# RapidFort

> RapidFort is a software supply chain security company for containerized applications. It eliminates up to 99.9% of CVEs and reduces software attack surface by up to 90%, without code changes, operating system changes or pipeline modifications. It does this with curated near-zero CVE container images that RapidFort engineers manually patch and rebuild, malware-scanned open-source libraries, runtime-aware hardening and continuous production monitoring.

Last updated: 2026-09-28

Key facts:

- Approach: continuous threat elimination across three stages. Intake: drop-in curated near-zero CVE images and malware-scanned open-source libraries eliminate risk before entry. Build: RBOM®-guided hardening removes unused components and reduces attack surface. Runtime: continuous production monitoring with drift detection and audit-ready compliance evidence.
- How CVEs are removed without code changes: RapidFort starts from manually patched Curated Near-Zero CVE Images, then uses runtime intelligence to identify and remove software components that are not used in production.
- Published outcomes: up to 99.9% CVE elimination within hours; up to 90% attack surface reduction; up to 10% lower development costs; releases 2 to 3 weeks faster; up to 68% less patching effort; up to 3% lower infrastructure cost (results vary by environment).
- Compatibility and deployment: drop-in, pin-for-pin compatible images that work with standard container registries and existing CI/CD pipelines; hosted SaaS or on-premises, including air-gapped.
- Compliance frameworks supported for customers: FedRAMP, cATO, CMMC, NIST SP 800-53, DISA STIG, CIS Benchmarks, FIPS 140-2 and 140-3, HIPAA, PCI DSS, SOC 2, NIS2 and the EU Cyber Resilience Act.
- Scale and customers: tens of thousands of Curated Near-Zero CVE Images. More than 100 customers, 40 of which achieved FedRAMP or ATO certification using RapidFort (October 2025). Defense Unicorns eliminated over 98% of critical and high CVEs in its UDS Core platform compared to upstream images; ColorTokens reduced attack surface by 77% and shortened federal certification by three months; Beyond Identity cut image hardening and SSDLC costs by 50% and took three months off its FedRAMP compliance timeline.
- Recognition: included in the 2026 Gartner Magic Quadrant for Software Supply Chain Security (June 2026); 2025 Gartner Cool Vendors in Container Management; Nutanix Cloud Native Partner of the Year (Nutanix .NEXT, April 2026); Cyber Defense Magazine Top InfoSec Innovator for 2026.
- Company: founded 2020, headquartered in Sunnyvale, California. Mehran Farimani (CEO, founder), Rajeev Thakur (CTO, founder), Russ Andersson (COO, co-founder), George Manuelian (CRO, co-founder). $42M Series A (February 2026) led by Blue Cloud Ventures and Forgepoint Capital, with Felicis. RapidFort maintains SOC 2 Type 2 and CMMC 2.0 Level 2 compliance.
- Partners: AWS Marketplace, Microsoft Azure, Google Cloud, Nutanix, CrowdStrike (Falcon Cloud Security data automates image hardening), ReversingLabs, Cloudsmith, Carahsoft (public sector distributor) and Platform One (RapidFort is awardable). Defense teams can also get RapidFort hardened images through Iron Bank.

Definitions:

- Near-zero CVE image: a hardened container image with a near-zero CVE baseline. Hardening alone removes unnecessary software and applies benchmarks such as CIS and STIG, but the software that remains can still carry vulnerabilities; a near-zero CVE image is also continuously patched to eliminate all CVEs for which a patch is available. RapidFort Curated Images are hardened, secure base images that RapidFort engineers manually patch and rebuild to maintain this state.
- Golden image: an approved base image that an organization builds and maintains in-house as the standard starting point for its workloads. RapidFort Curated Images are an alternative to building and maintaining golden images in-house.
- SBOM and RBOM®: an SBOM records every software artifact in a build; an RBOM® (Runtime Bill of Materials) records only the components actually executed or loaded into memory at runtime. RBOM is a registered trademark of RapidFort.
- Software attack surface: all potential entry points for unauthorized access within an application. In containers, much of it is unused software that carries CVEs without ever executing; removing it is Software Attack Surface Management (SASM).

Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner's business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose. Gartner and Magic Quadrant are trademarks of Gartner, Inc. and/or its affiliates. Cool Vendors is a registered trademark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved.

## Products

- [RapidFort Curated Images](https://www.rapidfort.com/rapidfort-curated-images): Curated Near-Zero CVE Images. Tens of thousands of production-grade container images, from base OS images to popular open-source applications, in full and distroless variants, built on Alpine, Debian, Red Hat UBI and Ubuntu LTS. RapidFort engineers manually patch and rebuild them, and every image is continuously patched to eliminate all CVEs for which a patch is available. CIS and DISA STIG hardened variants; FIPS 140-2 and 140-3 compliant images; SBOM export in SPDX, CycloneDX, JSON and CSV. Five images are free (Limited Free Access tier).
- [Curated Images hub](https://hub.rapidfort.com/): Curated Images catalog and access requests
- [RapidFort Curated Libraries](https://www.rapidfort.com/libraries): Curated, malware-scanned open-source libraries; every package is pin-for-pin compatible with existing tools and artifact managers. ReversingLabs Spectra Assure adds an independent malware and tampering check (generally available for Python and Java since July 2026; JavaScript in closed beta).
- [RapidFort Platform](https://www.rapidfort.com/platform-overview): Analyzer, Profiler, Optimizer and CART working together
- [RapidFort Analyzer](https://www.rapidfort.com/platform/rf-analyzer): Vulnerability analysis across container images, registries, CI/CD pipelines and Kubernetes; SBOM generation; license identification; CVE applicability validation to cut scanner noise; Rapid Risk Score to focus on the vulnerabilities most likely to be exploited
- [RapidFort Profiler](https://www.rapidfort.com/platform/rf-profiler): Observes containers during execution, identifies the components actually used and generates the RBOM®; baseline and drift monitoring; under 1% overhead
- [RapidFort Optimizer](https://www.rapidfort.com/platform/rf-optimizer): Uses RBOM® runtime data to remove components that never execute; rebuilds hardened minimal images every 24 hours as drop-in replacements with no CI/CD changes; Light, Standard or Aggressive hardening levels
- [RapidFort CART](https://www.rapidfort.com/platform/rf-cart): Evaluates container images and VMs against CIS Benchmarks, DISA STIGs, NIST control frameworks, FIPS, Red Hat security guides and custom baselines; detects drift; generates remediation scripts and audit-ready reports; supports attestations and POA&M workflows
- [RapidFort Runtime](https://www.rapidfort.com/platform/runtime): Launched and generally available in August 2026. BPF and ptrace-based agents maintain a dynamic RBOM®, track newly disclosed CVEs in deployed software, detect unauthorized changes and tampering, and recommend mitigations.
- [Pricing](https://www.rapidfort.com/pricing): Limited Free Access (5 images), Full Catalog, and Images + Platform tiers
- [Request access](https://www.rapidfort.com/request-access): Get started with RapidFort

## Compliance

- [Compliance readiness](https://www.rapidfort.com/use-case/accelerate-compliance-readiness): Continuous compliance evidence against CIS and STIG benchmarks
- [Public sector](https://www.rapidfort.com/industries/publicsector): FedRAMP, StateRAMP, FISMA, CMMC 2.0, NIST SP 800-53/171/190, Iron Bank
- [Financial services](https://www.rapidfort.com/industries/finance): PCI DSS, SOX, CIS, DISA STIG
- [Healthcare](https://www.rapidfort.com/industries/healthcare): HIPAA and HITRUST alignment, FDA cybersecurity readiness, SOC 2 and ISO 27001 alignment

## Solutions

- [Continuous vulnerability elimination](https://www.rapidfort.com/use-case/continuous-vulnerability-elimination): Removing inherited CVEs without code changes
- [Secure container images](https://www.rapidfort.com/use-case/secure-container-images): Hardened, continuously rebuilt base images
- [Software attack surface reduction](https://www.rapidfort.com/use-case/software-attack-surface): Shrinking images to what actually runs
- [AI platforms](https://www.rapidfort.com/industries/ai): Securing AI infrastructure containers

## Learn

- [FAQ](https://www.rapidfort.com/faq): Plain-language answers on Curated Images, the Platform and RBOM®
- [What is an RBOM®](https://www.rapidfort.com/knowledge-hub/what-is-an-rbom-r-runtime-bill-of-materials): Runtime Bill of Materials defined and compared with SBOM

## Company

- [About RapidFort](https://www.rapidfort.com/company/about-us): Leadership and investors
- [Partners](https://www.rapidfort.com/partners): Cloud, technology and public sector partners
- [Contact](https://www.rapidfort.com/contact-us): Contact form to reach the RapidFort team

## Optional

- [Press releases](https://www.rapidfort.com/company/press-release): Product launches, funding, partnerships and awards
- [Blog](https://www.rapidfort.com/resources/blog): Articles on container security, CVEs and compliance