RapidFort launches runtime tool for production CVE checks

RapidFort has launched RapidFort Runtime, extending its software supply chain security tools into live production environments.

The launch adds runtime monitoring to RapidFort's existing focus on software before deployment. The system runs inside production environments, watching deployed software for unauthorised or unexpected changes while tracking newly disclosed common vulnerabilities and exposures, or CVEs.

RapidFort says the product alerts administrators and developers when new security issues affect software that is already running. It also provides mitigation recommendations and creates what it calls a Runtime Bill of Materials, or RBOM, showing what software and processes are executing in production.

The service is designed to integrate with existing CI/CD pipelines without code changes. It also distinguishes between first-party and third-party software, aiming to give security teams a clearer view of what is active in live systems.

Runtime focus

The move reflects a broader challenge in software security. Many tools concentrate on code repositories, build pipelines and container images before release, but security teams still have to manage newly disclosed vulnerabilities and unauthorised changes after workloads reach production.

RapidFort argues this creates a gap between pre-production checks and runtime oversight. Its new product is intended to address that issue by continuously monitoring running workloads rather than relying only on static analysis or image scanning.

RapidFort Runtime uses lightweight agents based on BPF and ptrace to observe software behaviour in live environments. According to the company, that approach maps system calls, network and memory usage, and process execution to provide evidence of what is running.

That emphasis on runtime evidence is tied not only to threat detection, but also to compliance and audit demands. Security and compliance teams increasingly need proof of what software was deployed, whether it changed, and whether newly identified flaws affect systems in operation.

One customer highlighted that point in comments released alongside the launch. "Maintaining an accurate, real-time inventory of what is actually executing in production has been a consistent audit and compliance hurdle," said Sangram Dash, CISO and VP of IT at Sisense. "RapidFort Runtime's ability to generate a precise, dynamic RBOM provides us with undeniable evidence of our software's state. We can now verify integrity and confirm our compliance in real-time, which is a total game-changer for our security operations."

Production exposure

One of the main problems RapidFort is targeting is what it describes as production obsolescence, where software can become exposed as soon as it is deployed because new CVEs are disclosed after release. In that scenario, organisations may know what they built and shipped, but not whether running instances have become newly vulnerable.

The new product continuously correlates emerging vulnerabilities with deployed workloads. This is intended to reduce the manual work involved in determining whether a newly disclosed CVE affects software that is actually running in production.

RapidFort also says the tool establishes a baseline of approved software and monitors changes to packages, binaries, libraries, processes and runtime behaviour. That is intended to help identify tampering or drift from an approved production state.

The launch builds on RapidFort's existing business in curated open-source software and hardened container images. Its software catalogue is validated through deep-binary malware analysis by ReversingLabs, and the new runtime offering is intended to verify both what enters production and what remains intact after deployment.

RapidFort positioned the product as an alternative to approaches that require organisations to adopt proprietary package managers or distroless images. It says the offering supports standard package managers including pip, npm and apk.

Commenting on the rationale for the product, a Senior Executive at the company pointed to the limitations of build-time tools. "While most software supply chain security tools stop at build-time or deployment, RapidFort continuously monitors live production environments for newly disclosed CVEs that impact deployed software," said Rajeev Thakur, CTO of RapidFort. "By automatically correlating new vulnerabilities with running workloads, RapidFort eliminates the manual effort of tracking CVEs and determining real production exposure, enabling organizations to respond faster and with greater confidence."

RapidFort Runtime is generally available.