RapidFort Allies with CrowdStrike to Harden Container Images

RapidFort this week revealed it has integrated its container vulnerability remediation platform with the cloud security platform provided by CrowdStrike.

Announced at the Fal.Con 2026 event hosted by CrowdStrike, the integration enables RapidFort to ingest vulnerability and software bill of materials (SBOM) data from Falcon Cloud Security that can then be used to automate the hardening of container images.

Mike Wood, chief marketing officer for RapidFort, said the insights surfaced via Falcon Cloud Security will make it simpler for RapidFort engineers to create container images that are free from known vulnerabilities that are often inherited from open-source base images and packages that have been encapsulated in a container image.

That approach makes it possible to swap in secure container images that have been rebuilt by RapidFort without having to change any of the code in an application, he added. Additionally, RapidFort will deliver container images that can run, for example, on an older version of an instance of Kubernetes that an internal IT team for one reason or another might not be able to upgrade, said Wood.

RapidFort also developed the RapidFort Runtime platform that makes it possible to now monitor open source software deployed within a container image to detect unauthorized or unexpected changes, and proactively assess the impact any report of a newly discovered Common Vulnerabilities and Exposures (CVE) might have.

Mitch Ashley, vice president and practice lead for software lifecycle engineering at the Futurum Group, said finding vulnerabilities is no longer the hard part. Scanning produces more findings than any team can work through, so value moves to whatever closes them without a human in the queue, he added. Rebuilding a hardened image and swapping it in treats the fix as the deliverable, said Ashley.

What matters next is proof, noted Ashley. Security teams will want evidence that the rebuilt image runs the same application, and platform teams own that verification, whether the tooling makes it easy or not, he added.

It’s not clear to what degree organizations will be adopting containers in the age of artificial intelligence (AI), but as it becomes simpler for adversaries to discover vulnerabilities and create exploits, containers offer a unique advantage over having to patch a monolithic application. Most containers are replaced every few minutes, so if a DevSecOps team needs to update an application all they need to do is swap out one container for another.

The one thing that is all but certain is that there will be multiple waves of cyberattacks that take advantage of the latest advances in artificial intelligence (AI) to exploit vulnerabilities, many of which are now just being discovered using AI models developed by Anthropic and OpenAI. While the first wave of those attacks may not necessarily be especially novel, it’s more a question of when those attacks will become more sophisticated as, for example, multiple low-level vulnerabilities are chained together to create a more lethal exploit. As those attacks are launched, DevSecOps teams will find themselves in a race against time to remediate vulnerabilities that will be measured in minutes and hours rather than days and weeks.

Hopefully, efforts such as the Akrites initiative launched by the Linux Foundation will lead to more open source software being patched faster by maintainers of those projects. In the meantime, however, DevSecOps teams should assume there are thousands of vulnerabilities in applications running in production environments. The challenge and the opportunity then becomes how best to modernize those applications in a way that improves the overall state of application security.