is currently generally available. For more information visit https://www.rapidfort.com/platform/runtime.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort is recognized as a Top InfoSec Innovator in 2026 for Software Supply Chain Security.

RapidFort Recognized as a 2026 Top InfoSec Innovator for Software Supply Chain Security

RapidFort Unveiling Industry-First Software Supply Chain Security Advancements in its Award-Winning Solution at Black Hat USA Booth 5704

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced it has been recognized as a Top InfoSec Innovator for 2026, and a finalist in the Software Supply Chain Security category by Cyber Defense Magazine (CDM), the industry’s leading electronic information security magazine.

“RapidFort embodies three major features we judges look for with the potential to become winners: Understanding tomorrow’s threats, today; providing a cost-effective solution; and innovating in unexpected ways that can help mitigate cyber risk and get one step ahead of the next breach,” said Gary S. Miliefsky, Publisher of Cyber Defense Magazine.

RapidFort will unveil industry-first Software Supply Chain Security advancements in its award-winning solution at Black Hat USA in its Booth 5704.

RapidFort will showcase its award-winning solution at Black Hat USA 2026 in its Booth #5704, as well as launch industry-first advancements to help protect organizations through the entire SSCS lifecycle. Visitors will see the demo of the RapidFort continuous threat elimination model which spans intake to build to runtime and includes integrated malware-scanning and tamper-scanning for images and libraries.

“It’s validating to be recognized leading up to Black Hat in one of the most prestigious cybersecurity awards programs in the world from Cyber Defense Magazine, during their 14th anniversary as an independent cybersecurity news and information provider,” said Michael Wood, RapidFort CMO. “Black Hat is the perfect venue to make our significant announcement in the cybersecurity industry, including advancements no one has ever seen before that will best protect organizations from SSCS threats and extend RapidFort leadership ahead of the competition.”

Judging of the award finalists continues through October, when winners will be announced online, in print and during CyberDefenseCon 2026, taking place October 20-21 at The Ritz-Carlton in Orlando. There a select group of winners will showcase their innovative solutions to the Top Global CISOs during the invitation-only conference at https://www.cisoconference.com.

About Cyber Defense Awards

This is Cyber Defense Magazine’s thirteenth year of honoring InfoSec innovators from around the globe. Submission requirements are for any startup, early stage, later stage, or public companies in the information security space who believe they have a unique and compelling value proposition for their product or service. Learn more at www.cyberdefenseawards.com.

About Cyber Defense Magazine

Cyber Defense Magazine is the premier source of cyber security news and information for InfoSec professions in business and government. We are managed and published by and for ethical, honest, passionate information security professionals. Our mission is to share cutting-edge knowledge, real-world stories and awards on the best ideas, products, and services in the information technology industry. We deliver electronic magazines every month online for free, and special editions exclusively for the RSAC Conferences, Black Hat Conferences and Cyber Defense Conferences. CDM is a proud member of the Cyber Defense Media Group. Learn more at https://www.cyberdefensemagazine.com and visit https://www.cyberdefensetv.com and https://www.cyberdefenseradio.com to see and hear some of the most informative interviews of many of these award-winning company executives.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

RapidFort and ReversingLabs launch industry’s first independently validated open-source dependency libraries delivering safe package catalogs.

RapidFort and ReversingLabs Launch Industry’s First Independently Validated Open-Source Dependency Libraries Delivering Safe Package Catalogs

Partnership Verifies Packages are Free of Tampering, Malware and Vulnerabilities Across all Operating Systems, Frameworks and Application Stacks with no Proprietary Package Manager Migration Needed

SAN JOSE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security with the largest distribution of curated truly open-source software, and ReversingLabs (RL), the trusted name in file and software security, today announced a strategic partnership to deliver RapidFort Open-Source Dependency Libraries—the industry’s first and only open-source package catalog to combine RapidFort’s proven curation and hardening process with independent third-party validation powered by ReversingLabs’ Spectra Assure® platform.

RapidFort is the only vendor whose open-source library catalog is independently validated by a separate, named third-party security company—ReversingLabs—using enterprise-grade deep-binary malware detection. As a result of this partnership, every package in the catalog passes through RapidFort’s rigorous multi-stage hardening pipeline and is independently assessed by ReversingLabs to be free of tampering, malware, and known vulnerabilities before it reaches developers’ environments.

Strategic partnership creates industry’s first and only open-source package catalog to combine RapidFort’s proven curation and hardening process with independent third-party validation powered by ReversingLabs’ Spectra Assure® platform.

“ReversingLabs was built on the conviction that software security requires deep binary intelligence,” said ReversingLabs Founder and CEO Mario Vuksan. “Malicious actors are increasingly compromising open-source components, embedding threats deep within the layers of container images that traditional tooling cannot reach. By bringing Spectra Assure’s independent malware analysis to every package in the RapidFort library catalog, together we give enterprises access to open-source dependencies that are both rigorously hardened and independently assessed clean before they ever enter a build pipeline.”

Unlike competing approaches that require migration to proprietary package managers, custom operating system distributions, or vendor-specific toolchains, RapidFort Libraries work with any OS, any framework, and any application package manager through standard pip, Maven, npm, and OS package interfaces teams already use today. For customers, this means reducing time to compliance by three to six months without the migration and lock-in of proprietary package managers, without single-source liability, and without the friction that slows security and development teams down. RapidFort Libraries are a drop-in replacement—no migration, no disruption, no compromise. Existing vendor responses to the open-source supply chain crisis address only parts of this problem, but each imposes new constraints: proprietary OS distributions requiring platform migration, single-ecosystem library coverage, or build-from-source approaches with no independent integrity verification. No vendor prior to today has subjected every library in their catalog to named, independent third-party malware validation.

RapidFort Curation and Hardening Combined with ReversingLabs Validation

The RapidFort–ReversingLabs partnership brings together two complementary capabilities into a single, end-to-end security pipeline. RapidFort contributes its proven attack surface reduction and source-verified hardening process, which has helped enterprise customers eliminate up to 99.9% of CVEs from container images. ReversingLabs adds Spectra Assure, the industry’s leading deep-binary analysis platform for software supply chain security, bringing enterprise-scale malware detection, tampering identification, and independent onboarding governance to every package RapidFort releases.

“ReversingLabs is the gold standard for binary malware analysis,” said Mehran Farimani, CEO with RapidFort. “By embedding Spectra Assure analysis into our library release pipeline as an independent validation gate, we’ve created something the industry has been missing—a library catalog where the security claim is made by a separate company with its own reputation on the line. That’s a fundamentally different level of trust.”

ReversingLabs’ Spectra Assure performs deep binary analysis that goes far beyond signature-based scanning. As a result of this partnership, for public open-source repositories organizations now receive:

• Deep malware detection: Binary-level analysis identifies obfuscated malware, hidden backdoors, and malicious payloads that evade traditional signature-based scanners—including novel threats with no prior CVE assignment.
• Tampering verification: Cryptographic and structural analysis helps identify evidence of unauthorized modification, repackaging, or tampering within delivered software artifacts.
• Threat intelligence correlation: Packages are checked against ReversingLabs’ authoritative Spectra Intelligence dataset covering billions of files and decades of malware research, providing context that no internal scan can replicate.
• Differential version analysis: Spectra Assure compares a new package version against previous versions to identify newly introduced malware, tampering, risky behaviors, and unexpected changes in a new package update.
• Policy-driven release gates: Packages that fail ReversingLabs’ security policies are blocked from the RapidFort catalog until risks are remediated, providing a preventative rather than reactive security control.
• Evidence-backed audit trail: Every package release includes a ReversingLabs-generated security report, giving customers, their auditors, and regulators independently produced documentation of each artifact’s integrity status.

Availability

RapidFort Open-Source Dependency Libraries validated by ReversingLabs Spectra Assure are available today in general availability for Python and Java ecosystems, with JavaScript entering closed beta. OS package coverage for Red Hat, Ubuntu, Debian, and Alpine is available now. Additional language runtimes and application package catalogs are on an accelerated roadmap.

Existing RapidFort customers can enable library coverage immediately through the platform console or by contacting their account team. New customers can learn more and request access at rapidfort.com/libraries. Learn more about ReversingLabs Spectra Assure at https://www.reversinglabs.com/products/spectra-assure.

About ReversingLabs

ReversingLabs is the trusted name in file and software security. We provide the modern cybersecurity platform to verify and deliver safe binaries. Trusted by the Fortune 500 and leading cybersecurity vendors, RL Spectra Core powers the software supply chain and file security insights, tracking over 422 billion searchable files with the ability to deconstruct full software binaries in seconds to minutes. Only ReversingLabs provides that final exam to determine whether a single file or full software binary presents a risk to your organization and your customers. For more information, visit www.reversinglabs.com.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

‍

Linux Foundation and Industry Leaders Launch Akrites to Defend Critical Open Source Software Against AI-Enabled Cyber Threats

Amazon Web Services, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone and Zscaler join coordinated effort to find, fix and responsibly disclose vulnerabilities in open source software the world runs on

The Linux Foundation, joined by leading organizations, today announced Akrites, a coordinated effort to remediate and disclose vulnerabilities in critical open source software.

Akrites establishes a shared Security Incident Response Team (SIRT) and a single, standardized Coordinated Vulnerability Disclosure (CVD) process, built on confidentiality-first principles and industry-standard tooling.

Founding members commit engineering talent, security expertise and funding to harden the shared open source software that banks, hospitals, power grids, telecoms, governments, and AI labs depend on.

Organizations that contribute engineering resources or funding to the security of critical open source are invited to participate and can learn more at https://akrites.org.

SAN FRANCISCO, June 25, 2026 /PRNewswire/ -- The Linux Foundation, the nonprofit organization enabling mass innovation through open source, today announced Akrites, a coordinated industry effort to harden the world's most critical open source software in the era of AI-assisted vulnerability discovery. Backed by founding commitments from Amazon Web Services, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone and Zscaler, the initiative unites major technology companies, AI labs, financial institutions, and security vendors around a shared mission: to coordinate the remediation of vulnerabilities in widely used open source projects with upstream maintainers before those vulnerabilities can be exploited.

Open source software underpins virtually every layer of the modern digital economy, from banking and healthcare to energy, transportation, telecommunication, and government. Akrites enables industry coordination to support and defend critical infrastructure users and consumers of open source. Previously, finding and fixing serious flaws in open source software demanded comparable expertise from attackers and defenders alike. Today, frontier AI models can scan a major open source project and surface vulnerabilities in minutes. Once access to these capabilities is broadly available, bad actors who previously lacked the technical expertise to mount sophisticated attacks will have the tools they need to do so quickly.

To mark the launch, the founding signatories published a joint open letter to the technology industry, "We All Depend on Open Source. We Will Defend It Together." The full letter is available at https://akrites.org/letter/.

In the past, security response involved a patchwork of organizations often working on the same problems independently, sometimes shipping conflicting patches or burying maintainers under duplicate reports. Akrites changes that model. The initiative provides a single, trusted place to coordinate, remediate and disclose, with a shared SIRT serving as a predictable partner for maintainers rather than a flood of uncoordinated reports. Akrites commits to working with critical infrastructure to support patch deployment before vulnerable systems can be targeted.

Confidentiality is central to the effort. Bug fixes flow back into each project's original home, on maintainers' terms. Where a critical package has no active maintainer, Akrites will serve as maintainer of last resort so fixes to the latest version reach everyone in a timely fashion. The initiative will also coordinate with government efforts so public and private defenders move together.

Alpha-Omega, a directed fund of the Linux Foundation, will provide seed funding to support Akrites. Other organizations that contribute engineering resources or funding to the security of critical open source are invited to participate. To learn more or to join, visit https://akrites.org.

Supporting Quotes

"Frontier AI models have given defenders the ability to find and fix vulnerabilities in open source software at a speed and scale that were never possible before. That's an enormous opportunity for defenders, and Akrites ensures we seize it together. Maintainers deserve a coordinated partnership, not a flood of reports. AWS is committed to securing the projects our customers depend on and building this shared infrastructure alongside the community."
– Matt Wilson, Vice President and Distinguished Engineer, Amazon Web Services

"Open source projects collectively underpin much of the internet, and the existing model for coordinated disclosure has been outpaced by how quickly AI can now find vulnerabilities. Getting ahead of that requires the industry to coordinate on findings and get fixes upstream before they're disclosed and exploited. Efforts like Akrites drive this level of coordination at the scale and speed this moment requires."
– Jason Clinton, Deputy Chief Information Security Officer, Anthropic

"The software supply chain is only as strong as the upstream it draws from, and we see how thin that layer really is. As AI finds more vulnerabilities, the industry will rush to patch them. Without coordination, those fixes will fragment across different patches and forks, and maintainers who are already overwhelmed, unreachable, or haven't touched a project in years. Akrites gives the industry one coordinated way to fix vulnerabilities upstream before they're exploited, with maintainers still in control. Now the work is making sure there's always someone on the other end to catch them."
– Dan Lorenc, CEO and Co-founder, Chainguard

"Finding a serious open source vulnerability used to take an expert weeks. It now takes a machine minutes. When maintainers lose that race, so does everyone else. No single company, no single maintainer, and no single government can close that gap alone. That is why Cisco is bringing its networking infrastructure, security expertise, and decades of open source contribution to Akrites - because defenders cannot afford to lose, and maintainers cannot be left to run this alone."
– Vijoy Pandey, SVP and GM, Outshift by Cisco

"Advances in AI models have significantly reduced the effort required to discover and exploit vulnerabilities. In partnership with the Linux Foundation and Project Akrites, Citi is committed to supporting the open-source ecosystem by helping to build a framework that identifies and remediates vulnerabilities and shares proposed patches. Focused on securing critical infrastructure, this initiative is a key part of our efforts to help the industry mitigate emerging threats."
– Al Tarasiuk, Chief Information Security Officer, Citi

"For years we have believed finding vulnerabilities was never the hard part. Fixing them was. AI has made that gap impossible to ignore. Of the thousands of validated open source vulnerabilities surfaced in recent months, fewer than 5% have been patched. Endor Labs is a founding member of Akrites because it is built for the response this moment needs: coordinated remediation upstream, handled confidentially, with maintainers in control, so one trusted fix reaches everyone who depends on the code."
– Varun Badhwar, CEO and Co-Founder, Endor Labs

"Vulnerability discovery is now moving at a speed that overwhelms both the maintainers who sustain open source projects and the users who rely on them. Uncoordinated reporting, patching, and disclosure create friction, putting the entire ecosystem at risk. No single organization can solve this alone. That is why Ericsson is joining Akrites as a Premier member, contributing funding and talent to a shared effort to keep open source software secure and thriving."
– Mikko Karikytö, Chief Product Security Officer, Ericsson

"As AI accelerates both the scale and speed of vulnerability discovery, defending the open source ecosystem requires an equally rapid, coordinated response. By joining Akrites, we are combining Google's long-standing commitment to open source security with industry-wide expertise to ensure that vulnerabilities are found, fixed, and responsibly disclosed before they can be exploited. Safeguarding the software that powers the world's critical infrastructure is essential to maintaining trust in our digital future."
– Heather Adkins, Vice President Security Engineering, Google

"Open source powers the systems we rely on every day—running everything from banks and hospitals to power grids and AI platforms. As frontier AI accelerates vulnerability discovery, the risk has grown too large for any one organization to address alone. That's why an ecosystem approach is critical, bringing the community, technology providers, and enterprises together to ensure vulnerabilities are addressed and at the new speed required today."
– Jamie Thomas, Enterprise Security Executive, IBM

"AI has massively compressed the time between vulnerability discovery and exploitation to near real time, which means we have to compress the time from fix to deployment. That's why we at JPMorganChase are helping to build this effort to measure success in patch deployment, not patch publication. We support a mechanism that enables downstream operators of critical infrastructure so that fixes reach real systems before adversaries can turn disclosures into exploits. And upstream, we owe maintainers a single, reliable signal: confirmed vulnerabilities, well-tested proposed fixes, and a predictable partner they can trust, rather than a flood of duplicative, conflicting reports."
– Pat Opet, Chief Information Security Officer, JPMorganChase

"OpenSSF and Alpha-Omega demonstrated what is possible when industry comes together to strengthen open source security. Building on our experience co-founding these organizations, Akrites was created to address the emerging inflection point of AI-powered vulnerability discovery and defense. As a founding member, Microsoft will contribute expertise, resources, and AI technologies to help responsibly identify and fix vulnerabilities across the open source software ecosystem that customers and organizations depend on."
– Mark Russinovich, Azure Chief Technology Officer, Deputy Chief Information Security Officer and Technical Fellow, Microsoft

"Transparency and open collaboration are how the cybersecurity community has kept infrastructure safe for decades. In the age of AI, these open source foundations have never been more critical. Open source AI is the engine of American innovation — and one of our most powerful tools for deploying AI with the security, trust, and transparency needed to power this industrial revolution."
– David Reber, Chief Security Officer, NVIDIA

"The world runs on open source, and securing it is a long-term commitment for us at OpenAI. Through Patch the Planet, we're putting our models and resources behind expert-led work that helps maintainers validate issues and land fixes, and we're proud to participate in Akrites to strengthen coordination across the industry and help defend the software we all depend on."
– Clint Gibler, Cyber Lead, OpenAI

"Open source only works when we keep the work open, upstream, and available to everyone who depends on it. The answer to the AI-driven vulnerability crisis is not to fragment the ecosystem behind proprietary walls or turn community foundations into closed products. It must be coordinated remediation that preserves the integrity of original software, works with maintainers, and returns fixes to the commons. We are proud to support the Akrites initiative which aligns with our belief of strengthening the open source ecosystem from within, helping organizations reduce risk without unnecessary code changes, and making the software we all share safer for everyone."
– Mehran Farimani, CEO, RapidFort

"Open source is the foundation of modern software innovation. Defending that foundation requires a coordinated, upstream community response capable of meeting threats at scale. Red Hat's participation in Akrites focuses on strengthening this upstream ecosystem. By collaborating openly to identify and patch vulnerabilities at the source, we help build a more resilient software supply chain for the entire industry."
– Chris Wright, Chief Technology Officer and Senior Vice President, Global Engineering, Red Hat

"For too long, the goodwill and sense of responsibility among upstream maintainers has been taken for granted in security response processes. Akrites promises meaningful coordination with upstream maintainers, financial, and full-time support to find, fix and disclose security vulnerabilities responsibly, and a genuine commitment from the most influential companies across tech and finance to solve this problem. The Rust Foundation looks forward to working with Akrites to develop security that is fit for the future."
– Rebecca Rumbul, Executive Director and CEO, Rust Foundation

"Sonatype sees the dependency graph of the modern world every day. A single vulnerable component can sit underneath thousands of organizations, which means one upstream fix can reduce risk across an entire ecosystem. AI may make vulnerability discovery dramatically easier, but it does not make coordinated repair automatic. Akrites is important because it gives the industry a confidential way to do that work together, upstream, before the same flaw becomes thousands of separate incidents."
– Brian Fox, Co-founder and Chief Technology Officer, Sonatype, and Steward of Maven Central

"With the increasing ability of AI to fast-track vulnerability discovery, now is the right time to come together and invest resources to safeguard critical open-source software on which telecommunications and many other industries rely on. As a founding member, Vodafone has committed both expertise and funding to Akrites. This unified initiative will drive a co-ordinated, industry-wide approach to responsibly identify and fix vulnerabilities in the software that runs the systems upon which the world depends."
– Paul Hopkins, Cyber & IT strategy and Architecture Director, Vodafone

"AI has changed the speed of both offense and defense. Vulnerabilities can now be found at machine speed, which means defenders have to move just as fast. Akrites helps turn that speed into an advantage for the open source ecosystem by finding issues earlier, coordinating remediation responsibly, and pushing fixes upstream. Zscaler is proud to be part of it."
– Deepen Desai, Executive Vice President and Chief Security Officer, Zscaler

About Akrites

Akrites is a coordinated confidential effort to remediate and disclose vulnerabilities in the open source software that critical infrastructure depends on. It provides a single, standardized Coordinated Vulnerability Disclosure (CVD) process operated by a shared Security Incident Response Team (SIRT), built on confidentiality-first principles and the industry's established standards and tooling (CVE, TLP, CWE, CVSS, EPSS, SSVC, VEX). To learn more or to join, visit https://akrites.org.

About the Linux Foundation

The Linux Foundation is the world's leading home for collaboration on open source software, hardware, standards, and data. Linux Foundation projects, including Linux, Kubernetes, Model Context Protocol (MCP), OpenChain, OpenSearch, OpenSSF, OpenStack, PyTorch, Ray, RISC-V, SPDX and Zephyr, provide the foundation for global infrastructure. The Linux Foundation is focused on leveraging best practices and addressing the needs of contributors, users, and solution providers to create sustainable models for open collaboration. For more information, please visit us at linuxfoundation.org.

The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of the Linux Foundation, please see its trademark usage page: www.linuxfoundation.org/trademark-usage. Linux is a registered trademark of Linus Torvalds.

‍

RapidFort and Legion Intelligence Unite to Secure AI Workloads for the Warfighter – Delivering Near-Zero CVE, Battle-Ready Artificial Intelligence from the Container Up

RapidFort curated, hardened, near-zero CVE container images are the security backbone of Legion’s battlefield AI platform — ensuring every AI workload deployed to the tactical edge is provably secure, continuously hardened, and mission-ready from the first line of code to the battlefield.

SUNNYVALE, Calif.--(BUSINESS WIRE)--Legion Intelligence, the governed AI platform trusted by U.S. Special Operations Command, the U.S. Department of War, and the U.S. Air Force, today announced a strategic partnership with RapidFort, the leader in software supply chain security for containers. Together, the two companies are redefining what it means to field AI on the battlefield — establishing that every AI workload running in support of the warfighter must be built on a provably secure, near-zero CVE software foundation, from forward-deployed edge systems to air-gapped command posts.

The Problem: AI Workloads Running on Vulnerable Containers Put Warfighters at Risk

Artificial intelligence is now at the center of modern warfighting — driving intelligence synthesis, mission planning, logistics, and real-time decision support. But AI workloads are only as secure as the container infrastructure they run on. Today, most AI systems — including large language models, inference engines, and agent orchestration platforms — are deployed inside containers that inherit thousands of CVEs (Common Vulnerabilities and Exposures) from base images and open-source dependencies.

On a commercial platform, an unpatched container vulnerability is a compliance finding. On the battlefield, it is an attack vector. A single exploitable CVE in an AI workload container can compromise the intelligence feeding a commander’s decision, corrupt a mission plan mid-execution, or hand an adversary a foothold inside the warfighter’s AI decision loop. The DoW cannot afford to field AI that is brilliant but breakable.

The Solution: RapidFort Secures the AI Stack — Legion Executes the Mission

The Legion-RapidFort partnership solves this problem at its root. Rather than patching CVEs after AI workloads are deployed, RapidFort eliminates them before a single AI model, inference container, or agent service ever reaches the battlefield. Legion Intelligence then builds its entire AI platform on this hardened foundation — delivering governed, auditable AI agent orchestration that warfighters can trust with their most sensitive operations.

“The AI workloads we deploy for the warfighter, from intelligence analysis agents to mission planning workflows, need to run inside containers that RapidFort has hardened to near-zero CVEs. That is not a nice-to-have. It is a prerequisite for fielding AI that the U.S. Department of War can trust with sensitive data and high-consequence operations,” said Ben Van Roo, CEO and co-founder, Legion Intelligence. “RapidFort strengthens the security foundation our AI stack is built on, helping Legion deliver governed AI that warfighters can rely on when it matters most.”

How RapidFort Secures Legion’s AI Workloads

• Near-Zero CVE AI Container Images: RapidFort library of 35,000+ curated, production-grade container images serves as the secure base for every Legion AI service, including LLM inference engines, agent orchestration runtimes, and data pipeline containers. Built on trusted LTS Linux distributions — Ubuntu, Red Hat, Debian, and Alpine — these images eliminate up to 99.9% of CVEs before Legion’s AI workloads are deployed.
• Continuous AI Workload Hardening: The RapidFort platform profiles real runtime behavior inside Legion’s AI containers, identifies unused software components, and automatically removes them — shrinking the exploitable attack surface of every AI workload by up to 90% without requiring code changes, OS changes, or pipeline modifications. Hardened images are rebuilt every 24 hours to stay ahead of emerging threats.
• Battlefield-Grade Compliance Automation: RapidFort continuously validates Legion’s AI container stack against STIG, CIS, FedRAMP, and CMMC security benchmarks, generating audit-ready compliance reports that accelerate authorization to operate (ATO) for AI systems in classified and mission-critical environments.
• Legion Intelligence AI Agent Orchestration: Built on RapidFort hardened container foundation, Legion’s FedRAMP High–authorized, IL6-capable platform deploys AI agents that automate current operations, intelligence analysis, mission planning, and secure process automation — with full auditability and human oversight — across on-premises, cloud, and air-gapped tactical edge environments.

The combined result is a fully secured AI stack: from the container image layer through the inference runtime to the governed AI agent — every component hardened, every CVE eliminated, and every AI workload continuously monitored and re-hardened as new threats emerge.

AI Workloads Warfighters Can Trust in the Most Contested Environments

Legion’s AI platform — secured end-to-end by RapidFort — delivers mission-critical AI capabilities across the full spectrum of battlefield operations:

• AI-Powered Current Operations — real-time intelligence synthesis across all mission systems, accelerating OODA loops and enabling commanders to act faster than adversaries
• AI Intelligence Analysis — automated report production and multi-source data fusion, so analysts spend time on judgment rather than chasing and formatting data
• AI Mission Planning — situation report generation, training scenario simulation, and mission readiness analysis up to 75% faster than manual processes
• Secure AI Process Automation — AI-driven drafting, querying, and content composition on classified networks at IL2 through IL6

All of these AI workloads run inside containers that RapidFort has hardened to near-zero CVEs — deployable on-premises, air-gapped, in a VPC, or at the forward tactical edge, with no vendor lock-in and no inherited vulnerability debt.

“AI workloads are the new high-value target. The models, inference engines, and agent runtimes that warfighters depend on are only as secure as the containers they run in — and most of those containers are shipping with thousands of inherited CVEs,” said Mehran Farimani, CEO and Founder at RapidFort. “RapidFort was built to eliminate that risk at the source. By securing the container foundation of Legion’s entire AI platform, we are ensuring that the AI reaching the battlefield is hardened, continuously monitored, and provably secure — not just powerful.”

Security Compliance and Certifications

The Legion-RapidFort stack is engineered to meet the most demanding government and defense security standards:

• FedRAMP High Authorization (Legion Intelligence — January 2026)
• IL2 through IL6 deployment support across on-premises, cloud, hybrid, and air-gapped environments
• STIG and CIS benchmark-hardened container images (RapidFort)
• CMMC, FedRAMP, SOC 2 Type 2, HIPAA, and GDPR compliance readiness acceleration
• Continuous CVE remediation with automated compliance validation and audit-ready reporting

About Legion Intelligence

Legion Intelligence builds the Command Layer for mission-critical operations, helping defense, federal, and enterprise teams turn human intent into governed AI work across existing systems. Trusted by U.S. Special Operations Command, the U.S. Army, the U.S. Air Force, and the U.S. Department of Energy, Legion connects data, tools, models, and workflows through role-specific Mission Packs so agents can execute with auditability, governance, and human oversight. Legion deploys across cloud, on-premises, classified, air-gapped, edge, hybrid, and DDIL environments through Centurion, and is FedRAMP High authorized. Learn more at legionintel.com.

About RapidFort

RapidFort is the leader in Software Supply Chain Security, enabling organizations to eliminate risk across their software stack at scale. Its platform combines curated near-zero CVE container images, runtime profiling, and attack surface management to remove up to 99.9% of vulnerabilities within hours and reduce the attack surface by up to 90% without code changes. RapidFort was identified as a Gartner® Cool Vendor™ in 2025 and a Nutanix.Next Partner of the Year in 2026. For more information, visit www.RapidFort.com.

‍

RapidFort recognized in 2026 Gartner Magic Quadrant for Software Supply Chain Security report for delivering mandatory features for the SSCS market.

RapidFort Recognized in 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security for Delivering Mandatory Features for SSCS Market

Gartner Magic Quadrant Highlights Vendors Delivering Third-Party Software Risk Protection, Software Bill of Materials and Threat Intelligence while Demonstrating Ability to Execute and Completeness of Vision

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, a leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced it has been recognized in the just-released 2026 Gartner Magic Quadrant for Software Supply Chain Security report 1, which provides evaluations of 18 vendors.

According to Gartner, “Software supply chain security has grown from a niche concern into a top enterprise priority, supported by a rapidly maturing market. Gartner estimates that SSCS market revenue exceeded $2.8 billion in 2025, up from $2.5 billion in 2024 and $2.2 billion in 2023. Gartner forecasts that the SSCS market will exceed $5 billion in revenue by 2030.” 1

RapidFort included in Gartner Magic Quadrant report that highlights vendors delivering third-party software risk protection, software bill of materials and threat intelligence while demonstrating ability to execute and completeness of vision.

For its report, Gartner considered SSCS products or services that deliver “software composition analysis, third-party software governance, software bill of materials life cycle management, continuous threat intelligence, third-party reputation analysis, and all other additional features.” 1

“We believe Gartner has specific requirements for the select vendors included in the SSCS Magic Quadrant, and we are pleased to be recognized as delivering the mandatory features for this market, including additional features such as protection from third-party AI components, including large language models (LLMs) and Model Context Protocol (MCP) servers,” said Michael Wood, CMO with RapidFort. “RapidFort is differentiated in the industry with the largest and most comprehensive catalogue of curated genuinely open-source software, and we see customers select RapidFort because of our end-to-end continuous threat elimination platform.”

According to Gartner, “SSCS products have recently evolved in five ways, including OS image security, curated registries and rebuild factories are growing, as vendors seek to harden the upstream supply and offer pre-vetted components.”1

A complimentary copy of the 2026 Gartner Magic Quadrant for Software Supply Chain Security is available at https://go.rapidfort.com/gartner-magic-quadrant-software-supply-chain-security.

1 Gartner, Magic Quadrant for Software Supply Chain Security, Aaron Lord, Johnny Walters, Jason Gross, 17 June, 2026.

Gartner and Magic Quadrant are trademarks of Gartner, Inc., and/or its affiliates.

Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner’s business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose.

About RapidFort

RapidFort is the leader in Software Supply Chain Security, enabling organizations to eliminate risk across their software stack at scale. Its platform combines curated near-zero CVE container images, runtime profiling, and attack surface management to remove up to 99.9% of vulnerabilities within hours and reduce the attack surface by up to 90% without code changes. RapidFort was identified as a Gartner® Cool Vendor™ in 2025 and a Nutanix.Next Partner of the Year in 2026. For more information, visit www.RapidFort.com.

‍

RapidFort Curated Libraries help organizations secure the software supply chain at the source without disrupting existing development processes.

RapidFort Launches Curated Libraries to Stop Supply Chain Attacks Before They Reach the Pipeline

RapidFort expands its security platform with curated, third-party malware-scanned libraries to enhance protection of software at the source

SUNNYVALE, Calif.--(BUSINESS WIRE)--RapidFort, the leader in Software Supply Chain Security, today announced the availability of RapidFort Curated Libraries, a comprehensive catalog of malware-scanned open-source libraries to help organizations prevent supply chain malware before it reaches development pipelines or production environments.

RapidFort Curated Libraries give developers access to curated, malware-scanned open-source packages for npm, PyPI, Maven, RubyGems, and NuGet ecosystems. Developers are able to continue using the libraries they already know while reducing exposure to malicious binaries, backdoored dependencies, install-time payloads, typosquatted packages, credential stealers, droppers, downloaders, infostealers, keyloggers, rootkits, ransomware, and other supply chain threats.

“Modern software teams depend on open-source packages to move quickly, but every package downloaded into a development workflow introduces risk,” said Michael Wood, CMO at RapidFort. “RapidFort Curated Libraries give developers the power to move at DevOps speed while giving organizations the confidence that their applications and services have been vetted by the world’s most advanced threat intelligence solutions.”

RapidFort already provides more than 35,000 near-zero CVE curated images, runtime bill of material analysis, and the industry's most comprehensive software supply chain security platform. With RapidFort Curated Libraries, the company extends that protection to third-party application libraries, helping enterprises and public sector organizations secure the software supply chain at the source.

Mitigating Malware Before It Enters the Software Supply Chain

Recent software supply chain incidents have demonstrated how attackers increasingly target open-source ecosystems and developer workflows. Compromised packages and dependencies have affected widely used projects and repositories across popular application ecosystems.

RapidFort Curated Libraries are designed to stop these threats from entering an organization by ensuring developers access only open-source software that is curated and independently malware-scanned.

DevOps Velocity and SecOps Protection

RapidFort Curated Libraries leverage “The Power of And”: DevOps velocity and SecOps protection.

Developers can continue using the same pin-for-pin compatible libraries, packages, CLI syntax, interfaces, features, versions, and workflows they rely on today. RapidFort Curated Libraries work with existing operating systems, tools, artifactories, and software delivery processes without requiring teams to migrate to a proprietary operating system or vendor-specific development models.

Key benefits include:

• Malware scanning at the source: RapidFort helps prevent malicious packages and compromised dependencies from entering software pipelines.
• Existing workflow support: RapidFort Curated Libraries work with current operating systems, tools, artifactories, interfaces, and CLI syntax.
• Reduced incident response burden: Security and engineering teams can spend less time hunting for malware and vulnerabilities after public disclosures of threats.
• Continuous compliance visibility: RapidFort supports up-to-date compliance assessment and reporting based on frequent updates, helping organizations demonstrate security posture to internal stakeholders, auditors, customers, clients, and boards of directors.
• Policy-driven security: Organizations can shift from reactive vulnerability response to a proactive, policy-driven model for open-source software consumption.

Helping Developers Ship With Confidence

Open-source software powers modern innovation, but its scale and speed create new challenges for today’s security teams. RapidFort Curated Libraries allow organizations to continue benefiting from the global open-source ecosystem while reducing the risk that compromised packages, malicious payloads, or newly introduced malware will impact production systems.

“RapidFort has really helped us get ahead of the curve in vulnerability management of our application images, which is critical to delivering ATO-ready software to our customers," said Wesley Smith, President and CTO at Tactical ID. "We're excited that we can now give developers the packages they need while ensuring those packages are curated, malware-scanned, and compatible with the way teams already build software.”

Availability

RapidFort Curated Libraries are available today for organizations seeking to secure open-source software consumption across package libraries, operating systems, images, middleware, and development workflows. Customers can use RapidFort Curated Libraries alongside the RapidFort Curated Images catalog, runtime bill of material analysis, and compliance reporting capabilities.

For more information, visit www.rapidfort.com/libraries

About RapidFort

RapidFort is the leader in Software Supply Chain Security, enabling organizations to eliminate risk across their software stack at scale. Its platform combines curated near-zero CVE container images, runtime profiling, and attack surface management to remove up to 99.9% of vulnerabilities within hours and reduce the attack surface by up to 90% without code changes. RapidFort was identified as a Gartner® Cool Vendor™ in 2025 and a Nutanix.Next Partner of the Year in 2026. For more information, visit www.RapidFort.com.

‍

Knox Systems and RapidFort Join Forces to Defend Against Mythos-Generated CVE Threats and Fast-Track FedRAMP Compliance

Alliance Provides SaaS Vendors with Bundled FedRAMP 20-Ready Images to Accelerate Authorization and Prepare for AI-Driven Attacks

SAN FRANCISCO & NEW YORK--(BUSINESS WIRE)--Knox Systems, the largest federal AI-managed cloud provider, and RapidFort, the leader in Software Supply Chain Security, today announced a significant expansion of their strategic partnership. Effective immediately, Knox subscribers gain bundled access to RapidFort Federal Information Processing Standards (FIPS) 140-3 curated container images as part of their existing subscription. This expanded offering eliminates a critical compliance bottleneck on the FedRAMP path and provides a hardened, continuously maintained security foundation designed to withstand the AI-accelerated vulnerability landscape.

Knox and RapidFort share a unified mission: unlock cutting-edge commercial software for federal agencies by streamlining compliance and reducing the attack surface. Through this partnership, customers receive:

• Faster FedRAMP 20 Certification: Knox already enables vendors to inherit 60–80% of required FedRAMP controls on day one, compressing authorization timelines to approximately 90 days without requiring agency sponsorship. The addition of RapidFort FIPS 140-3 curated images removes the next largest obstacle — container image compliance — from the vendor's plate entirely. Teams that previously spent weeks hardening images, negotiating Security Technical Implementation Guide (STIG) and Center for Internet Security (CIS) benchmarks, and resolving FIPS cryptographic validation issues can now deploy against a pre-validated, continuously maintained foundation from first login.
• Structural CVE Defense, Not Reactive Patching: RapidFort near-zero CVE images are maintained continuously. As attack vectors like Mythos, the Anthropic AI system that autonomously discovers and exploits zero-day vulnerabilities, emerge and accelerate vulnerability weaponization, Knox customers can operate from a baseline that is already hardened. When the next Mythos-discovered vulnerability surfaces, organizations on this stack present a dramatically reduced attack surface compared to those relying on unmanaged community images.
• Simplified Adoption, Unified Cost: The bundled model eliminates the procurement complexity of managing separate image licensing. Knox subscribers gain access to both FIPS and non-FIPS variants across all major operating system (OS) distributions — Ubuntu, Red Hat, Alpine, and Debian, including Bitnami and official-image versions — under a single subscription and a single repository, with no per-image licensing fees and no vendor lock-in. Integration requires no source code changes and fits directly into existing Continuous Integration/Continuous Delivery (CI/CD) pipelines.

“FedRAMP 20x and the White House’s recent Memorandum 26-12 signal that the government wants to rapidly increase the use of commercial technology without sacrificing security,” said Irina Denisenko, CEO of Knox Systems. “At Knox, we are answering the call by enabling SaaS companies to achieve ATO faster and more cost-effectively. The addition of RapidFort’s FIPS images enables us to speed up the process even more while continuing to save valuable IT resources.”

“Since the outset of our partnership, we have proven that Knox and RapidFort are better together. Now we are making that combination the default,” said Mehran Farimani, CEO of RapidFort. “Every Knox customer automatically gets the most compliant and hardened container image foundation available anywhere - FIPS 140-3 validated, STIG and CIS benchmarked, and maintained at near-zero CVE. D.”

Existing Knox customers can activate RapidFort curated images through their Knox subscription portal. New customers receive access automatically upon onboarding.

About Knox Systems

Knox Systems operates the largest managed federal cloud, trusted by top agencies and partners across defense and civilian sectors. Built for speed, resilience, and compliance, Knox delivers FedRAMP authorization in 90 days - turning the biggest bottleneck in government IT into the fastest path to modernization. Knox proudly serves Adobe, Celonis, OutSystems, Armis, BigID and more AI and SaaS providers, accelerating secure innovation across the federal landscape. Learn more at www.knoxsystems.com.

About RapidFort

RapidFort is the leader in Software Supply Chain Security, enabling organizations to eliminate risk across their software stack at scale. Its platform combines curated near-zero CVE container images, runtime profiling, and attack surface management to remove up to 99.9% of vulnerabilities within hours and reduce the attack surface by up to 90% without code changes. RapidFort was identified as a Gartner® Cool Vendor™ in 2025 and a Nutanix .Next Partner of the Year in 2026. For more information visit www.RapidFort.com.

‍

RapidFort Awarded Nutanix Cloud Native Partner of the Year at Nutanix’s .NEXT Event

Nutanix recognizes RapidFort for advancing secure, cloud-native application delivery with near-zero vulnerability software supply chain security

WASHINGTON--(BUSINESS WIRE)--RapidFort, the leading software supply chain security platform delivering near-zero CVE container images and continuous vulnerability remediation, announced today during Nutanix’s .NEXT conference that it has been awarded the Nutanix Cloud Native Partner of the Year Award.

Nutanix recognized RapidFort as the recipient of a 2026 partner award for its innovation in helping customers secure and optimize cloud-native applications across hybrid and multi-cloud environments. RapidFort was recognized for enabling organizations to dramatically reduce their attack surface through automated container image hardening, continuous vulnerability removal, and compliance assurance, helping enterprises deploy and run applications on Nutanix infrastructure.

Through its partnership with Nutanix, RapidFort empowers joint customers to accelerate secure application delivery by combining the Nutanix Kubernetes Platform with RapidFort’s end-to-end software supply chain security capabilities. This includes real-time vulnerability remediation, generation of SBOMs and RBOMs, and access to a curated catalog of near-zero CVE container images, allowing customers to build and operate secure, compliant, and production-ready applications faster.

“We are proud to have honored RapidFort at .NEXT this year for their outstanding efforts in enabling customer success with Nutanix,” said Tarkan Maner, President and Chief Commercial Officer at Nutanix. “At a time when Enterprise AI, cloud-native, and hybrid cloud technologies are reshaping industries, RapidFort’s commitment to the Nutanix vision ensures that our customers can truly ‘Run Anything, Anywhere’ on a secure, future-proof platform.”

“Winning the Nutanix Partner of the Year Award is a strong validation of our shared mission to help enterprises build and run secure, cloud-native applications without compromise,” said George Manuelian, Co-Founder and CSO of RapidFort. “Together with Nutanix, we are enabling organizations to eliminate vulnerabilities at the source, reduce operational risk, and accelerate innovation across hybrid and multi-cloud environments.”

RapidFort and Nutanix continue to collaborate to deliver integrated solutions that simplify security across the software lifecycle, from build through production, while ensuring compliance with frameworks such as FedRAMP and CMMC. This partnership enables organizations, including those in highly regulated sectors, to confidently deploy modern applications with reduced risk and increased operational efficiency.

About RapidFort

RapidFort is the industry’s leading software supply chain security platform, built to help organizations quickly ship safer software with less overhead across any operating system. RapidFort automates vulnerability remediation at scale, eliminating up to 95% of vulnerabilities without requiring code changes. Operating system–agnostic and vendor-neutral by design, the platform enables organizations to secure software across container environments without platform or vendor lock-in.

With a free tier and hardened community images, RapidFort makes secure development accessible to teams of any size. Learn more at rapidfort.com.

‍

RapidFort partners with Nutanix to help enterprises scale Kubernetes for AI workloads while reducing risk, compliance burden, and operational burden.

RapidFort Partners with Nutanix to Deliver Secure, Compliant Kubernetes at Development Speed for Enterprise AI Workloads

Collaboration with Nutanix enables enterprise teams to innovate without compromise with hardened containers and accelerated compliance, at scale.

AMSTERDAM--(BUSINESS WIRE)--KubeCon + CloudNativeCon – RapidFort, the leader in end-to-end software supply chain security, today announced a strategic partnership with Nutanix, a leader in hybrid multicloud computing, to address a growing challenge for enterprises adopting Kubernetes at scale: maintaining speed and agility without expanding security and compliance risk.

Through this new partnership, RapidFort will integrate its automated software supply chain security capabilities with the Nutanix Kubernetes Platform (NKP) solution. RapidFort’s Platform and curated near-zero CVE images enable customers to deploy continuously hardened software artifacts remediated with every release across data center, edge, and public cloud environments. This integration will help organizations running NKP strengthen the security of their cloud-native workloads while maintaining the speed developers expect. By extending protection into the software supply chain, RapidFort enables customers to build and operate secure Kubernetes environments for modern applications, including AI and generative AI initiatives.

This integration builds on the strong security foundation Nutanix customers already expect, extending protection into the software supply chain for cloud‑native deployments running on the Nutanix Cloud Platform solution. With RapidFort’s curated near-zero CVE images and automated vulnerability remediation, organizations can deploy hardened cloud-native workloads with dramatically reduced attack surface across on-prem, edge, OEM partner platforms, and public cloud environments.

“Integrating RapidFort into the Nutanix Kubernetes Platform gives our customers access to a platform with hardened software artifacts. It’s a big step forward in making Kubernetes environments more secure everywhere they run,” said Dan Ciruli, vice president and general manager, Cloud Native, at Nutanix.

“The Nutanix Kubernetes Platform meets the enterprise foundation team’s need to run Kubernetes consistently across datacenter, edge, and public cloud,” said George Manuelian, Co-Founder and CSO of RapidFort. “RapidFort complements NKP by continuously eliminating vulnerabilities and reducing attack surface in the workloads deployed into those environments—so customers can move faster while reducing risk and accelerating compliance.”

Scaling Kubernetes More Securely

The partnership:

• Enables containers and VMs to run consistently across data center, edge, and public cloud.
• Reduces operational burden through automated vulnerability remediation.
• Gives platform and security teams clear, auditable controls for compliance.

Extending Security Across NKP

The collaboration also:

• Brings RapidFort’s hardened software supply chain protections to workloads running on NKP.
• Delivers curated, near-zero-CVE hardened container images by default.
• Aligns RapidFort’s automated remediation with NKP’s policy-driven guardrails.

Mitigating Rising Software Supply Chain Risk

With RapidFort integrated into NKP, organizations can:

• Eliminate reactive patching by fostering a proactive, secure-by-design posture throughout the entire software lifecycle.
• Secure the supply chain with cryptographic proof of provenance, ensuring the integrity of every library from source to deployment.
• Protect production environments by mandating that only verified, hardened, and risk-reduced artifacts are deployed to production.

Analyst Commentary

"Sovereign AI and Sovereign Cloud demand more than just localized data; they demand a hardened, minimalist software supply chain. Container platforms must prioritize security optimized libraries to enable secure-by-default container management approaches, giving customers a streamlined path to compliance in the world’s most demanding digital environments,” said Gary Chen, Research Director, IDC.

The newly integrated RapidFort and Nutanix solution will be available to all NKP customers and users regardless of tier (Starter, Pro, and Ultimate). It is expected to be generally available to customers later this year.

About RapidFort

RapidFort is the industry’s leading software supply chain security platform, built to help organizations quickly ship safer software with less overhead across any operating system. RapidFort automates vulnerability remediation at scale, eliminating up to 95% of vulnerabilities without requiring code changes. Operating system–agnostic and vendor-neutral by design, the platform enables organizations to secure software across container environments without platform or vendor lock-in.

With a free tier and hardened community images, RapidFort makes secure development accessible to teams of any size. Learn more at rapidfort.com.

‍

Trellix strengthens software supply chain security with RapidFort, delivering hardened images, reduced attack surface, and rapid CVE response.

Trellix Partners With RapidFort to Strengthen Software Supply Chain Security Across Product Portfolio

Strategic collaboration delivers hardened container images, reduced attack surface, and accelerated vulnerability response

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced Trellix, the company delivering the future of AI-powered cybersecurity, has selected the RapidFort platform and curated images to secure both first-party and third-party software components across its entire product ecosystem.

With a mission to address critical software supply chain security challenges, Trellix identified the need for a security partner capable of reducing software vulnerabilities in container images while maintaining operational efficiency. By adopting RapidFort's platform, Trellix benefits from hardened, curated images with minimized attack surfaces and automated remediation workflows across its comprehensive product suite.

"In today's threat landscape, securing the software supply chain is critical to delivering enterprise-grade security solutions our customers can trust,” said Randy Dougherty, Chief Information Officer at Trellix. "By hardening our software from the inside out, we're helping set a new security standard for product development and strengthening our cloud exposure management portfolio."

Key benefits for Trellix customers include:

• Enhanced Software Supply Chain Security: Comprehensive protection for both proprietary and third-party software components throughout the development lifecycle
• Rapid CVE Response: Accelerated identification, prioritization, and remediation of vulnerabilities, reducing exposure windows and strengthening security posture
• Optimized Container Images: Significantly reduced image footprint and attack surface through intelligent removal of unnecessary components
• Improved Operational Efficiency: Smaller, hardened images result in faster deployments, reduced storage costs, and streamlined maintenance

“Software supply chains have become a primary attack vector, and organizations need solutions that address vulnerabilities before they reach production," said Mehran Farimani, CEO of RapidFort. "Trellix's decision to adopt our platform ensures that enterprises start with a secure, dependable software foundation that supports their products at scale.”

The partnership delivers immediate value by further strengthening Trellix's security posture and optimizing deployment workflows. The RapidFort platform automatically patches and optimizes base images while intelligently removing unused components, resulting in container images that are 30% smaller than traditional distroless images and contain 20% fewer CVEs. After evaluating multiple solutions, Trellix replaced its previous vendor with RapidFort, achieving these measurable improvements with no migration efforts or software porting required through drop-in replacements for existing images.

For Trellix customers, this partnership translates into immediate security benefits: enhanced protection through products built with a fortified software foundation, reduced vulnerability exposure from hardened components, and faster security updates through rapid CVE identification and remediation. The implementation spans Trellix's comprehensive product suite, ensuring consistent security standards and supply chain integrity across all customer deployments.

This partnership reinforces Trellix's position as a trusted cybersecurity vendor that practices the same rigorous security principles it advocates for its customers. With a free tier and community-maintained images, RapidFort makes secure development accessible to teams of any size. Learn more at https://www.rapidfort.com.

About RapidFort

RapidFort delivers a modern software supply chain security platform built to help organizations ship safer software with less overhead. Its curated near-zero-CVE container images, automated vulnerability remediation, runtime intelligence, and built-in hardening tools reduce noise, shrink attack surfaces, and keep applications secure from build to production. Through intelligent analysis and optimization, RapidFort enables enterprises to deploy secure, efficient container images while maintaining full functionality. The platform serves Fortune 500 companies and security-conscious organizations worldwide.

‍

RapidFort raises $42M to scale a new approach to automated software supply chain security, and combat increasing vulnerability exploitation.

RapidFort Raises $42M Series A Led by Blue Cloud Ventures and Forgepoint Capital to Power the Next Generation of Software Supply Chain Defense

Strategic collaboration delivers hardened container images, reduced attack surface, and accelerated vulnerability response

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the technical leader defining the next generation of software supply chain security, today announced $42 million in Series A funding led by Blue Cloud Ventures and Forgepoint Capital, with participation from prior lead investor Felicis Ventures. Additional participants include Alumni Ventures, Boulder Ventures, Brave Capital, Evolution Ventures, Florida Funders, Gaingels, and Mana Ventures.

This funding arrives at a defining moment for cybersecurity and software delivery. AI has dramatically accelerated how software is built and shipped, and attackers are moving just as fast. As the window between vulnerability disclosure and exploitation continues to shrink, organizations can’t rely on quarterly patch cycles, manual triage, or “scan-and-pray” security. RapidFort’s accelerating revenue momentum reflects the market’s shift toward continuous, automated vulnerability elimination. According to Verizon’s latest Data Breach Investigations Report, vulnerability exploitation now accounts for 20% of breaches, nearly matching credential abuse at 22%. The message is unmistakable: vulnerability management must shift from reactive detection to continuous elimination.

“Software teams are shipping faster than ever—and attackers are moving even faster. RapidFort is building what the market urgently needs: continuous vulnerability remediation that keeps pace with modern development. Their end-to-end platform doesn’t just surface risk—it eliminates it. We’re excited to partner with RapidFort as they define the next era of software supply chain security,” said Rami Rahal, Managing Partner at Blue Cloud Ventures.

A New Category: Continuous Remediation for the Software Supply Chain

RapidFort is setting a new standard: remediation at machine speed, built directly into the software delivery pipeline. RapidFort secures the entire software lifecycle—from build through runtime—by continuously analyzing, remediating, hardening, and protecting software artifacts so vulnerabilities don’t survive long enough to become incidents.

“The problem isn’t that organizations don’t know they have vulnerabilities, it’s that they can’t fix them fast enough,” said Mehran Farimani, Founder and CEO of RapidFort. “AI has accelerated software delivery and attacker capability at the same time. The window between disclosure and exploitation has collapsed. RapidFort exists to eliminate vulnerabilities continuously—at machine speed—before they reach production.”

RapidFort combines automated vulnerability remediation with one of the industry’s most comprehensive catalogs of hardened, near-zero-CVE container images across major Linux distributions, enabling teams to dramatically reduce risk in days, not months.

Why RapidFort Wins: From “Finding Fires” to “Stopping Them”

RapidFort goes beyond scanning and detection. The platform eliminates risk through:

• Automated remediation: Continuous vulnerability removal embedded in CI/CD workflows, enabling teams to fix issues as software ships, not weeks later.
• Near-zero-CVE containers: Drop-in, hardened images across major Linux distributions that dramatically reduce CVEs without code changes, eliminating security debt from day one.
• Runtime intelligence: Behavioral analytics and image optimization that remove unused components, reducing attack surface by up to 90 percent.
• End-to-end hardening: Automated hardening and validation from build through production for consistent security across environments.
• Compliance-ready security: Built for regulated environments, supporting programs such as FedRAMP, CMMC, ATO, CRA and NIS2 with continuous risk reduction and auditable security controls.

Investing in the Future of Software Security for the AI Era

The Series A funding will accelerate RapidFort’s next phase of growth across product innovation, platform expansion, and enterprise adoption:

• Go-to-Market Expansion: Scaling sales, marketing, and partnerships to meet increasing demand for automated remediation
• Platform Innovation: Advancing automated remediation, near-zero-CVE software delivery, and continuous attack surface reduction
• Enterprise Adoption: Supporting deployments in regulated industries with deeper integrations, smoother onboarding, and operational scalability
• Software Supply Chain Assurance: Expanding end-to-end lifecycle security from build through runtime to ensure continuous protection and compliance

“RapidFort represents the evolution of software supply chain security from reactive to proactive,” said Ernie Bio, Managing Director at Forgepoint Capital. “In an AI-accelerated threat landscape, detection alone is table stakes. What matters is elimination. RapidFort is the only platform that combines comprehensive profiling, automated rebuilding, intelligent patching, and continuous validation at enterprise scale. We’re thrilled to partner with Mehran and the team as they define the new standard for software supply chain security.”

“What’s compelling about RapidFort is that it treats software artifacts as infrastructure. By hardening and validating images continuously, the platform creates a security foundation that scales across teams, tools, and environments—without forcing developers to change how they build,” said Jimmy Park, Vice President at Forgepoint Capital.

Learn more at rapidfort.com.

About RapidFort

RapidFort delivers the modern software supply chain security platform built for the AI era. Through automated vulnerability remediation, curated near-zero-CVE container images, runtime intelligence, and continuous hardening, RapidFort helps organizations eliminate vulnerabilities at the speed of development and accelerate compliance readiness. From startups to Fortune 500 enterprises, RapidFort enables teams to reduce attack surface, shrink security debt, and ship safer software with less overhead.

‍

Azul Launches Technology Alliance Partner Program to Accelerate Innovation and Expand the Ecosystem of Java Solutions

New program fosters deep collaboration between Azul and technology partners to deliver integrated solutions that improve developer productivity, DevOps efficiency, business productivity and cloud efficiency for Java customers worldwide

SUNNYVALE, Calif.--(BUSINESS WIRE)--Azul, the only company 100% focused on Java, today announced the launch of the Azul Technology Alliance Partner (TAP) Program, a global initiative designed to strengthen collaboration with leading technology providers, accelerate innovation and expand the Java ecosystem.

The TAP program provides a formal framework for joint technical integrations, solution development, and go-to-market activities between Azul and its alliance partners. By joining the TAP program, partners gain access to Azul’s innovative products, Java expertise, joint marketing initiatives, sales team and channel to bring high-value, validated solutions to market faster for their shared customers. TAP is part of Azul’s overall PartnerConnect Program – in addition to technology alliance ISVs, Azul’s broader PartnerConnect ecosystem includes solution providers, authorized value-added resellers and authorized distributors.

New program fosters deep collaboration between Azul and technology partners to deliver integrated solutions that improve developer productivity, DevOps efficiency, business productivity and cloud efficiency for Java customers worldwide

Empowering ISVs with Java Innovations, Co-Sell Opportunities and Market Expansion

By partnering with Azul, ISVs realize several benefits, including:

• Technical collaboration with Azul product managers and engineers to aid solution integration and optimization.
• Accelerated innovation and development via access to cutting-edge Java technologies, expertise and resources that can accelerate product development.
• Joint marketing initiatives, including co-branded content, events and campaigns.
• Access to new markets and customer segments that can significantly boost sales and brand awareness.
• Access to Azul’s ecosystem, connecting partners with the world’s leading Java innovators and community.

Maximizing Customer ROI Through Azul’s Technology Alliance Ecosystem

Azul’s Technology Alliance Partner Program delivers tangible customer value by integrating best-of-breed Java technologies to provide solutions in four key areas:

• Developer Tools & Productivity – Enabling developers to be more productive — writing better code faster, deploying more frequently and responding rapidly to production security issues.
• DevOps Efficiency – Improving the automation and optimization of key aspects of the development and IT operation lifecycle.
• Business Benefit/Productivity Software – Driving the company’s top-line revenue growth through improved Java application performance and metrics (e.g., KPIs).
• Cloud Cost Savings/Infrastructure Cost Reduction – Reducing Java’s infrastructure footprint and right-sizing compute resources without sacrificing performance.

Together, these benefits make Azul’s partner ecosystem a powerful force multiplier for enterprises seeking to maximize the value of their Java investments.

The inaugural TAP members include leading companies in supply chain security, development and modernization. Azul will continue expanding the program throughout 2025 with additional partners across key technology categories.

Real World Customer Impact from Working with Azul and its ISVs

Azul’s growing ecosystem of technology partners is delivering tangible business outcomes for customers – the following are real-world examples of how organizations across industries are benefiting from Azul’s integration with leading technology providers:

• Moderne – A global online employment marketplace vendor using Azul Intelligence Cloud to surface unused and dead code estimated it would take 21 person-years to remove all their unused code. By applying Moderne’s OpenRewrite-based platform with Azul’s runtime intelligence, the company automated that remediation, doing in days what would have taken years. They were able to go from a project that was often ignored or handled sparingly to one that can be tackled decisively at scale.
  
  “Modernizing enterprise Java applications is a massive challenge. Moderne enables our customers to tackle technical debt at scale — bringing entire fleets of applications forward in parallel,” said Jonathan Schneider, CEO and co-founder of Moderne. “Partnering with Azul gives us the real-time data to drive transformations across codebases faster and with greater confidence.”
  ‍
• Payara – A large securities industry foundation needed to modernize its aging financial education platform used by thousands of users. By migrating to Payara Platform Enterprise, which includes Azul Platform Core and Azul Platform Prime as the default JVMs, the foundation increased user capacity per machine by 2.5 times while unlocking scalability opportunities.
  
  “Payara is committed to delivering cloud-native Java solutions for global enterprises, from powerful runtimes to Payara Qube — our Kubernetes-native automation platform that simplifies and scales Java deployments,” said Steve Millidge, CEO and founder of Payara. “The Azul TAP program creates exciting opportunities for deeper collaboration that brings customers better performance, stronger security and more choice across their Java deployments.”
  ‍
• RapidFort – A U.S. wealth management firm was struggling with CVE remediation. Instead of chasing enormous CVE patch backlogs, the firm chose to focus solely on the vulnerabilities within its applications, while RapidFort and Azul focused on the rest (e.g., RapidFort containers embedded with Azul Java runtimes). This resulted in a significant improvement in developer productivity and the velocity of new deployments.
  
  “Performance and security go hand in hand, especially in cloud environments where efficiency is critical,” said George Manuelian, co-founder of RapidFort. “By joining Azul’s TAP program, we’re giving enterprises the ability to optimize Java workloads with a dramatically smaller attack surface and lower cloud costs.”

“Java remains the backbone of modern enterprise and cloud-native applications, and at Azul, our mission is to give enterprises more — more performance, more value and more choice,” said George Gould, senior vice president, Corporate Development and Strategic Alliances at Azul. “The Technology Alliance Partner Program is a powerful catalyst for innovation, enabling Azul and our ecosystem partners to co-create solutions that streamline development and operations, as well as make Java run more securely and more cost-effectively across today’s distributed environments. By aligning with technology leaders who share our vision, we can help our joint customers boost application performance, reduce costs and enhance security across their Java landscape.”

For more information about the Azul Technology Alliance Partner Program and how to participate, please visit https://www.azul.com/partners/type/technology-alliance-program.

About Azul Systems Inc.

Headquartered in Sunnyvale, California, Azul provides the Java platform for the modern cloud enterprise. Azul is the only company 100% focused on Java. Millions of Java developers, hundreds of millions of devices and the world’s most highly regarded businesses trust Azul to power their applications with exceptional capabilities, performance, security, value, and success. Azul customers include 36% of the Fortune 100, 50% of Forbes top 10 World’s Most Valuable Brands, 10 of the world’s top 10 banks and leading brands like Avaya, Bazaarvoice, BMW, Deutsche Telekom, LG, Mastercard, Mizuho, Priceline, Salesforce, Software AG, and Workday. Learn more at azul.com and follow us @azulsystems.

‍

RapidFort achieves SOC 2 Type 2 compliance demonstrating the company’s commitment to security and privacy

RapidFort Achieves SOC 2 Type 2 Compliance, Reinforcing Trust-First Strategy

Third-party auditors confirm the company’s mature security practices, reaffirming RapidFort’s commitment to their partners and customers

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a San Francisco-based container security company, today announced that it has successfully completed a Service Organization Controls (SOC) 2 Type 2 compliance audit, demonstrating the company’s commitment to maintaining all aspects of security and privacy. After an extensive review of RapidFort’s controls, practices, business processes, and more by a professional third-party auditor, RapidFort met more than 300 necessary requirements to achieve the certification.

The importance of vendor and partner security cannot be overstated in today’s business ecosystem. Security breaches from vendors or partners that directly affect companies and their clients are more prevalent now than ever before. SOC 2, developed by the American Institute of CPAs (AICPA), is a globally recognized auditing procedure that measures a service provider’s ability to securely manage its data and protect the privacy of its clientele. All audited organizations must meet the criteria across five trust service principles, including security, availability, processing integrity, confidentiality, and privacy.

“Trust is the currency of business today,” said Kevin Baldwin, Chief Revenue Officer at RapidFort. “Achieving SOC 2 Type 2 compliance makes RapidFort more than just a credible company, but a trusted and preferred business partner. Now companies of all sizes, from government organizations to major enterprises, can use the RapidFort platform with confidence knowing that their data will remain secure.”

Successfully completing the SOC 2 Type 2 Compliance audit reasserts RapidFort’s dedication to its current and future business partners. This certification also allows them to broaden their target audience to companies that will only work with SOC 2 Type 2 credited companies. RapidFort’s existing internal standards of security and compliance made the 3-month assessment process simple. They were able to demonstrate excellence in best practices for each of the audited categories and serve as an example that adherence to high standards begets positive outcomes.

To learn more about RapidFort’s platform, please visit https://www.rapidfort.com.

About RapidFort

RapidFort is a cloud-native cybersecurity company that provides a platform to optimize and secure modern cloud infrastructures. The company helps organizations monitor and minimize their software attack surface continuously. RapidFort’s free tier and free community images empower development and security teams to improve their security posture and operational efficiency. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort launches Runtime Protection to enhance software visibility and automatically mitigate vulnerabilities.

RapidFort Launches Runtime Protection to Automatically Monitor and Secure Kubernetes Workloads

RapidFort Runtime Protection enhances software visibility, empowering security and development teams to easily mitigate software vulnerabilities

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), has launched RapidFort Runtime Protection, its flagship runtime toolset. Runtime Protection provides security teams with a deep understanding of their software and the tools needed to automatically mitigate vulnerabilities – significantly reducing the burden on development teams.

Securing trust among customers, stakeholders, and regulators has never been more critical. Government regulatory efforts and an increasingly interconnected technology landscape are driving companies to decrease their overall attack surface. Many are placing extra emphasis on container security as a key part of their risk reduction strategy in order to protect against malware, vulnerabilities, data leaks, human error, and more. Runtime Protection actively scans, profiles, monitors, and secures containers in lower and production environments, pinpointing the vulnerabilities within applications’ execution paths. This enables teams to protect their infrastructure by automatically securing unused components and unnecessary vulnerabilities, ultimately reducing software attack surfaces by 60-90%. With deep insights into their Kubernetes workloads, teams are able to prioritize vulnerabilities, streamline their remediation strategy, and make informed decisions across the board.

“Scaling the remediation of software vulnerabilities has become an intractable problem to solve," said Dave Neuman, Senior Analyst at Tag-Cyber. "Security professionals are burdened by an overabundance of vulnerabilities and developers are asked to chase CVEs instead of focusing on innovation and new product features. RapidFort is a quantum leap forward. Now security professionals are empowered to solve up to 90% of software vulnerabilities automatically without involving developers. RapidFort’s innovative technology has taken the complex and made it simple, ushering in a whole new way of managing the risk associated with software vulnerabilities at enterprise scale.”

With the addition of RapidFort Runtime Protection, the RapidFort platform is the first solution on the market that offers build time CI/CD tools and runtime Kubernetes features that work in unison, helping organizations reduce their software attack surface throughout the Software Development Life Cycle and facilitating efficient cooperation between security and development teams. Current industry runtime tools can require up to 30% of compute overhead, which can hinder high-performance cloud native environments. Runtime Protection was purpose-built to be environment agnostic and uses less than 1% compute overhead, allowing frictionless deployment in high-traffic Kubernetes environments.

“Trust and compliance are paramount to success in today's business landscape and RapidFort is fundamentally revolutionizing the cloud application security industry by solving one of the most important and complex issues facing organizations today – software vulnerability management,” said Kevin Baldwin, Chief Revenue Officer at RapidFort. “We realized early on we needed to look at the problem differently and that automation was key to solving this issue at scale. The addition of Runtime Protection to our platform’s tool set ensures that, with the push of a button, only the vulnerabilities that materially impact a company's unique environment are identified and remediated. This innovation doesn’t just eat around the edges of the problem. It simply eliminates it.”

RapidFort’s platform presents security teams with a simple, three-step process to optimize and secure their software attack surface:

• Scan & Observe: Scan infrastructure, generate vulnerability reports, and measure risk
• Profile & Understand: Understand your software attack surface, identify what packages are used and unused, and prioritize vulnerability remediation
• Harden & Secure: Reduce your software attack surface, and improve security posture

A recent study conducted by RapidFort found that 60-90% of software in modern applications is unused and irrelevant to the execution path. Despite its irrelevance, the unused software is continuously maintained, bogging down security and dev teams while posing significant, unnecessary risk. Through its automatic scanning, monitoring, and hardening capabilities, Runtime Protection identifies this unnecessary code and gives security teams contextual insight into what vulnerabilities matter most so they can remediate risks more efficiently.

To learn more about Runtime Protection and the RapidFort platform, please visit http://runtime.rapidfort.com.

About RapidFort

RapidFort is a cloud-native cybersecurity company that provides a platform to optimize and secure modern cloud infrastructures. The company helps organizations monitor and minimize their software attack surface continuously. RapidFort’s free tier and free community images empower development and security teams to improve their security posture and operational efficiency. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort selected as a member of the prestigious Microsoft for Startups Pegasus Program

RapidFort Joins Microsoft for Startups Pegasus Program

The program helps RapidFort drive growth and customer value

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), has been selected as a member of the prestigious Microsoft for Startups Pegasus Program. The program helps drive sales and accelerate growth for RapidFort’s advanced software security platform. As part of the program, Microsoft channels and customers now have easy access to RapidFort's market-leading platform, which includes RapidFort Runtime Protection. This tool empowers security teams to automatically scan, understand, and harden their software infrastructure. By leveraging Runtime Protection, companies can expect the automatic remediation of 60-90% of their software vulnerabilities without involving development teams.

“The Microsoft Pegasus Program is a critical part of our go-to-market strategy, and we’re thrilled to be working with such a stellar and capable team,” said Mehran Farimani, CEO at RapidFort. “Being selected as a member of the program validates our unique vision for the future of software attack surface management. With Microsoft's support, we will greatly accelerate our mission to help customers automatically secure and optimize their software, and enjoy the operational efficiency and security benefits that RapidFort enables.”

The Microsoft for Startups Pegasus Program extends the Microsoft for Startup Founders Hub platform with curated training and support for invited startups. The Pegasus Program is an ecosystem of startups with unique solutions to critical market needs and offers a range of resources and support. Participation in the program gives RapidFort access to a dedicated Success Manager, a Cloud Solutions Architect, and an Account Executive, who provide customers with personalized support and the technical assistance needed to make the most of RapidFort's offerings. RapidFort is well-positioned to accelerate top-line expansion and deliver innovative solutions that solve critical business problems for Microsoft and RapidFort's joint customers.

The program also enables RapidFort to serve its current and prospective customers better. Microsoft’s enterprise customers who are looking to streamline their security operations are now able to connect with RapidFort’s offerings and transact seamlessly. These companies can now meet one-on-one with RapidFort to collaborate on digital transformation and innovation opportunities.

“Remediation of software vulnerabilities is a considerable burden to engineering teams, and RapidFort has developed a patented and effective toolset to significantly reduce this cost. RapidFort's acceptance into the Pegasus Program is a testament to their unique approach to software security. We look forward to continuing our work together to drive growth for them, and increased security for our joint customers,” said Tom Davis, Senior Director at Microsoft for Startups.

To learn more about the Microsoft for Startups Pegasus Program, please visit: https://www.microsoft.com/en-us/startups/pegasus

To learn more about Runtime Protection and the RapidFort platform, please visit: http://runtime.rapidfort.com.

About RapidFort

RapidFort is a cloud-native cybersecurity company that provides a platform to optimize and secure modern cloud infrastructures. The company helps organizations monitor and minimize their software attack surface continuously. RapidFort’s free tier and free community images empower development and security teams to improve their security posture and operational efficiency. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort named a winner of the 2023 CISO Choice Awards in Vulnerability Management

RapidFort Wins The Prestigious 2023 CISO Choice Award For Vulnerability Management

RapidFort is recognized for its innovative approach to vulnerability management and automatic remediation.

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), has been named a winner of the prestigious 2023 CISO Choice Awards in the Vulnerability Management category. The awards honor leading security vendors who exemplify creative entrepreneurship and offer innovative solutions to today's growing security challenges. The board of judges is composed of distinguished CISOs from major organizations across multiple industries, and their choices were rooted in firsthand knowledge and insights from building and maintaining their own programs.

"I would like to congratulate RapidFort for winning the 2023 CISO Choice Awards Vulnerability Management Category. The field was exceptionally competitive this year, and our esteemed CISO Board of Judges was very impressed by the level of innovation that solution providers put forth to safeguard our organizations," said David Cass, CISOs Connect and Security Current President, and Global CISO at GSR.

It's common for large enterprises to find 10-20 million vulnerabilities in their software infrastructure after a scan. Uniquely, through a process of identifying used and unused components, RapidFort's platform can automatically remediate a majority of vulnerabilities. In a recent study conducted by Rapidfort, 73% of people said that their organizations spend up to 30 hours each week remediating each prioritized CVE, taking up a significant amount of time. RapidFort pinpoints these unused components and their associated vulnerabilities in all parts of the software development and deployment lifecycle and provides security and development teams with the tools to mitigate most vulnerabilities automatically.

The platform empowers organizations to:

• Scan & Observe: Scan infrastructure, generate vulnerability reports, and measure risk
• Profile & Understand: Understand their software attack surface, identify what packages are used and unused, and prioritize vulnerability remediation
• Harden & Defend: Reduce their software attack surface and improve security posture

When using RapidFort, discussions between security and development teams change from fixing CVEs in open-source components (i.e., other people's code) to improving software hygiene with actionable reports and tools to eliminate unnecessary software components. This, in turn, frees up development teams to focus on building new software features and solving customer and business issues, resulting in a faster, leaner software organization.

"The CISO Choice Awards are a significant accolade to companies in the cybersecurity industry. The recognition from the highly respected CISO judges validates our unique and innovative approach to reducing organizations' software attack surface," said Mehran Farimani, CEO of RapidFort. "RapidFort is revolutionizing how security teams and developers work together to keep their organizations safe. By automatically identifying and remediating up to 90% of software vulnerabilities, we empower security teams to focus on defending while enabling developers to spend their precious time on innovations relevant to their businesses."

To learn more about RapidFort's platform, please visit https://www.rapidfort.com.

About RapidFort

RapidFort is a cloud-native cybersecurity company that provides a platform to optimize and secure modern cloud infrastructures. The company helps organizations monitor and minimize their software attack surface continuously. RapidFort's free tier and free community images empower development and security teams to improve their security posture and operational efficiency. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort’s attack surface management platform now available on Microsoft Azure Marketplace

RapidFort’s Platform Now Available in Microsoft Azure Marketplace

Marketplace inclusion improves access to industry-leading software attack surface management technology

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), is now available in the Microsoft Azure Marketplace, an online repository containing IT software applications and services built by industry-leading technology companies. Customers now have access to the powerful -- Azure optimized -- features of the RapidFort platform to scan, monitor and harden workloads running in Microsoft Azure Kubernetes Services.

RapidFort’s technology will be the first of its kind available on the Azure marketplace and can be fully deployed on the Azure stack within a customer account. With no data leaving the customer account, customers remain secure and can enforce organizational security policies while leveraging the benefits of the RapidFort platform. The locality of the platform and RapidFort Runtime Protection features also allow for accelerated scanning of Common Vulnerabilities and Exposures (CVEs) as all data is local to customer workloads.

“Our inclusion in the Microsoft Azure Marketplace is another crucial step forward in our go-to-market strategy as we expand access to our powerful solution, and tackle the growing challenge of software security,” said Mehran Farimani, CEO at RapidFort. “This affirms our innovative approach to software attack surface management. As we expand access to our platform, we're expediting our mission, empowering customers to effortlessly secure and optimize their software with the operational efficiency and security benefits of RapidFort."

RapidFort’s inclusion in the marketplace serves as further testament to their mission of creating a seamless approach for customers to access its technology. The complete integration of the platform into the Azure Marketplace greatly benefits regulated industries such as financial services and healthcare, as it will allow customers to leverage their existing certifications alongside the benefits of the RapidFort platform.

RapidFort was also recently selected to be in the prestigious Microsoft For Startups Pegasus Program. This in addition to the listing demonstrates the company’s continued dedication to better serve its current and prospective customers by increasing access to its market-leading platform and making it easier than ever to remediate software vulnerabilities.

To find RapidFort on the Microsoft Azure Marketplace, please visit: https://azuremarketplace.microsoft.com/pt-br/marketplace/apps/rapidfortinc1678380358035.saas_sasm_platform?tab=overview

To learn more about RapidFort, please visit: https://www.rapidfort.com.

About RapidFort

RapidFort is a cloud-native cybersecurity company that provides a platform to optimize and secure modern cloud infrastructures. The company helps organizations monitor and minimize their software attack surface continuously. RapidFort’s free tier and free community images empower development and security teams to improve their security posture and operational efficiency. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort announces new SBOM warehouse feature, increasing software vulnerability identification and remediation efficiency

RapidFort Unveils New Software Bill of Materials Warehouse Feature

New capability increases efficiency in identifying and automatically remediating more than 80% of critical software vulnerabilities

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity, unveiled its Software Bill of Materials (SBOM) Warehouse feature, taking a major leap forward in Software Attack Surface Management (SASM). This innovative platform capability provides a centralized location for SBOMs for all of an organization’s containers, aligning with the National Institute of Standards and Technology’s (NIST) recommendation. The centralized view, coupled with additional benefits like enhanced risk visibility, ingestion and reporting capabilities, allows security teams to swiftly and effectively address critical vulnerabilities in any package and its dependencies, significantly enhancing organizations' cybersecurity posture. This new functionality is part of the process RapidFort uses to automatically eliminate more than 80% of software vulnerabilities, during development, with no code changes.

The Presidential Executive Orders new requirement for cyber devices to provide an SBOM for all software components and a proposal for federal contractors to develop and maintain an SBOM for any software are just two examples of recent compliance requirements making SBOMs among the most critical priorities for government agencies and commercial organizations. RapidFort’s SBOM Warehouse feature is helping to address this new priority by continuously monitoring for risks, updating risk profiles with new security advisories, and reducing the repetitive task of regenerating SBOMs for the same containers on a regular cadence, saving customers time and money.

"The landscape of vulnerabilities within SBOMs is dynamic, changing almost daily. To maintain an accurate risk profile, organizations would traditionally need to generate SBOMs manually every day, a time-consuming and costly process," explained Mehran Farimani, CEO and Co-Founder of RapidFort. "We are thrilled to be one of the only vendors offering a solution that is helping organizations address this growing priority by simplifying and automating the process, saving them valuable time and resources."

RapidFort’s SBOM Warehouse is incorporated within RapidFort's platform and scanning suite, making it simple for organizations to leverage the profiling and hardening feature to remediate risks quickly and automatically. Uniquely, the SBOM Warehouse enables the ingestion of SBOMs generated by scanners, including those not supported by RapidFort's platform. It then converts them to industry standard formats such as SPDX and Cyclone DX. With the SBOM Warehouse's container comparison feature, RapidFort can identify any new components or deficiencies found within containers and associated vulnerabilities. This results in organizations having the most accurate view of their SBOMs, specifically the components used in their containers and the actionable risk metrics based on current information.

RapidFort's SBOM Warehouse is just one of the many capabilities that make up its SASM platform, the first of its kind. This platform is designed to identify and remove unused components without altering the software's behavior, resulting in smaller, more performant and secure software. Its flagship runtime toolset, RapidFort Runtime, takes an active role in scanning, profiling, monitoring, and securing containers in production environments, pinpointing the vulnerabilities within applications' execution paths. This comprehensive approach enables teams to protect their infrastructure by automatically removing unused components and unnecessary vulnerabilities, and reducing software attack surfaces by an impressive 60-90%.

Large portions of the SBOM Warehouse were developed in partnership with and financed by SpaceWERX. SpaceWERX is the innovation arm of the United States Space Force and blends the best of commercial innovation with the needs of United States Space Guardians. The enterprise version is available on RapidFort’s website, while the Department of Defense version is available for download at USAF PlatformOne Ironbank.

To learn more about RapidFort and the SBOM Warehouse capability, please visit https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure cloud development. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort adds compliance capability to help government and commercial organizations benchmark container images against the STIG framework.

RapidFort Enhances SASM Platform with Cutting-Edge STIG Compliance Toolset

New features will help government and commercial companies more easily achieve and maintain compliance with common industry benchmarks

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), has added a new compliance capability to its platform to help both government and commercial organizations benchmark their container images against the Security Technical Information Guide (STIG) framework. In thirty seconds or less RapidFort scans for and identifies configuration errors and vulnerabilities in code, generating an executable script and automatically remediating identified risks.

Compliance plays a critical role in regulated industries like fintech, healthcare, and critical infrastructure, and RapidFort customers now have access to tools that will help them identify, achieve, and maintain compliance with their necessary industry standards. Government organizations that work with the Department of Defense (DoD) must comply with STIG configuration standards for device hardware and software that help safeguard the DoD’s IT network and systems.

“Compliance benchmarking is essential for businesses within regulated industries as well as companies using containers with intellectual property or customer data,” said Mehran Farimani, CEO of RapidFort. “With regulatory requirements only growing, we recognize the challenge this can present to security and development teams, so we wanted to give our customers an easier way to achieve their compliance requirements. Our simple and easy-to-use tool can now quickly benchmark their containers, and automatically address any vulnerabilities within the code, reducing manual code changes and compliance headaches.”

The compliance features are built into RapidFort’s innovative SASM platform, designed to identify and remove unused components without altering the software's behavior, resulting in smaller, more performant and secure software. RapidFort’s flagship runtime toolset, RapidFort Runtime, scans, profiles, monitors, and secures containers in production environments, pinpointing vulnerabilities within applications' execution paths. This comprehensive approach enables teams to protect their infrastructure and maintain compliance by automatically removing unused components and undetected vulnerabilities, reducing software attack surfaces by more than 80%.

Large portions of the STIG Toolset were developed through contracts with SpaceWERX. SpaceWERX is the innovation arm of the United States Space Force and blends the best of commercial innovation with the needs of United States Space Guardians. The enterprise version is available on RapidFort’s website, while the Department of Defense version is available for download at USAF PlatformOne Ironbank.

For more information about RapidFort’s new compliance tool, visit https://www.rapidfort.com.

The views expressed are those of the author and do not necessarily reflect the official policy or position of the Department of the Air Force, the Department of Defense, or the U.S. government.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

About SpaceWERX

As the innovation arm of the U.S. Space Force and a unique division within AFWERX, SpaceWERX inspires and empowers collaboration with innovators to accelerate capabilities and shape our future in space. Headquartered in Los Angeles, SpaceWERX employs 40 military, civilian and contractor personnel executing an annual $457 million budget. Additionally, SpaceWERX partners with Space Systems Command's Commercial Space Office (COMSO) as a collaborative program. Since it was aligned under AFRL in Aug. 2021, SpaceWERX has executed 1106 contracts worth more than $897 million to strengthen the U.S. defense industrial base and drive faster technology transition to operational capability. For more information, visit spacewerx.us.

‍

RapidFort launches GitHub repository with pre-hardened open-source images, offering developers free, secure, efficient, & reliable container solutions

RapidFort Launches Free Pre-Hardened Images on GitHub

Repository will strengthen containerized open-source software for developer community

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), has launched their GitHub repository with hundreds of prehardened open-source images. This initiative offers developers free, secure, efficient, and reliable container solutions, transforming the DevSecOps landscape with over 1.85 million unique downloads from developers to date.

Open-source containers, while powerful and widely used, are often bloated with unnecessary code and hundreds of vulnerabilities, shifting the burden of remediation to developers and increasing the risk of insecure software. In a survey conducted by RapidFort, 73% of people said their organizations spend between 11 and 30 hours each week remediating CVEs. RapidFort is addressing this challenge head-on with their free pre-hardened images, giving developers a weekly updated catalog of slimmer, faster, less resource-intensive images, letting developers focus on what developers do best, building. This community-focused initiative provides cost-saving benefits and more efficient infrastructure, allowing developers to focus on innovation rather than vulnerability management, ultimately accelerating development cycles and enhancing their security posture.

“We believe that security should be accessible to everyone, regardless of the size of their organization or the resources they have,” said Mehran Farimani, CEO of RapidFort. “By offering these pre-hardened community images for free, we are not only helping developers save time and resources but also contributing to a safer, more secure digital ecosystem. It's our way of giving back to the open-source community that has given us so much.”

These images are hardened through RapidFort’s innovative SASM platform, with rebuilds to the repository each time a new image is released. RapidFort’s flagship runtime toolset, RapidFort Runtime allows container images to be scanned, profiled, monitored, and secured in a production environment. Its ability to pinpoint vulnerabilities within the execution path results in the automatic removal of unused components and unnecessary vulnerabilities, reducing software attack surfaces by an impressive 60-90%.

To access RapidFort’s hardened community images, please visit: https://github.com/rapidfort/community-images.

To connect with talented engineers worldwide and stay updated on the company's latest developments, join RapidFort's Slack community at: https://www.rapidfort.com/resources/community-center.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort launches Curated Images, offering a secure foundation for software development and deployment as well as accelerated FedRAMP authorization.

RapidFort Curated Images Help Organizations Achieve Zero CVEs

Curated container images provide a secure foundation for software development and accelerated FedRAMP authorization

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), has launched RapidFort Curated Images, helping organizations quickly reach near-zero common vulnerabilities and exposures (CVEs) within their software. Meticulously patched to reduce the number of total vulnerabilities, RapidFort Curated Images offer a secure foundation for software development and deployment, featuring daily rebuilds, FIPS readiness and accelerating FedRAMP compliance and saving enterprise development resources.

RapidFort Curated images is the first of a three step process leveraging the RapidFort Platform to remediate up to 95% of all CVEs across the application development process. RapidFort's secure container image repository includes three categories of curated images, available in both FIPS and non-FIPS versions: base images, framework images and third-party open-source images. All images are STIG-compliant, hardened and patched, and include RapidFort’s unique analysis providing contextual “Justification Advisory” to weed out real vs. false positive CVEs. The repository is updated several times per week and whenever a new patch for a known CVE is released. Historical versions of these images are retained for 6 months after they reach end-of-life, ensuring continued access. Unlike first generation near zero CVE image vendors in the market, RapidFort does not force customers to re-baseline to a proprietary operating system with no real community support. RapidFort images are based on the most mature and popular Linux distributions: Ubuntu, Red Hat, and Alpine to minimize the impact and ensure compatibility with our end customer’s existing software builds.

Organizations can significantly reduce costs and resource allocation dedicated to vulnerability management with RapidFort Curated Images. The need for a dedicated team of engineers to research and patch images is eliminated, reducing costs to a tenth. When combined with RapidFort’s SASM platform, users can remediate the majority of their software vulnerabilities automatically and early in the development cycle. When leveraging Rapidfort’s Platform, users can expect:

• Up to a 10% reduction in development cycle time for patching unused components
• An 88% reduction in software attack surface
• A 2-3 week reduction in code release time for every major release
• A 1-3% infrastructure cost savings from smaller size images
• Up to 11x faster container boot time

“Software vulnerabilities are a perpetual challenge for developers, creating a relentless cycle of patching that can leave organizations vulnerable. Compliance regulations, like FedRAMP, DSS, PCI and public companies facing breach notification mandates, add another layer of complexity to this problem,” said Mehran Farimani, CEO of RapidFort. “Our new curated images offering is a game-changer for organizations striving to enhance their security posture while maintaining operational efficiency. By providing a secure, meticulously patched foundation for software development, we empower our clients to achieve near-zero CVEs and navigate the complexities of compliance with ease.”

RapidFort offers an end-to-end solution for CVE remediation, addressing all three lifecycle steps: starting with curated images, instrumenting and profiling, and hardening and monitoring. Unlike other offerings that rely on third parties and additional tools, RapidFort provides a comprehensive platform that manages the entire remediation process, from images to production. This unique capability positions RapidFort as a leader in the market, delivering unparalleled security and compliance solutions, as exemplified by the company’s inclusion in SpaceWERX’s Innovate to Accelerate cohort.

To learn more about RapidFort Curated Images, please visit: https://hub.rapidfort.com

For more information about the RapidFort platform, please visit: https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort names George Manuelian as Chief Strategy and Revenue Officer to accelerate market expansion and adoption of its cybersecurity platform.

RapidFort Appoints Industry Veteran George Manuelian as Chief Strategy and Revenue Officer

Curated container images provide a secure foundation for software development and accelerated FedRAMP authorization

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), today announced the appointment of George Manuelian as Chief Strategy and Revenue Officer (CRO). With a proven track record of scaling high-growth technology companies, Manuelian brings nearly three decades of experience in the cybersecurity, cloud, and networking industries to his new role.

Prior to joining RapidFort, Manuelian held a pivotal position as Vice President of Worldwide SASE GTM (Go-to-Market) at Palo Alto Networks, where he led the business to impressive revenue growth exceeding $1.2 billion. Before his tenure at Palo Alto Networks, Manuelian was instrumental in building several key software partnerships at Amazon Web Services, fostering strategic alliances and expanding market reach. Following his role at AWS, Manuelian served as VP of Sales Engineering at Versa Networks, where he successfully grew the business to over $100 million ARR. His instrumental role in driving sales strategy and execution contributed significantly to Versa Networks' rapid expansion. Prior to Versa Networks, Manuelian held leadership roles at Cisco for over 20 years, where he spearheaded innovation in mobile and cloud services.

“George's deep understanding of the cybersecurity landscape, coupled with his exceptional leadership abilities, make him an invaluable asset to RapidFort,” said Mehran Farimani, CEO of RapidFort. “His proven success in scaling high-growth companies aligns perfectly with our ambitious growth plans. We are confident that George’s expertise will be instrumental in accelerating our market expansion and delivering exceptional value to our customers.”

“I am thrilled to join RapidFort at this pivotal stage of its growth journey,” said Manuelian. “The company’s innovative cybersecurity platform has the potential to revolutionize the way organizations approach software security. I look forward to leveraging my experience to drive strategic partnerships, expand market reach, and contribute to RapidFort’s continued success.”

RapidFort is a cybersecurity platform that revolutionizes software development by streamlining vulnerability remediation. The platform empowers developers to secure applications effortlessly in just three steps: Curated base image, container instrumentation and profiling, and ongoing hardening and monitoring. By automating vulnerability remediation, RapidFort offers customers a near zero CVE foundation for their base, framework and 3rd party application open source software. This innovative approach delivers substantial cost savings, including a 10% reduction in software development expenses, a 2-3 week decrease in time-to-market for major releases, and a 3% decrease in infrastructure costs. Ultimately, RapidFort dramatically lowers the overall cost of securing software while ensuring compliance with industry standards.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort names Ben de Waal as VP of Research & Development to ensure next generation products meet the demands of security & development teams.

RapidFort Appoints Proven Leader Ben de Waal as Vice President of Research and Development

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), today announced the appointment of Ben de Waal as Vice President of Research and Development. De Waal joins RapidFort as a highly skilled engineer and entrepreneur with more than 65 patents to his name and a proven track record of leading and growing teams in both large organizations and startups.

At RapidFort, de Waal will be responsible for next-generation product development, focusing on enhancing RapidFort’s offerings to meet the evolving demands of security and development teams. Prior to joining RapidFort, de Waal held various senior roles at technology companies, most notably serving as Vice President of GPU Software at NVIDIA. There he led the development of GPU and CUDA products and worked closely with industry partners to help shape the direction of modern GPU technology, significantly improving graphics processing performance for both consumer and enterprise markets.

After his time at NVIDIA, de Waal co-founded IonGrid, where he served as CTO and developed a secure platform for remote document access. His work addressed the critical security challenges of “Bring Your Own Device” (BYOD) policies, which led to IonGrid’s acquisition by NetApp in 2013. Later, as Founding CTO of HintMD, de Waal created an innovative FinTech platform tailored to the medical aesthetics industry, streamlining client-provider interactions and facilitating HintMD’s acquisition by Revance Therapeutics in 2020.

“We’re working to develop our next-generation capabilities at RapidFort, and Ben is exactly the leader we need to make this vision a reality,” said Russ Andersson, Chief Operating Officer of RapidFort. “His unique blend of technical expertise, strategic insight, and entrepreneurial spirit makes him an exceptional fit for this role, and we’re thrilled for him to lead the projects that will shape our future.”

RapidFort is a cybersecurity platform revolutionizing software development through streamlining vulnerability remediation. The platform empowers developers to secure applications effortlessly in three steps with: Curated base images, container instrumentation and profiling, and continual hardening and monitoring. By automating vulnerability remediation, RapidFort offers customers a near zero CVE foundation for their base, framework and 3rd party application open-source software. This innovative approach delivers substantial cost savings, including a 10% reduction in software development expenses, a 2-3 week decrease in time-to-market for major releases, and a 3% decrease in infrastructure costs. Ultimately, RapidFort dramatically lowers the overall cost of securing software while ensuring compliance with industry standards like NIST Zero Trust, DoD requirements, FedRAMP and SOC 2.

“I’m thrilled to be joining RapidFort at this inflection point in the company’s journey,” said de Waal. “I’ve always felt security should be an integral part of the development process, not an afterthought, and at RapidFort they’re making that happen. I’m looking forward to working with this talented team to enhance our solutions and make securing software easier and more accessible.”

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort's SASM platform & curated images available in AWS Marketplace, offering enhanced security, compliance, cost savings, & more to AWS users.

RapidFort Now Available in AWS Marketplace

Inclusion in the marketplace enhances availability of the industry’s premier attack surface management solution

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), is now available in AWS Marketplace, a tailored online marketplace enabling businesses of all sizes to discover, evaluate, purchase, implement, and manage solutions from AWS Partners. Customers now have greater access to the latest and powerful RapidFort SASM platform and curated near zero CVE images, which remove up to 95% of vulnerabilities with no code changes in the CI/CD pipeline.

RapidFort’s solution will be the first of its kind available within the AWS ecosystem and can be purchased directly through private offering and special pricing, meeting AWS spending obligations. By participating in AWS Marketplace RapidFort offers customers within the ecosystem unique benefits like simplified billing, cost savings, streamlined compliance, simple procurement, reduced risk and faster tool deployment. While most SASM solutions target specific stages of the software development lifecycle and cybersecurity, RapidFort stands out as the only proven end-to-end vulnerability management solution which includes curated zero-CVE images trusted by the DOD.

“We're excited to officially join the AWS Partner Network, offering AWS customers a comprehensive software vulnerability management solution that accelerates SOC-2 and FedRAMP compliance. Our solution accelerates AWS production deployments by at least three months,” said George Manuelian, CRO, Chief Strategy & Revenue Officer at RapidFort. “This partnership will empower more organizations to seamlessly secure their software infrastructure, and significantly reduce their attack surface meeting FedRAMP and NIS-2 software hardening requirements. We look forward to expanding our reach and continuing to deliver innovative solutions that fortify software security at scale.”

RapidFort's impact on the open-source community is significant. It has thousands of free hardened container images, over 6 million downloads, and more than 1.6 million active users, highlighting the critical need for its vulnerability remediation solution. As part of the AWS Marketplace, RapidFort provides a comprehensive and proven solution to AWS ecosystem customers globally.

RapidFort's innovative approach helps organizations remediate up to 95% of CVEs across the application development process, reduce their software attack surface by up to 90%, and speed up code release times by more than 3 weeks. This results in at least 10% reduction in software development expenses and a 3% decrease on average in infrastructure costs. RapidFort also accelerates compliance with industry standards like NIST Zero Trust requirements such as FedRAMP, SOC 2, NIS2, PCI, and HIPPA.

To find RapidFort on AWS Marketplace, please visit: https://aws.amazon.com/marketplace/seller-profile?id=a006c02c-541f-4dda-99b5-2706f70d5c11

To learn more about RapidFort, please visit: https://www.rapidfort.com.

About RapidFort

RapidFort is a cloud-native cybersecurity company that provides a platform to optimize and secure modern cloud infrastructures. The company helps organizations monitor and minimize their software attack surface continuously. RapidFort’s free tier and free community images empower development and security teams to improve their security posture and operational efficiency. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort's innovative SASM platform now available on Google Cloud Marketplace.

RapidFort Expedites FedRAMP and SOC 2 Compliance - Now Available on Google Cloud Marketplace

Marketplace listing expands access to the industry's leading software attack surface management solution and near-zero CVE images

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the San Francisco-based cybersecurity startup pioneering Software Attack Surface Management (SASM), is now available in Google Cloud Marketplace, a unified marketplace of Google and partner solutions, designed to help customers easily explore, test, acquire, and deploy products. Organizations now have even greater access to RapidFort’s SASM platform and curated near zero CVE images, that when used together, remove up to 95% of vulnerabilities with no code changes in the CI/CD pipeline.

RapidFort can be purchased directly through private offering and special pricing within Google Cloud Marketplace, meeting any required spending obligations. Customers within the marketplace now have unfettered access to unique benefits such as simplified billing, cost savings, streamlined compliance, simple procurement, reduced risk and faster tool deployment. Most SASM solutions on the market are limited, targeting only specific stages of the software development lifecycle and cybersecurity. RapidFort stands out within the industry as the only proven end-to-end vulnerability management solution that includes curated zero-CVE images trusted by the DOD.

“We’re thrilled to join Google Cloud Marketplace, enabling greater access to RapidForts’ solutions,” said George Manuelian, CRO, Chief Strategy and Revenue Officer at RapidFort. “Our collaboration will allow more organizations to effectively and efficiently secure their software infrastructure, achieve SOC-2 and FedRAMP compliance, and accelerate GCP production deployments. As we grow our market presence, we look forward to continuing our mission of providing innovative solutions that enhance software security for all.”

RapidFort has had a major impact on the open-source community providing thousands of free hardened container images. With over 6 million downloads and more than 1.6 million active users, there's a clear need for RapidFort’s vulnerability remediation solution. RapidFort's innovative approach to SASM helps organizations remediate up to 95% of CVEs across their application development pipeline, reducing their software attack surface by up to 90%, and speeding up code release times by more than 3 weeks. These efficiencies result in a 10% or more reduction in software development expenses and a 3% decrease on average in infrastructure costs. RapidFort also accelerates compliance with industry standards like NIST Zero Trust requirements for FedRAMP, SOC 2, NIS2, PCI, and HIPPA.

To find RapidFort on Google Cloud Market Place, please visit: https://console.cloud.google.com/marketplace/product/rapidfort-public/rapidfort-near-zero-cve-images-and-sasm-platform

To learn more about RapidFort, please visit: https://www.rapidfort.com.

About RapidFort

RapidFort is a cloud-native cybersecurity company that provides a platform to optimize and secure modern cloud infrastructures. The company helps organizations monitor and minimize their software attack surface continuously. RapidFort’s free tier and free community images empower development and security teams to improve their security posture and operational efficiency. Learn more about RapidFort at https://www.rapidfort.com.

Beyond Identity cut FedRAMP costs by 50% and shortened the certification process by 3 months using RapidFort’s platform.

Beyond Identity Accelerates Path to FedRAMP Certification with RapidFort, Slashing Time and Costs

Partnership fast-tracks access to government markets and simplifies compliance

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, has partnered with Beyond Identity, a leading provider of identity and access management solutions, to reduce the time and costs of FedRAMP certification. By working together with RapidFort, Beyond Identity shortened the certification process by three months and cut associated costs by 50%, outperforming alternative approaches and cementing its credibility in the government sector.

"RapidFort was an excellent and comprehensive partner during our FedRAMP journey,” says Borislav Ivanov, Engineering Manager, Site Reliability Engineering at Beyond Identity. “They cut the cost of image hardening and SSDLC efforts by 50%, shaved three months off our overall compliance timeline, and delivered outstanding support every step of the way."

Achieving FedRAMP certification is a crucial and complex process for any organization looking to provide solutions to the federal government, demanding extensive documentation, security testing, and ongoing compliance efforts. Beyond Identity wanted to streamline this process and reduce overall certification costs, all without overburdening its engineering team.

RapidFort played a critical role in helping Beyond Identity earn its certification, while achieving its budgetary and process goals in 3 key ways:

• Simplified the compliance process with pre-hardened, near-zero CVE Curated Images aligned with NIST 800-70, FIPS 140-2, and 140-3 standards, establishing a secure foundation, and cutting through a significant portion of the initial compliance work.
• Streamlined the benchmarking process with their automated scanning tools, ensuring Security Technical Implementation Guide (STIG) hardened applications.
• Automatically generated the necessary compliance documentation, including Plan of Action and Milestones (POAM) and Software Bill of Materials (SBOM), further reducing labor-intensive work.

“Our customers are developing cutting-edge security solutions for both the private and public sectors, so it’s imperative that their offerings are approved for government use as quickly as possible,” said Mehran Farimani, CEO of RapidFort. “We’re proud to be setting the industry standard for FedRAMP certification support, streamlining a traditionally formidable process, and strengthening the infrastructure that helps secure our nation.”

RapidFort, already available through Platform One, Tradewind Marketplace, AWS Marketplace, Microsoft Azure Marketplace, Google Cloud Marketplace, and Carahsoft, provides a reliable and efficient pathway for organizations looking to enter the federal marketplace and drive growth in the government sector. For more information about the RapidFort platform, please visit: https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort will showcase its Software Attack Surface Management platform at RSA 2025, enabling 95% vulnerability remediation with no code changes.

RapidFort to Showcase at RSA Conference 2025

Remediate 95% of vulnerabilities, shrink software attack surfaces up to 90% with no code changes and speed up software releases by 2 - 3 weeks

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, will be exhibiting at RSA 2025.

Meet Face-to-Face:

Visit the company's live demo spotlight at booth #0867, Moscone South Expo., as they highlight their cutting-edge, global software supply chain security solution, the RapidFort Software Attack Surface Management (SASM) platform.

RapidFort is also hosting a series of exclusive networking events to engage with customers, partners, and industry leaders. Space is limited and attendance is by invitation only. Attendees interested in requesting an invitation can visit RapidFort’s Booth (#0867) during RSA or contact us ahead of the event.

• Opening Yachting Day on the Bay | Expert panel discussion on evolving DoD security, Authority to Operate (ATO), and procurement standards (In partnership with the Spades Institute)
• RapidFort Customer Networking Event
• Cloud Meets Wine: A Women & Colleagues Cybersecurity Event (In partnership with Firstboard.io)

“At RSA Conference 2025, we’re excited to demonstrate how RapidFort is transforming vulnerability management, compliance acceleration, and cost reduction, with our end-to-end platform and near-zero CVE images,” said George Manuelian, CRO RapidFort. “Organizations need a proactive, automated approach to securing their environments, and that’s exactly what we deliver.”

The RapidFort Platform

Software vulnerabilities are a constant challenge for developers, creating an ongoing cycle of patching that leaves organizations unnecessarily exposed. At the same time, compliance requirements like FedRAMP, cATO, CMMC, and SOC 2 add operational and financial overhead, especially for government and defense. To achieve compliance and effectively secure software, businesses need a proactive, scalable approach to vulnerability management that reduces risks without adding unnecessary complexity. Specifically designed to secure modern software infrastructure, RapidFort’s Software Attack Surface Management (SASM) platform automatically remediates 95% of vulnerabilities, streamlines compliance efforts, and speeds up software releases by 2 - 3 weeks, all while reducing the overall cost of securing software by 10%. RapidFort provides an end-to-end solution that empowers organizations to secure their software supply chain and developers to secure applications effortlessly in three steps with curated images, instrumenting and profiling, and continual hardening and monitoring.

At the core of RapidFort’s platform are thousands of curated Near-Zero CVE images. Meticulously patched to reduce the number of total vulnerabilities, RapidFort’s curated images feature daily rebuilds, FIPS readiness and FedRAMP acceleration, providing unmatched savings on enterprise development resources. Trusted by the U.S. Department of Defense (DoD) and IronBank, they provide organizations with a secure foundation to build and deploy applications. Combined with automated vulnerability remediation, the platform can shrink software attack surfaces up to 90% with no code changes. Unlike traditional vulnerability management tools, RapidFort integrates effortlessly into your existing CI/CD pipelines, requiring minimal adjustments, leveraging community-supported operating systems, and avoiding vendor lock-in. Ultimately, RapidFort dramatically lowers the overall cost of securing software while ensuring compliance with industry standards like NIST Zero Trust, DoD requirements, FedRAMP, CMMC, FIPS, CIS/STIG and SOC 2.

Upcoming

Following RSA, RapidFort will be at FeinDef 2025, booth 6A08, from May 12th-14th in Madrid, a premier European defense event where the team will demonstrate how European organizations can fast-track compliance for the European market. Additionally, RapidFort will participate in CMMC Day 2025 on May 5th, in College Park, MD, reinforcing RapidFort’s commitment to helping organizations streamline compliance in the U.S.

For more information about the RapidFort platform, please visit: https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort, the fastest growing cybersecurity company securing the global software supply chain, exhibiting at FeinDef 2025.

RapidFort to Showcase at FeinDef 2025

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, will be exhibiting at FeinDef 2025 in Madrid, Spain.

Meet At FeinDef:

Attendees can visit the company at booth 6A08 to see how their platform is securing supply chains across the globe by remediating up to 95% of vulnerabilities and shrinking software attack surfaces by as much as 90% with no code changes.

RapidFort is participating in AFCEA TechNet Augusta, CrowdStrike fal.con, Billington CyberSecurity Summit 2026, and DevOpsDays Dallas later this quarter.

Already trusted by the U.S. Department of Defense (DoD), IronBank, P1 Marketplace and Carahsoft, RapidFort has a proven track record of helping government agencies and contractors secure their software infrastructure, streamline compliance efforts, and accelerate the deployment of critical solutions. RapidFort provides the most efficient pathway for organizations looking to enter the federal marketplace and drive growth in the government sector by fast-tracking compliance processes like FedRAMP by months, slashing developer workloads by 30%, and speeding up software releases by 2-3 weeks.

“Our work with U.S. government agencies and federal contractors has demonstrated how organizations can secure their software and achieve compliance requirements quicker than ever before by leveraging RapidFort,” said George Manuelian, CRO RapidFort. “Our platform helps organizations reduce the burden of compliance processes felt by development and security teams. As we continue to expand globally, we’re helping organizations expedite certification, harden their software, and streamline their path to operational readiness.”

The RapidFort Platform

Developers are in a constant battle against software vulnerabilities, often caught in endless patch cycles, increasing organizational risk. At the same time, compliance frameworks like FedRAMP, FIPS 140-3, cATO, CMMC, and SOC 2 place financial and operational burdens on government agencies and the defense sector. To meet these demands and secure their software effectively, organizations need a proactive, streamlined approach to vulnerability management that strengthens software security without introducing unnecessary roadblocks.

Designed to secure modern software infrastructure, RapidFort’s Software Attack Surface Management (SASM) platform automatically remediates most vulnerabilities, streamlines compliance efforts, and speeds up software releases while reducing the overall cost of securing software by 10%. In just three steps—curated images, instrumenting and profiling, and continual hardening and monitoring—RapidFort provides a comprehensive solution that enables organizations to protect their software supply chain and developers to more easily build secure applications.

At the core of RapidFort’s platform are thousands of curated Near-Zero CVE images. Meticulously patched to reduce the number of total vulnerabilities, RapidFort’s curated images feature daily rebuilds, providing unmatched savings on enterprise resources and a secure foundation to build and deploy applications. Combined with automated vulnerability remediation, the platform drastically reduces attack surfaces. Unlike traditional vulnerability management tools, RapidFort integrates effortlessly into your existing CI/CD pipelines, requiring minimal adjustments, leveraging community-supported operating systems, and avoiding vendor lock-in. Ultimately, RapidFort dramatically lowers the overall cost of securing software while ensuring compliance with industry standards like NIST Zero Trust, DoD requirements, CIS/STIG and more.

For more information about the RapidFort platform, please visit: https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

Congratulations to Sandfly Security and Senteon for joining Dropzone AI and RapidFort as finalists in the 2025 CyberShark Pitch Competition.

CyberShark Pitch Competition Names Finalists from Second Round of 2025 Event Series

While on site at Black Hat, a panel of CISO judges evaluated pitches from emerging cybersecurity companies – congratulations to finalists Sandfly Security and Senteon

BALTIMORE--(BUSINESS WIRE)--LaunchTech Communications, a CyberRisk Alliance (CRA) resource specializing in PR and AR services for the cybersecurity industry, today announced the next two finalists to advance in the 2025 CyberShark Pitch Competition.

RSA Conference marked the launch of the 2025 program, where Dropzone AI and RapidFort advanced as finalists. Building on that momentum, Black Hat provided the stage for the next round of pitches, further expanding the pool of innovative companies advancing toward the final competition.

Sandfly & Senteon will advance to the final round of the competition, scheduled for October 16, where they will compete head-to-head with Dropzone AI & RapidFort in a live virtual broadcast. All members of CyberRisk Collaborative will be invited to judge.

2025 CyberShark Pitch Competition “Round 2” Finalists (Black Hat 2025):

• Sandfly Security: Agentless Endpoint Detection and Response (EDR) for Linux.
• Senteon: Continuous configuration remediation and enforcement for workstations, servers, and browsers that delivers audit ready endpoint compliance.

Other strong competitors in this round included Mimic, Bytewhisper, and Stream Security, who impressed judges with innovative approaches and advanced capabilities.

The CISO judges represented a range of industries, including technology infrastructure, financial and investment services, healthcare and pharmaceuticals, and retail and grocery. They voted to determine which presentation conveyed the most distinct value proposition and clear messaging.

Just as RSA set the tone for this year’s CyberShark series by identifying the first set of standout solutions, Black Hat reinforced the competition’s role as a proving ground for cutting-edge startups – highlighting the diverse ways innovators are tackling today’s cybersecurity challenges.

"The CyberShark Pitch Competition gives early-growth cybersecurity vendors a unique opportunity to validate their solutions in front of decision makers, while receiving candid, actionable feedback on their messaging, positioning, and product-market fit,” said Wayne Schepens, Chief Cyber Market Analyst at CyberRisk Alliance. “What makes this program so valuable is the collaborative spirit – our judges not only bring their deep expertise, but also an enthusiasm to engage in a supportive, low-pressure environment. The result is a win-win: vendors gain champions, grow relationships, refine their go-to-market strategy, and test their solutions against peers, while CISOs gain early insight into innovations that could shape the future of the industry."

Sandfly and Senteon will advance to the final round of the competition, scheduled for October 16, 2025, where they will compete head-to-head with Dropzone AI and RapidFort in a live virtual broadcast. All 3,000+ members of CyberRisk Collaborative will be invited to participate as judges in the final round.

For more information about LaunchTech Communications, visit https://golaunchtech.com.

About CyberRisk Alliance (CRA)

CyberRisk Alliance provides business intelligence that helps the cybersecurity ecosystem connect, share knowledge, accelerate careers, and make smarter and faster decisions. Through our trusted information brands, network of experts, and more than 250 innovative annual events we provide cybersecurity professionals with actionable insights and act as a powerful extension of cybersecurity marketing teams. Our brands include SC Media, the Official Cybersecurity Summits, Security Weekly, InfoSec World, Identiverse, CyberRisk Collaborative, ChannelE2E, MSSP Alert, LaunchTech Communications, TECHEXPO Top Secret and CyberRisk TV. Learn more at www.cyberriskalliance.com.

The Modern Data Company enhances security and accelerates compliance with RapidFort's platform and curated images.

The Modern Data Company Selects RapidFort’s Curated Images and Platform to Enhance and Accelerate Customer Data Security

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced that The Modern Data Company, a pioneer in data products that radically simplify how enterprises activate their data, has chosen the RapidFort platform and curated images to enhance and accelerate its customer data security deployments across its environments.

With a mission to deliver reliable and scalable solutions for its customers, Modern identified the need for a security partner capable of reducing software vulnerabilities at the source. By adopting RapidFort’s curated images, Modern ensures its development teams and customers benefit from optimized, hardened containers with minimized attack surfaces, enhancing security and accelerating compliance across cloud and hybrid environments.

“Security is critical to the trust we build with our customers,” said Saurabh Gupta, Chief Strategy and Revenue Officer at The Modern Data Company. “RapidFort gives us a faster, more reliable way to enhance and accelerate secure deployments, empowering us to deliver safe, compliant, and resilient solutions, establishing trust from the start.”

RapidFort’s AI-powered platform offers Modern:

• Curated Hardened Images: Continuously optimized, near-zero CVE images to enhance security posture from the start.
• Automated Vulnerability Management: Real-time visibility and remediation to accelerate compliance with standards such as FedRAMP and CMMC.
• Accelerated Time-to-Secure Deployment: Security embedded by default, enabling quick delivery of data-driven solutions to customers.

“There’s a growing demand for secure-by-design approaches to software deployment as security and compliance regulations evolve,” said Mehran Farimani, CEO of RapidFort. “We’re proud to partner with Modern to provide solutions that enhance and accelerate security while reducing vulnerabilities at scale.”

This partnership underscores a shared commitment between Modern and RapidFort to advance data security, compliance readiness, and customer trust. Schedule a call to learn more about how you can become a RapidFort partner.

About The Modern Data Company

The Modern Data Company is revolutionizing how businesses use data as a strategic asset. Its flagship platform, DataOS, is a cloud-native solution that solves complex data challenges 90% faster than traditional methods, at substantial cost savings. DataOS simplifies the entire data product lifecycle—from creation to deployment and maintenance—while uniquely supporting AI/ML era demands, including LLM and GenAI use cases, beyond conventional architectures. This empowers businesses to democratize data access for true self-service, accelerate time-to-market for data initiatives, and unlock data's full potential across the organization. By bringing software best practices to the data world, Modern is transforming data management with a focus on business outcomes. For more information visit: www.themoderndatacompany.com.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with curated near-zero CVE images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort Analyzer has achieved the Red Hat Vulnerability Scanner Certification, validating compatibility, reliability, and performance.

RapidFort Achieves Red Hat Certification, Strengthening Security for Enterprise Container Workloads

Certification validates accuracy, interoperability, and performance across Red Hat environments

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced that RapidFort Analyzer has achieved the Red Hat Vulnerability Scanner Certification, validating its compatibility, reliability, and performance across Red Hat platforms. This milestone underscores RapidFort’s commitment to delivering secure, high-performance container analysis and vulnerability management for enterprise workloads across Red Hat environments. Customers now gain increased confidence that their Red Hat–based container images are analyzed with exceptional precision, speed, and depth. This certification ensures seamless integration with Red Hat ecosystems, enabling organizations to trust that vulnerability scan results are accurate, reliable, and aligned with Red Hat’s rigorous quality standards.

As enterprises face an unprecedented surge in software vulnerabilities and supply chain risks, the challenge is more than operational, it’s systemic. According to the WEF Global Cybersecurity Outlook 2025, more than half of large organizations identify supply chain interdependencies as the top barrier to achieving cyber resilience, highlighting how hidden vulnerabilities in third-party software and vendors can ripple across entire ecosystems. Customers now benefit from RapidFort’s ability to eliminate noise from false positives, deliver research-backed vulnerability insights, and generate comprehensive SBOMs that improve software supply chain transparency. Combined with its ability to scan registries and Kubernetes clusters at scale, organizations can rapidly surface real risks, prioritize what truly matters, and strengthen compliance and security posture across their cloud-native environments, all while reducing operational overhead and accelerating secure software delivery.

The certification also demonstrates that RapidFort Analyzer seamlessly integrates with Red Hat platforms, leveraging Red Hat’s authoritative security data to accurately identify affected components, apply Red Hat–specific severity ratings, and exclude vulnerabilities that are not applicable or have already been resolved through backported fixes. This reduces false positives and enables teams to focus on actionable security findings.

“Developers are asked to do more than ever, and they need clear, reliable information so they can focus on the work that matters,” said Rajeev Thakur, CTO and Co-Founder of RapidFort. “As developers ourselves, the goal is to give teams accurate results they can trust, so they can move quickly and build with confidence. This certification reinforces that commitment and ensures we’re meeting the standards Red Hat teams depend on.”

Unlike other scanners, RapidFort Analyzer’s deep binary-level visibility and alignment with Red Hat security practices help organizations strengthen their security posture, reduce noise, and accelerate remediation across their containerized environments. For more information on RapidFort’s Analyzer, please visit: https://www.rapidfort.com/blog/inside-rapidfort-analyzer-precision-vulnerability-intelligence-for-containers.

For additional details on the Red Hat Vulnerability Scanner Certification, view Red Hat’s official listing here: https://catalog.redhat.com/en/software/vulnerability-scanner/detail/297217.

About RapidFort

RapidFort delivers a modern software supply chain security platform built to help organizations ship safer software with less overhead. Its curated near-zero-CVE container images, automated vulnerability remediation, runtime intelligence, and built-in hardening tools reduce noise, shrink attack surfaces, and keep applications secure from build to production.

With a free tier and community-maintained images, RapidFort makes secure development accessible to teams of any size. Learn more at rapidfort.com.

Kimia provides an actively maintained alternative to Kaniko, enabling secure, verifiable, and compliant container builds.

RapidFort Introduces Kimia Open Source Project

New container build platform replaces Kaniko with enterprise-grade security, 100% backward compatibility, and 90% attack surface reduction

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced the release of the Kimia open source project, a next-generation, daemon-less container build system, developed in collaboration with SOSi. Kimia is the natural successor to Kaniko—which is no longer maintained—and delivers 100% backward compatibility for Kaniko users while dramatically improving performance and security.

As organizations look for a secure, actively maintained alternative to Kaniko, Kimia steps in to fill the gap. Building on Kaniko’s innovation of removing Docker daemon dependencies, Kimia adds enterprise-grade security features and complete Dockerfile support. While maintaining Kaniko’s ease of use, Kimia introduces true rootless operation, and real-time Software Bill of Material (SBOM) generation, giving teams a secure, compliant, and efficient build pipeline for modern cloud environments. By running entirely as a non-root process and using minimal Linux capabilities (SETUID and SETGID), Kimia provides complete privilege isolation through user namespaces and is fully compliant with Kubernetes Pod Security Standards “Restricted” policy.

“Kaniko solves a critical challenge for developers, building containers securely without privileged mode,” said George Manuelian, Chief Strategist at RapidFort. “With Kimia, we take that foundation further by embedding attestation, signing, and continuous validation directly into the build process, transforming container builds into verifiable, supply chain–secure operations.”

Key highlights of Kimia include:

• Drop in replacement for Kaniko
• Reproducible builds: Ensures consistent, bit-for-bit identical outputs
• Image Signing: Cryptographic signatures for verification
• Attestation (SBOM & Provenance)
  SBOM: Lists all software components in the image
  Provenance: Documents how/when/where the image was built

“Collaborating on Kimia reinforces our commitment to advancing secure, modern software delivery,” said Kyle Fox, Chief Technology Officer at SOSi. “Kimia gives our teams — and the customers we serve — a hardened, fully verifiable build process with strong attestation that finally closes long-standing gaps in supply-chain security. It offers a seamless path forward for organizations that need both speed and compliance.”

Kimia is available immediately for download from ghcr.io, and organizations currently using Kaniko can migrate within minutes using existing configurations. For detailed migration guides, documentation, and deployment examples, visit https://us01.rapidfort.com/docs/smithy or the project’s GitHub repository at https://github.com/rapidfort/kimia.

About RapidFort

RapidFort delivers a modern software supply chain security platform built to help organizations ship safer software with less overhead. Its curated near-zero-CVE container images, automated vulnerability remediation, runtime intelligence, and built-in hardening tools reduce noise, shrink attack surfaces, and keep applications secure from build to production.

With a free tier and community-maintained images, RapidFort makes secure development accessible to teams of any size. Learn more at rapidfort.com.

RapidFort advances software supply chain security, surpasses 100 customers, 15k hardened images, and earns 2025 Gartner Cool Vendor recognition.

RapidFort Strengthens Market Leadership and Gains Industry Recognition: Surpasses 100 Customers, 15,000 Curated, Near-zero CVE hardened images, and inclusion in Gartner® Research

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced major milestones that mark a surge in adoption, positioning the company for accelerated momentum and market expansion in 2026. The company has now exceeded 100 customers worldwide, including 40 that achieved FedRAMP or ATO certification through RapidFort’s platform and curated images. This continued traction underscores RapidFort’s leadership in trusted, compliant software delivery, reflected by a catalog of more than 15,000 Curated, near-zero CVE hardened images. RapidFort was also recognized in the 2025 Gartner® Cool Vendors™ in Container Management report.

“We maintain that our success reflects the trust our customers place in RapidFort to help them move faster and stay secure,” said George Manuelian, Chief Strategy and Sales Officer at RapidFort. “Our mission has always been to make secure software delivery a natural part of how modern teams build. The momentum we’re seeing today is proof that our approach resonates, and that RapidFort is becoming a trusted foundation for building software with confidence.”

Customer Trust Drives RapidFort’s Momentum

RapidFort’s growth is fueled by its ability to help teams build and ship secure software faster while reducing attack surfaces. Through a powerful combination of automated CVE remediation, continuous scanning, intelligent profiling, and automated hardening tools, RapidFort eliminates unnecessary vulnerabilities, streamlines compliance, and accelerates deployment cycles. Customers routinely achieve up to 95% fewer CVEs, reduced exposure across their software supply chain, and simplified audit readiness, all without code changes or pipeline disruption.

Expanding Customer Impact Across Regulated and Enterprise Markets

With over 100 organizations now leveraging RapidFort, the platform has become trusted across defense, federal, and enterprise sectors, with over 40 customers achieving FedRAMP or ATO certification. By automating vulnerability remediation, integrating runtime hardening, and providing Runtime Bill of Materials (RBOM™) visibility, RapidFort empowers teams to meet federal and enterprise standards with unprecedented speed. RapidFort’s customers include organizations such as:

• Defense Unicorns - Used RapidFort to harden and deploy secure software in classified environments, eliminating over 98% of critical and high CVEs and reducing image sizes by a total of 140MB (5.9%).
• ColorTokens - Accelerated federal certification timelines by three months after reducing its attack surface by 77% and cutting their vulnerability backlog.
• Beyond Identity - Reduced compliance costs by 50% while shortening its path to FedRAMP approval by three months.

Expanding the Industry’s Most Comprehensive Hardened Image Catalog

In addition, RapidFort’s 15,000 curated near-zero CVE, hardened images represent the most comprehensive secure image catalog available today. Each image is FIPS 140-3 validated, and STIG/CIS benchmarked, ensuring enterprise-grade compliance from the start. Beyond images, RapidFort provides end-to-end supply chain protection, securing both first and third-party software with RBOM™ insights, runtime monitoring, and automatic workload hardening, all of which is designed to reduce vulnerabilities and strengthen software security across the software development lifecycle.

Industry Recognition and a Look Ahead

RapidFort’s recognition in the 2025 Gartner® Cool Vendors™ in Container Management report comes at a time where software supply chains have become central to national and enterprise resilience. It’s clear to us that, RapidFort is setting the standard for delivering hardened, compliant, and open-source-based software, faster and confidently.

For reference requirements for any listed customers, please email: [email protected]

For more information about the RapidFort platform, please visit: https://www.RapidFort.com.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with curated near-zero CVE images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

‍

RapidFort is the winner of the 2025 CyberShark Pitch Competition, determined by CISO voting in the final round of the event series.

CyberShark Pitch Competition Names RapidFort as 2025 Winner

LaunchTech extends gratitude to the CISOs who served as judges and provided expert insights and guidance throughout the 2025 CyberShark season

BALTIMORE--(BUSINESS WIRE)--LaunchTech Communications, a CyberRisk Alliance (CRA) resource specializing in PR and AR services for the cybersecurity industry, today announced RapidFort as the winner of the 2025 CyberShark Pitch Competition.

The 2025 event series spotlighting innovation and excellence in cybersecurity brought together promising growth-stage companies from across the market landscape, offering them a platform to demonstrate their technology and vision to a panel of CISOs and experienced industry experts.

The 2025 CyberShark Pitch Competition highlighted the innovative strength of cybersecurity vendors and reinforced CyberRisk Alliance’s commitment to advancing collaboration, thought leadership, and technological innovation across the industry.

The 2025 event series spotlighting innovation and excellence in cybersecurity brought together promising growth-stage companies from across the market landscape, offering them a platform to demonstrate their technology and vision to a panel of CISOs and experienced industry experts.

RapidFort emerged as the 2025 winner as a result of presenting a compelling pitch during the final round, held virtually on Oct. 16. The event featured dedicated CISO members of the CyberRisk Collaborative and broader industry who participated as judges to vote for the winner.

Earlier rounds of this year’s CyberShark competition saw strong performances from a diverse field of competitors. At RSA Conference 2025, Dropzone AI, represented by Edward Wu, advanced as a finalist alongside RapidFort. At Black Hat USA 2025, Sandfly Security, represented by Craig Rowland, and Senteon, represented by Henry Zhang, joined the finalist lineup following standout presentations.

“We are honored to be named the winner of the 2025 CyberShark Pitch Competition,” said George Manuelian, Chief Strategy and Sales Officer at RapidFort. “This recognition reinforces our commitment to helping organizations build secure software, faster and with confidence. As security and compliance requirements evolve, it’s clear that integrating security from the start is no longer optional. The CyberShark experience has been incredible, connecting us directly with CISOs, providing valuable insights, and validating our mission to make secure software delivery a natural, continuous part of how modern teams build.”

Wayne Schepens, Chief Cyber Market Analyst at CyberRisk Alliance, added, “The CyberShark Pitch Competition is one of the most exciting projects I’ve had the fortune to lead. CyberShark gives growth-stage cybersecurity vendors a unique opportunity to validate their solutions, while receiving candid, actionable feedback on their messaging, positioning, and product-market fit. What makes this program so valuable is the collaborative spirit; our judges not only bring their deep expertise, but also an enthusiasm to engage in a supportive, low-pressure environment. It's a win-win: vendors gain champions, grow relationships, refine their go-to-market strategy, and test their solutions against peers, while CISOs gain early insight into innovations that could shape the future of the industry.”

The 2025 CyberShark Pitch Competition highlighted the innovative strength of cybersecurity vendors and reinforced CyberRisk Alliance’s commitment to advancing collaboration, thought leadership, and technological innovation across the industry.

If you are an emerging cybersecurity vendor and would like to be considered for a pitch slot in the 2026 CyberShark event series, please submit your self-nomination to [email protected].

For more information about LaunchTech Communications, visit https://golaunchtech.com.

About CyberRisk Alliance (CRA)

CyberRisk Alliance provides business intelligence that helps the cybersecurity ecosystem connect, share knowledge, accelerate careers, and make smarter and faster decisions. Through our trusted information brands, network of experts, and more than 250 innovative annual events we provide cybersecurity professionals with actionable insights and act as a powerful extension of cybersecurity marketing teams. Our brands include SC Media, the Official Cybersecurity Summits, Security Weekly, Identiverse, CyberRisk Collaborative, LaunchTech Communications, Execweb, InfoSec World, ChannelE2E, MSSP Alert, and TECHEXPO Top Secret. Learn more at www.cyberriskalliance.com.

‍

RapidFort and Krumware partner to deliver near-zero CVE images, 60% faster deployments, and streamlined compliance for enterprise container security.

Krumware and RapidFort Partner to Deliver Comprehensive Container Security Solutions with Near-Zero CVE Images

New container build platform replaces Kaniko with enterprise-grade security, 100% backward compatibility, and 90% attack surface reduction

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the leader in end-to-end security for the global software supply chain, today announced a strategic partnership with Krumware, a leading platform engineering and cloud-native application development company, to provide enterprises with secure, optimized container workloads. By combining Krumware’s platform engineering expertise with RapidFort's container hardening technology and AI-powered software security platform, the two companies are addressing the critical security challenges enterprises face deploying containerized applications at scale.

According to the SecurityVulnerability.io database there have been 33,969 vulnerabilities published so far in 2025, a 21% YoY increase when compared to this time in 2024, highlighting common enterprise security challenges like image sprawl, vulnerability management, and upstream supply chain risk. These challenges only represent a portion of the issues modern enterprises face when securing and deploying containerized applications across their environments and underscore the urgency of adopting comprehensive software supply chain security solutions. With RapidFort's curated near-zero CVE Images, DevTime profiling, and RunTime protection, organizations can reduce up to 95% of vulnerabilities and shrink their attack surface by 90%. Complementing this, Krumware’s platform engineering expertise ensures quick, seamless integration and enterprise-wide adoption.

"Modern enterprises need more than just vulnerability scanning; they need proactive security that's built into their development lifecycle," said Colin Griffin, Founder & CEO of Krumware. "Our partnership with RapidFort enables us to deliver hardened, optimized container workloads that dramatically reduce security risk while accelerating time-to-market for our clients' applications."

The integrated solution combines:

• RapidFort's Near-Zero CVE Images: Hardened container images based on trusted LTS Linux distributions like Ubuntu, RHEL, Debian, and Alpine, with no vendor lock-in to proprietary OS.
• Automated Attack Surface Reduction: Automatically secure unused components and shrink your software attack surface by 90% without burdening your development teams.
• Krumware's Implementation Expertise: Industry leading cloud-native application development, Kubernetes deployment strategies, and platform engineering practices.
• Continuous Security Optimization: Runtime protection and DevTime profiling for ongoing security posture improvement.

"Container security can't be an afterthought in today's threat landscape," said Mehran Farimani, CEO of RapidFort. "Our partnership with Krumware ensures that enterprises not only have access to secure container images, but also the engineering expertise and implementation support needed to deploy and maintain truly secure container environments."

The partnership delivers immediate value by accelerating deployment timelines and strengthening enterprise security posture. Early implementations have shown up to 95% fewer vulnerabilities and deployment time improvements of 60% compared to traditional container security approaches. Enterprises also benefit from faster compliance with hardened NIST 800-70 images, FIPS 140-2 validation, and integrated CIS/STIG benchmarks, as well as lower infrastructure costs through smaller, more efficient containers.

The joint solution is immediately available to enterprise customers through both companies' professional services organizations.

For more information about the RapidFort platform, please visit: https://www.RapidFort.com

About Krumware:

Krumware specializes in cloud-native software and platform engineering and provides services, software, and technical resources. By leading with developer advocacy and expertise developed through practice, Krumware helps companies build better software. For more information, visit: https://www.krum.io.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort emerges as the leading replacement for Bitnami helm charts compatible images.

RapidFort the Leading Replacement for Bitnami Helm Charts Compatible Images

RapidFort’s hardened, near-zero CVE, image catalog offers Bitnami compatibility and simple migration, reducing CVEs by up to 100% while helping maintain compliance, strengthen security, and reduce costs

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, emerges as the clear leader in this transition, offering curated near-zero CVE images compatible with Bitnami helm charts, as enterprises seek alternatives to Bitnami’s recently deprecated image registry. With a catalog of Bitnami-compatible, production-grade container images, RapidFort enables organizations to maintain operational continuity while strengthening security and streamlining compliance.

Bitnami’s transition to a subscription-based image catalog has affected more than 500 million image pulls, forcing teams to remediate sudden risks in operational stability, compliance, and security. Many organizations project replacement costs to be between $100,000 and $500,000 annually. RapidFort’s curated images offer a cost-effective replacement that preserves existing workflows while strengthening long-term security and compliance.

RapidFort’s curated images offer a cost-effective replacement that preserves existing workflows while strengthening long-term security and compliance.

“We started RapidFort with the purpose of giving organizations the confidence to scale without sacrificing security,” said Mehran Farimani, CEO of RapidFort. “As the container ecosystem continues to evolve, teams need reliable tools that they can trust. We remain focused on helping teams adapt quickly and securely without compromising the standards they rely on.”

RapidFort’s AI-powered platform analyzes runtime to remove unused components, producing smaller, faster containers with an average ~95% CVE reduction and up to ~80% smaller images; for many popular stacks it eliminates all known vulnerabilities. Each SLSA Level 3, non-root image includes continuous monitoring and hardening, zero-day protection, cryptographic signing, provenance, SBOMs and VEX, and the catalog spans 200+ hardened images across common infrastructure, developer stacks and DevOps tooling.

RapidFort’s runtime scanner integrates with Helm charts, GitOps and Kubernetes operators with no app changes, inventories images to flag safe replacements, and enables validation and rollout in under four weeks with automated tests and blue-green deployment with rollback, supporting no-downtime migration and compliance with SOC 2, PCI DSS and NIST through minimized scope, distroless execution, audit trails and continuous control validation.

To begin your transition, schedule a 30-minute assessment to evaluate current Bitnami image usage and identify compatible RapidFort alternatives. With the help of RapidFort’s team, organizations can develop a customized transition strategy and complete rollout in under four weeks, resulting in long term improvements in security, compliance, and operational efficiency.

For more information about the RapidFort platform, please visit: https://www.RapidFort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

Defense Unicorns achieves near-zero CVEs, delivers FIPS-validated modules, and accelerates secure software deployment using RapidFort’s platform.

Defense Unicorns Accelerates Secure Software Delivery for Defense Missions with RapidFort

Partnership strengthens software security posture and enables faster deployments for defense environments

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, has partnered with Defense Unicorns, a veteran-owned defense tech startup, to scale and strengthen its container infrastructure while accelerating deployment of its secure runtime platform for defense missions, Unicorn Delivery Service (UDS). By leveraging RapidFort’s platform and Curated Near-Zero CVE Images, Defense Unicorns achieved a near-zero CVE state across the UDS platform, accelerated delivery, enhanced compliance, and optimized deployment without the overhead of building internal hardening pipelines.

“RapidFort’s experience within classified environments and collaborative approach has made them a trusted partner in helping us deliver secure, reliable software to the teams who need it most, without slowing down mission-critical deployments,” said Rob Slaughter, CEO of Defense Unicorns. “Their curated images, FIPS-validated modules, and hands-on support enabled our teams to meet compliance requirements effortlessly while accelerating delivery.”

Like many organizations delivering software in classified environments, Defense Unicorns faced the challenge of hardening software containers at scale, without delaying delivery. This prompted them to make a “build vs. buy” decision and, after evaluating multiple options and the current ecosystem of secure container vendors, they selected RapidFort as the most effective partner to meet their operational and security goals.

RapidFort and Defense Unicorns addressed these challenges by:

• Eliminating over 98% of critical and high CVEs in the UDS Core platform compared to upstream images.
• Delivering FIPS-validated modules across all 32 UDS Core images to support deployments in compliance-sensitive environments.
• Reducing image sizes by a total of 140MB (5.9%), accelerating deployment in low-bandwidth and tactical edge environments.
• Providing engineering collaboration to support fast turnaround on FIPS-compliant builds and resolve emerging issues.
• Enabling Defense Unicorns to harden containers for its proprietary products, such as the UDS Registry, an OCI-compliant registry launched in June 2025.

“Security and speed are equally mission-critical in defense environments, but for many companies, achieving both can feel impossible,” said Mehran Farimani, CEO of RapidFort. “By leveraging RapidFort’s platform and Curated Near-Zero CVE Images, Defense Unicorns proved that it’s possible to accelerate the delivery of secure, compliant software, without compromising mission readiness.”

RapidFort, available through Platform One, Tradewind Marketplace, AWS Marketplace, Microsoft Azure Marketplace, Google Cloud Marketplace, Carahsoft, and now Azul provides organizations with a reliable and efficient pathway to secure their software supply chain. For more information about the RapidFort platform, please visit: https://www.rapidfort.com

To get started using UDS with RapidFort’s Curated Near-Zero CVE Images to securely deliver software for national security missions, reach out to Defense Unicorns at [email protected] or https://defenseunicorns.com/contact-us.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

About Defense Unicorns

Defense Unicorns is a veteran-owned defense tech startup founded in 2021 to make software a strategic deterrent for the U.S. Department of Defense. They build innovative technical solutions to securely develop and deploy mission software across cloud, on-premises, and tactical edge environments. ‘Defense Unicorns’ is trusted by the operators of some of the most critical systems in the world, including the U.S. Navy, Army, Air Force, and Space Force. Learn more about Defense Unicorns at https://defenseunicorns.com.

Azul and RapidFort Partner to Deliver Near-Zero CVE Enterprise Grade Java Container Images, Backed by Commercial Java Support

Strategic collaboration aims to dramatically reduce security patching burden and strengthen software supply chain security for enterprise Java customers

SUNNYVALE, Calif. & PALO ALTO, Calif.--(BUSINESS WIRE)--Azul, the only company 100% focused on Java, and RapidFort, the industry leader in software supply chain security, today announced a strategic partnership to deliver near-zero Common Vulnerabilities and Exposures (CVEs) third-party container images backed by Azul’s world-class Java support. This partnership, which combines Azul’s entire commercial Java portfolio, including Azul Platform Core and Azul Platform Prime, with RapidFort Curated Images, will accelerate developer productivity and reduce the burden of security patching while enabling secure software development practices to protect the software supply chain.

The partnership comes at a critical time as organizations face mounting pressure to secure their software supply chains amid escalating cyber threats. According to Verizon’s 2025 Data Breach Investigations Report, the exploitation of vulnerabilities (CVEs) has seen another year of growth and will surpass credential abuse as the #1 security attack vector by 2026. This places an enormous burden on both security and developer teams who must continuously patch and update systems.

Strategic collaboration between Azul and RapidFort aims to dramatically reduce security patching burden and strengthen software supply chain security for enterprise Java customers.

Transforming Container Security

RapidFort and Azul have joined forces to redefine how enterprises secure and run Java workloads in containers. By combining RapidFort’s advanced container optimization technology with Azul’s Platform Core and Platform Prime runtimes for Java 8 and later, organizations can now deploy hardened Java containers with unprecedented efficiency and security. These jointly curated images reduce vulnerabilities by up to 90%, significantly shrinking the attack surface. As a result, development teams benefit from less frequent patching and greater productivity, accelerating innovation without compromising security.

Unlocking Value Across Security, Speed, and Costs

The Azul/RapidFort partnership delivers several significant advantages for enterprise customers, including:

• Reduced Patching Burden: Near-zero CVE container images mean fewer vulnerabilities to patch, allowing security teams to focus on more strategic initiatives.
• Enhanced Supply Chain Security: Hardened container images provide a secure foundation for the entire software development lifecycle.
• Accelerated Development: Developers can build applications faster without compromising security.
• Regulatory Compliance: Compliance is made easier despite increasingly stringent security regulations and frameworks such as NIS2, CMMC and FedRAMP.
• Lower Operational Costs: Maintenance burden and risk of security incidents is dramatically reduced.

”Enterprises are drowning in security vulnerabilities and patches,” said Mehran Farimani, founder and CEO of RapidFort. “Our partnership with Azul allows us to provide customers with hardened container images that are not only more secure by design but require significantly less ongoing maintenance. This is a game-changer for organizations looking to strengthen their security posture while reducing operational overhead.”

“Java remains the backbone of enterprise applications worldwide, and securing the Java ecosystem is critical to protecting the software supply chain,” said Scott Sellers, co-founder and CEO at Azul. “By partnering with RapidFort, we’re enabling organizations to deploy Java applications with confidence, knowing they’re backed by Azul’s world-class support organization and built on a foundation of security-hardened container images with minimal vulnerability exposure.”

Availability

The first set of jointly developed hardened container images is available immediately. These images will include all Java LTS (Long Term Support) releases starting with Java 8, and popular Java applications such as Apache Spark, Apache Kafka and Apache Tomcat. Interested customers can request more information here.

For more information:

• Azul Platform Core
• Azul Platform Prime
• RapidFort Product Overview
• Azul RapidFort Partner Page

About Azul

Headquartered in Sunnyvale, California, Azul provides the Java platform for the modern cloud enterprise. Azul is the only company 100% focused on Java. Millions of Java developers, hundreds of millions of devices and the world’s most highly regarded businesses trust Azul to power their applications with exceptional capabilities, performance, security, value, and success. Azul customers include 36% of the Fortune 100, 50% of Forbes top 10 World’s Most Valuable Brands, all 10 of the world’s top 10 financial trading companies. and leading brands like Avaya, Bazaarvoice, BMW, Deutsche Telekom, LG, Mastercard, Mizuho, Priceline, Salesforce, Software AG, and Workday. Learn more at azul.com and follow us @azulsystems.

About RapidFort

RapidFort is a software supply chain security platform that secures and optimizes modern infrastructure by reducing the attack surface of containerized applications and near-zero CVE, curated base images. Through continuous monitoring and intelligent removal of unnecessary components from container images, RapidFort significantly minimizes vulnerability exposure and patching requirements. This innovative approach enhances security posture, improves operational efficiency, and ensures end-to-end protection across the global software supply chain. The company's innovative approach has been recognized by leading industry analysts and is trusted by Global 2000 companies across finance, healthcare, and government sectors. For more information, visit www.rapidfort.com

RapidFort now available in the P1 Solutions Marketplace, enabling government agencies and contractors to streamline software security and compliance.

RapidFort Assessed “Awardable” for Department of Defense work in the P1 Solutions Marketplace

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM) today announced that it has achieved “Awardable” status through the Platform One (P1) Solutions Marketplace.

The P1 Solutions Marketplace is a digital repository of post-competition, 5-minute long readily awardable pitch videos, which address the Government’s greatest requirements in hardware, software and service solutions. RapidFort’s solutions are designed to help developers significantly reduce the time and cost by at least 50% to achieve cATO and FedRAMP with near Zero CVE Curated Images and a broad set software hardening tools. RapidFort is used by a wide range of businesses, including Beyond Identity, Avalara, and Blue Cycle as well as government agencies such as the U.S. Air Force and Space Force.

“Our inclusion in the P1 Marketplace is a major step forward as we continue to strengthen our relationship with the Department of Defense,” said Mehran Farimani, CEO of RapidFort. “This milestone allows us to better support government agencies and contractors as they secure their software infrastructure, streamline compliance efforts, and accelerate the deployment of critical solutions. We’re excited to continue supporting the defense community with our innovative solutions, enhancing software security for all.”

RapidFort’s video, RapidFort CVE Management Platform with SCA Scanner, Profiler, Automated Image Hardening and Near Zero CVE Image Catalog, accessible only by government customers on the P1 Solutions Marketplace, presents an actual use case in which the company provides a complete software supply chain toolset for containerized workloads that includes image scanner, profiler, hardening tools along with FIPS compliant, STIGed Near Zero CVE Images. RapidFort was recognized among a competitive field of applicants to the P1 Solutions Marketplace whose solutions demonstrated innovation, scalability, and potential impact on DoD missions. Government customers interested in viewing the video solution can create a P1 Solutions Marketplace account at https://p1-marketplace.com.

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

About the P1 Solutions Marketplace:

The P1 Solutions Marketplace is a digital repository of post-competition, readily awardable pitch videos that address the Department of Defense’s (DoD) most significant challenges in hardware, software and service solutions. All awardable solutions have been assessed through complex scoring rubrics and competitive procedures and are available to Government customers with a Marketplace account. Government customers can create an account at https://p1-marketplace.com.

For more information or media requests, contact: [email protected].

Contact RapidFort for additional information.

Congratulations to Dropzone AI and RapidFort, the "Round 1" Finalists in the 2025 CyberShark Pitch Competition

CyberShark Pitch Competition Names Finalists from First Round of 2025 Event Series

While on site at the 2025 RSA Conference, a panel of 10 CISO judges evaluated pitches from emerging cybersecurity companies in search of stand-out solutions – Congratulations to finalists Dropzone AI and RapidFort

BALTIMORE--(BUSINESS WIRE)--Hosted by LaunchTech Communications, a CyberRisk Alliance (CRA) resource specializing in PR and AR services for the cybersecurity industry, the CyberShark Pitch Competition today announced the first two finalists to advance in the 2025 program.

The CyberShark Pitch Competition provides emerging cybersecurity companies with an opportunity to pitch their product and receive feedback from Chief Information Security Officers (CISOs). During the in-person event held the week of RSA Conference, CISO judges from a variety of industries – including insurance, technology, food and beverage, pharmaceutical distribution, manufacturing, financial services, and more – voted to determine which presentation conveyed the most distinct value proposition and clear messaging.

By providing a platform for emerging companies to showcase their innovative solutions, we're not just identifying potential game-changers, we're actively investing in the future of cybersecurity.

“Not only did our exceptional panel of judges generously offer their time and deep cybersecurity expertise, but they also brought an incredibly meaningful level of enthusiasm to engage with the early-stage participants,” said Taylor Hadley, Vice President, LaunchTech Communications. “Their thoughtful post-pitch feedback ensured that each pitching company received immediate, actionable feedback on their messaging, positioning, and product-market fit in a supportive, low-pressure environment.”

Congratulations to the finalists!

2025 CyberShark Pitch Competition “Round 1” Finalists:

• Dropzone AI – Provides pre-trained autonomous AI SOC analysts that work tirelessly alongside human teams.
• RapidFort – Eliminates 95% of software vulnerabilities without code changes through its attack surface management platform and near-zero CVE images.

This round of the pitch event was particularly competitive, with each participating company demonstrating exceptional preparedness and exciting technological advancements. During the judging process, the CISO panel consistently commented on a few key elements of a strong pitch. These included: the value of delivering a clear problem statement, while avoiding FUD (fear, uncertainty and doubt); addressing how the product integrates with other systems and how it fits into the broader cybersecurity landscape; and providing examples of how the product performs in real-world scenarios demonstrates measurable benefits.

"The CyberShark Pitch Competition exemplifies the community spirit of our CISO network," said Dustin Sachs, Chief Technologist and Senior Director of Programs with the CyberRisk Collaborative. "By providing a platform for emerging companies to showcase their innovative solutions, we're not just identifying potential game-changers, we're actively investing in the future of cybersecurity. This program is a win-win; cybersecurity vendors gain invaluable feedback to inform their go to market strategy and exposure to potential word of mouth referrals, and our CISO community gains insight into breakthrough solutions and serve to potentially influence how these companies ultimately meet market needs."

"We established this program to ensure our clients have the opportunity to validate their solutions and interact directly with industry decision makers,” said Wayne Schepens, Chief Cyber Market Analyst of CyberRisk Alliance. "CyberShark allows vendors to gather valuable input, identify champions, validate their messaging and test their solutions against others. For vendors, there is no better test than pitching industry CISOs in a competitive environment; and for buyers there is no better way for them to play a role in the direction of future innovation. We look forward to continuing this initiative while making it available to more and more practitioners and technology producers.”

A second opportunity to pitch CISO judges in person will take place during the week of Black Hat USA 2025, where two more finalists will advance in the CyberShark Pitch Competition. Those finalists, and the finalists from RSA Conference, will go head-to-head in the final round of the competition taking place virtually as part of a live broadcast in the fall of 2025. All 2,000+ members of CyberRisk Collaborative will be invited to participate as judges in the final round. More information about CyberShark can be found here.

For more information about LaunchTech Communications, visit https://golaunchtech.com.

About CyberRisk Alliance (CRA)

CyberRisk Alliance provides business intelligence that helps the cybersecurity ecosystem connect, share knowledge, accelerate careers, and make smarter and faster decisions. Through our trusted information brands, network of experts, and more than 250 innovative annual events we provide cybersecurity professionals with actionable insights and act as a powerful extension of cybersecurity marketing teams. Our brands include SC Media, the Official Cybersecurity Summits, Security Weekly, InfoSec World, Identiverse, CyberRisk Collaborative, ChannelE2E, MSSP Alert, LaunchTech Communications, TECHEXPO Top Secret and CyberRisk TV. Learn more at www.cyberriskalliance.com.

RapidFort optimizes ColorTokens federal compliance efforts and containerized infrastructure security.

ColorTokens Slashes Federal Compliance Timelines and Enhances Container Security with RapidFort

Partnership significantly improved company’s operational efficiency by eliminating critical software vulnerabilities and fast-tracking certification audits by three months

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, the fastest growing cybersecurity company securing the global software supply chain, has partnered with ColorTokens Inc., a pioneer in Zero Trust security and leader in microsegmentation, to strengthen its containerized infrastructure security and optimize its federal compliance efforts. By leveraging RapidFort’s platform, ColorTokens notably reduced its attack surface by 77%, minimizing its security risks and improving security operations.

“RapidFort has measurably strengthened the security of both our cloud‑hosted SaaS platform and our on‑premise product,” said Harish Akali, CTO of ColorTokens, “It’s hardened container images, continuous scanning, and clear remediation guidance have cut our vulnerability backlog and supplied the evidence we needed to fast‑track FedRAMP, IRAP, and other certification audits.”

Like many organizations who enter the federal marketplace, ColorTokens was challenged by diverse third-party base images and complex DevSecOps workflows. The constant need to maintain stringent federal compliance standards, including FIPS and STIG, required a solution that would reduce vulnerabilities without overburdening engineering resources.

RapidFort helped ColorTokens address these challenges by:

• Deploying FIPS and STIG aligned pre-hardened, near-zero CVE images for Ubuntu, Redis, Golang, and Node.js.
• Reducing vulnerabilities through intelligent runtime profiling and automated removal of unused software components, dramatically reducing exposure and cutting down on manual patching efforts.
• Embedding RapidFort’s runtime-aware scanner into CI/CD pipelines, providing continuous visibility, real-time vulnerability insights, and proactive control.
• Accelerating compliance readiness by three months using built-in benchmarking and STIGing tools, simplifying the path to federal certifications like FedRAMP.

“Far too often, organizations must divert critical resources to remediate vulnerabilities and meet compliance requirements, rather than advancing core business priorities,” said Mehran Farimani, CEO of RapidFort. “By leveraging the RapidFort platform to optimize vulnerability management and minimize their security risks, ColorTokens was able to secure their software faster and with less strain on their teams, reducing the burden of meeting stringent federal compliance requirements.”

RapidFort, already available through Platform One, Tradewind Marketplace, AWS Marketplace, Microsoft Azure Marketplace, Google Cloud Marketplace, and Carahsoft, provides a reliable and efficient pathway for organizations looking to enter the federal marketplace and drive growth in the government sector. For more information about the RapidFort platform, please visit: https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

RapidFort adds FIPS 140-3 compliance to Curated Images, providing a secure foundation for software development, deployment, and FedRAMP authorization.

RapidFort Simplifies FedRAMP Certification with Curated Images Supporting FIPS 140-3 Compliance

SAN FRANCISCO--(BUSINESS WIRE)--RapidFort, a leading innovator in cybersecurity pioneering Software Attack Surface Management (SASM), has announced support for FIPS (Federal Information Processing Standards) 140-3 compliance through its industry-first curated images offering. This leading-edge capability enables customers to easily meet the stringent security and compliance requirements of federal agencies and contractors. RapidFort is the first in the industry to achieve this milestone, accelerating the company’s leadership in zero Common Vulnerabilities and Exposure (CVE) images.

Replacing the widely adopted FIPS 140-2 cryptographic standard, FIPS 140-3 introduces enhanced protection against modern threats and aligns with international ISO/IEC (International Organization for Standardization/International Electrotechnical Commission) standards. FIPS 140-3 compliance is critical for organizations in government and regulated markets, securing sensitive data and meeting modern security requirements. A necessary step for companies looking to enter the federal marketplace, RapidFort streamlines FIPS readiness by providing FIPS 140-3 compliance across its entire portfolio of curated images, going beyond any other offering in the market. This ensures federal agencies and contractors can deploy secure and compliant software faster and more efficiently, accelerating time to market and saving enterprise development resources. When leveraging RapidFort’s Curated Images, users can expect:

• Broad community support and no vendor lock-in: RapidFort allows customers to retain access to a wide range of major operating system (OS) distributions like Ubuntu, Red Hat, Alpine, and Debian (both FIPS and non-FIPS), with active community support. This ensures flexibility and cutting-edge functionality without compromise.
• Minimal disruption to existing software pipelines: RapidFort integrates seamlessly into current workflows, allowing users to address vulnerabilities without requiring changes to existing tools or distributions. This reduces risks and avoids the disruptions typically associated with switching to unfamiliar operating systems, frameworks or platforms.
• Cost-effective Enterprise License Agreement (ELA) model for comprehensive use: With a simplified pricing structure, RapidFort provides access to both FIPS and non-FIPS variants, including Bitnami and official-image versions, under a single repository. This unified model offers significant cost savings compared to competitors that charge separately for each variant, making it ideal for both Federal Risk and Authorization Management Program (FedRAMP) and commercial environments.
• Streamlined compliance for FedRAMP and other standards: RapidFort simplifies regulatory compliance by including essential Center for Internet Security (CIS) and Security Technical Implementation Guides (STIG) benchmarking tools. Unlike competitors, RapidFort supports Defense Information Systems Agency (DISA) -approved distributions like Ubuntu and Red Hat, ensuring compliance even when configurations change during the build process.

“Meeting strict security and compliance requirements, especially in the federal space, can be an overwhelming challenge for organizations,” said Mehran Farimani, CEO of RapidFort. “We believe the path to compliance shouldn’t have to be complicated or restrictive. Our curated images streamline this process, allowing our customers to focus on their core mission, while we handle the rest.”

RapidFort offers an end-to-end solution for CVE remediation, addressing all three lifecycle steps: curated images, instrumenting and profiling, and hardening and monitoring. Unlike other offerings that rely on third parties and additional tools, RapidFort provides a comprehensive platform that manages the entire remediation process, from images to production.

To learn more about RapidFort Curated Images, please visit: https://hub.rapidfort.com

For more information about the RapidFort platform, please visit: https://www.rapidfort.com

About RapidFort

RapidFort offers a cybersecurity platform that streamlines and secures modern infrastructure. Their innovative approach allows organizations to continuously monitor and minimize their software attack surface, ultimately improving their security posture and operational efficiency. RapidFort empowers development and security teams with a free tier and free community images, making it easy to get started with secure software development. Learn more about RapidFort at https://www.rapidfort.com.

Solution brief | Software supply chain security

RapidFort Curated Libraries

A comprehensive catalog of malware-scanned and curated libraries

Extends RapidFort protection beyond operating systems, software images, and packages to independently deployable libraries.

npm

PyPI

Maven

RubyGems

NuGet

WHERE RAPIDFORT CURATED LIBRARIES FIT

Curated Libraries sit early in the software delivery process - before untrusted packages enter the build, artifacts, or production.

Open Source Ecosystems

npm PypI Maven RubyGems NuGet

RapidFort Curated Libraries
Trusted libraries consumed through existing workflows

Build & CI/CD
Buid pipelines packages

Images & Artifacts

Container images internal artifacts

Delivered through existing package and artifact workflows no new security friction while security teams set policy on approved packages, versions, and images.

The Challenge

Attackers compromise maintainer accounts, publish malicious updates, or typosquat popular packages.

Attackers compromise maintainer accounts, publish malicious updates, or typosquat popular packages.

Attackers compromise maintainer accounts, publish malicious updates, or typosquat popular packages.
‍
The RapidFort Solution

Malware-scanned libraries developers can trust.

Same versions, interfaces, features, and CLI syntax already in use.

Consumed earlier in development - a preventive, not reactive, model.

The Result

Lower likelihood that malware reaches build pipelines, artifacts, or production.

Prevention up front instead of reaction after public disclosure.

KEY CAPABILITIES

Malware scanning at the source

Helps prevent malicious packages and compromised dependencies from entering pipelines.

Existing workflow support

Works with current operating systems, tools, artifact repositories, interfaces, and CLI syntax.

Reduced incident response burden

Less time hunting for malware and vulnerabilities after public disclosures.

Continuous compliance visibility

Up-to-date assessment and reporting for auditors, customers, and boards.

Policy-driven security

Shift from reactive vulnerability response to a proactive consumption model.

COMMON USE CASES

Secure open-source package consumption

Protected libraries for npm, PyPI, Maven, RubyGems, and NuGet ecosystems.

Reduce incident-response churn

Limit recurring "are we exposed?" investigationsafter a newly disclosed malicious package.

Protect CI/CD and production environments

Reduce the risk that malware enters a build,
artifact, image, or runtime through a dependency.

Support audits and customer assurance

Current compliance reporting to demonstrate security controls are in place.

Standardize approved software intake

A shared process across engineering and security
for consuming open-source libraries, packages,
and images.

THREATS ADDRESSED

Helps mitigate supply-chain malware in compromised packages and dependencies, including:

Malicious binaries

Backdoored dependencies

Install-time payloads

Typosquatted packages

Credential-stealing code

Downloaders

Cryptominers

Rootkits

Ransomware

…and other unauthorized changes introduced into open-source components.

BUSINESS OUTCOMES

Developer velocity

Maintain velocity while consuming trusted libraries.

Reduced malware risk

Lower chance of malware entering development and production.

Less incident churn

Less time responding to supply-chain incidents.

Audit-ready posture

Current reporting for customer, auditor, and board-level assurance.

No vendor lock-in

Keep familiar tools and operating systems.

SUMMARY

RapidFort Curated Libraries shift open-source security from detection and response to prevention -giving developers malware-scanned, compatible libraries that reduce the risk of compromised dependencies reaching production.

RapidFort is the leader in Software Supply Chain Security, enabling organizations to eliminate risk across their software stack at scale. Its platform combines curated near-zero CVE container images, aged application libraries, malware removal threat intelligence, runtime profiling, and attack surface management to remove up to 99.9% of vulnerabilities within hours and reduce the attack surface by up to 90% without code changes.

Solution brief

RapidFort Supply Chain Risk Analysis

Independent, deep-binary malware and tampering detection across every image, library, file, and package before it ever reaches your environment.

Software supply chains run components that organizations did not build and cannot fully see. Malicious actors increasingly compromise open-source packages and container layers, embedding threats deep inside artifacts that signature-based scanners and vulnerability lists never reach. Self-reported fixes in new versions are not independently verifiable, and by the time a compromised package is discovered, it is often already running in production.

Security teams need a way to assess every artifact entering their environment, including images, open-source libraries, files, and packages, for malware and tampering before onboarding, not after an incident.

Solution

Supply Chain Risk mitigation is an integrated profiling and risk assessment capability built into the RapidFort platform. For RapidFort Curated Images (for Red Hat, Ubuntu, Debian, and Alpine) it automatically scans open-source libraries, files, and packages across ecosystems (including npm, PyPI, Maven, and RubyGems) for malware, tampering, and hidden threats, and surfaces the results in a dedicated Supply Chain Risk view.

This assessment is independently powered by ReversingLabs Spectra Assure, giving businesses a security claim backed by an independent, named third-party company rather than a self-reported scan result.

Up to 99.9%

CVE elimination in open-source images

422B+

files tracked by ReversingLabs threat intelligence

3-6 Months

faster time to compliance vs. platform migration

Key Capabilities

Malware-Scanned : Eliminate malicious binaries and install-time payloads at the source, across images, libraries, files, and packages.

Differential Version Analysis : Compares new package versions against prior releases to catch newly introduced malware or risky behavior changes.

Evidence-Backed Audit Trail : Every release includes an independently generated security report for customers, auditors, and regulators.

Tampering Verification : Cryptographic andstructural analysis helps identify unauthorizedmodification or repackaging of delivered artifacts.

Policy-Driven Release Gates : Packages that failsecurity policy are automatically blocked from the catalog until risks are remediated.

Pin-for-Pin Compatibility : Drop-in replacement that works with existing OS, tools, and CLI syntax. No migration or proprietary package manager.

How It Works

Assess before inclusion

Open-source packages from a
public repository are automatically
scanned for malware, tampering,
and hidden threats before they
are included, giving security
teams a full risk profile.

Identify risky updates
automatically

Version-to-version analysis
verifies that a new version
actually reduces risk instead of
introducing a new supply chain
risk.

Security becomes an
enabler, not a bottleneck

Policy-driven assessments
embedded directly in the
workflow let teams understand
risks to enable rapid decisions.

Why RapidFort

Named, independent validationRapidFort is the only vendor whose open-source library catalog is independently validated by a separate, namedthird-party security company using enterprise-grade deep-binary malware detection.

Hardening and risk assessment in one pipeline.The RapidFort hardening pipeline has helped enterprise customers eliminate up to 99.9% of CVEs from containerimages combined with continuous malware and tampering assessment across the same artifacts.

No migration, no lock-inWorks with standard pip, Maven, npm, and OS package interfaces that teams already use with no proprietarypackage manager, custom OS distribution, or vendor-specific toolchain required.

Availability

RapidFort Supply Chain Risk, with open-source library validation powered by ReversingLabs Spectra Assure, is generally available today for Python and Java ecosystems, with JavaScript in closed beta. OS package coverage spans Red Hat, Ubuntu, Debian, and Alpine, with additional language runtimes and application package catalogs on an accelerated roadmap. Existing RapidFort customers can enable Supply Chain Risk and library coverage through the platform console or by contacting their account team.

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software, enabling organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and independently malware-scanned open-source images. RapidFort is headquartered in Sunnyvale, California.