As KubeCon + CloudNativeCon North America 2026 returns to Salt Lake City, software supply chain security has moved from a compliance checkbox to a boardroom-level concern. AI is accelerating both code volume and vulnerability discovery, shrinking the window between disclosure and exploitation from months to hours, while regulators and buyers demand proof in the form of SBOMs, STIG and CIS evidence, and FIPS-validated cryptography. For platform engineers and DevSecOps teams, that means detection alone is no longer enough.
In this pre-show Q&A, Mike Wood, CMO of RapidFort, previews what attendees can expect at Booth 310 in the Solutions Showcase, including a live demo of RapidFort Runtime, which launched at Black Hat USA in August and is now generally available. Wood explains how the company’s “elimination rather than detection” approach, spanning hardened near-zero CVE images, malware-screened PyPI and npm libraries, and eBPF-based runtime profiling, can cut CVE exposure by up to 99.9% without code changes. He also discusses RapidFort’s role as a founding member of the Linux Foundation’s Akrites initiative, how the platform supports AI inference and agentic workloads, and customer outcomes from Beyond Identity and Legion Intelligence. Read on for the full conversation.
++
VMblog: What’s your elevator pitch for KubeCon + CloudNativeCon North America 2026? If attendees only remember one thing about your company after visiting your booth, what should it be?
Mike Wood: RapidFort leads the Software Supply Chain Security market with a comprehensive end-to-end Software Supply Chain Security solution extending from Intake to Runtime. RapidFort also has the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry’s first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.
VMblog: This is KubeCon’s return to Salt Lake City — what makes the North American cloud-native community particularly strategic for your business objectives this year?
Wood: North America is where platform engineering, security, and compliance decisions converge for many of our enterprise customers in financial services and healthcare, AI companies, SaaS providers pursuing FedRAMP, and the federal and defense ecosystem. Those teams are under two pressures at once. AI is accelerating both code volume and vulnerability discovery, shrinking the window between disclosure and exploitation from months to hours. At the same time, regulators and buyers are demanding proof: SBOMs, STIG and CIS evidence, FIPS-validated cryptography, and risk-based remediation timelines.
KubeCon NA puts us in front of the platform engineers and DevSecOps practitioners who actually choose base images and wire up pipelines, which is exactly where RapidFort delivers value. It is also our first North American KubeCon since we launched RapidFort Runtime at Black Hat USA in August, so it is the right audience to see continuous threat elimination running inside live Kubernetes clusters.
VMblog: Beyond the booth presence, what’s your broader community engagement strategy for KubeCon NA 2026? How are you contributing to the cloud-native ecosystem’s growth?
Wood: Open source is our foundation, so community is part of how we work. RapidFort is a CNCF member and a founding member of Akrites, the Linux Foundation initiative launched in June 2026 to coordinate the remediation and responsible disclosure of vulnerabilities in critical open source software before they can be exploited. RapidFort also serves on the Akrites governing board. Our curated image model reflects the same principle: we patch and rebuild genuine upstream open source rather than forking it into a proprietary distribution, so fixes preserve the integrity of the original software.
We also maintain open-source tooling for the community. Kimia, our MIT-licensed, Kubernetes-native OCI image builder, runs rootless without privileged mode or a Docker daemon, supports reproducible builds, and produces Cosign-signed images with SBOM and SLSA provenance attestations. We publish free, pre-hardened community images so any team can start from a smaller, safer baseline. During the show, our engineers will be available throughout the week to talk shop about optimizing, SBOM and RBOM® practices, FIPS 140-3 migration, and safe open-source consumption.
VMblog: Where exactly can attendees find you on the show floor at the Salt Palace Convention Center, and what’s the one must-see demo or experience you’ve built that showcases your technology’s real-world impact?
Wood: You will find RapidFort at Booth 310 in the Solutions Showcase at the Salt Palace Convention Center, facing the main aisle. RapidFort is a Silver sponsor of KubeCon + CloudNativeCon North America 2026.
The must-see demo is RapidFort Runtime. We install the Runtime agent into live Kubernetes clusters with a single Helm command and show it continuously scanning and profiling running workloads without touching developer workflows. You will see the RBOM® built from eBPF observation of what actually executes, compared against the SBOM to separate real exposure from noise; tamper and drift detection flagging new binaries, libraries, or services that appear in production; and a newly disclosed CVE being correlated against running workloads with a mitigation recommendation. We then close the loop by replacing a public image with its RapidFort Curated equivalent and optimizing it, taking an image from thousands of CVEs down to a handful. Attendees can also book time with our team in advance through the RapidFort KubeCon event page.
VMblog: Walk us through your booth strategy — what interactive elements, live demonstrations, or hands-on experiences will help attendees truly understand your solution’s differentiation?
Wood: Our booth is built around one idea: show the full lifecycle, intake to runtime, on real workloads rather than slides. Every conversation maps to one of three outcomes. The first is maintaining a near-zero CVE state, where we show daily-patched RapidFort Curated Images as drop-in replacements on the distribution a team already runs, including FIPS and STIG-hardened variants. The second is reducing patch backlogs while maintaining velocity, where the RapidFort Profiler and Optimizer remove unused components and non-exploitable vulnerabilities, which can cut patching effort by up to 80% while preserving application functionality. The third is securing what runs in production, where RapidFort Runtime and execution-path analysis focus remediation on the components actually loaded and executed.
The differentiation becomes obvious when attendees see it side by side: the same application, the same package managers, the same Linux distribution, but a fraction of the CVEs and a fraction of the image size. We encourage visitors to bring the name of an image they run in production so we can walk through what RapidFort would change for their environment.
VMblog: Are you hosting any booth talks, mini-sessions, or expert Q&A opportunities? What knowledge can attendees gain without attending a formal session?
Wood: Our solutions engineers will be on hand throughout the show for on-demand expert Q&A and whiteboard sessions at Booth 310, and attendees can reserve a dedicated time slot through our KubeCon event page. Popular topics include migrating from FIPS 140-2 to FIPS 140-3 and enforcing strict FIPS mode in Python workloads, generating STIG and CIS benchmark evidence for FedRAMP, CMMC, and cATO, replacing Bitnami Helm chart images with compatible near-zero CVE images, risk-based remediation deadlines using CISA BOD 26-04, and safely consuming PyPI and npm packages without exposing pipelines to malicious or freshly hijacked releases.
VMblog: What creative approaches are you taking to stand out on a crowded show floor with 9,000+ attendees? How are you making your booth a destination rather than just a stop?
Wood: We make the booth a destination by making every visit useful. Instead of a generic pitch, attendees get a conversation about their own stack: which distribution they run, whether they have adopted distroless-like images, and where their CVE backlog comes from. That leads directly into a live before-and-after of the CVE count and image size for an image like theirs, and a look at RapidFort Runtime watching a live cluster.
We also lean into a bit of fun. Our “SHIFT HAPPENS” t-shirts are a nod to the industry shift from detecting vulnerabilities to eliminating them at the source, and visitors can learn about our role in the Linux Foundation’s Akrites initiative right at the booth.
VMblog: Let’s get technical — what specific architectural challenges or operational bottlenecks does your solution address for cloud-native teams heading into 2027?
Wood: Five bottlenecks stand out. The first is inherited vulnerability debt. Base images and dependencies arrive with thousands of CVEs, and in our analyses roughly a third of reported CVEs do not actually affect the workload. The RapidFort Analyzer reconciles findings across scanners and reduces up to 25% of vulnerability noise so teams focus on real risk.
The second is image bloat. Typically 70% to 90% of the components in a container are never used at runtime. The RapidFort Profiler instruments the workload, generates an RBOM® of what actually executes, and the Optimizer removes the rest. In one example, an image shrank from 1.8 GB to 262 MB while CVEs dropped by 99.9%. Workload tags let teams reuse aggregated runtime profiles so minor version updates can be hardened without rerunning full test suites.
The third is software that is born outdated. New CVEs are disclosed against software after it is deployed. RapidFort Runtime runs a lightweight scanner DaemonSet on every node plus a single cluster-wide controller that is the only component talking to the RapidFort Platform over HTTPS, so production workloads are continuously re-evaluated against new disclosures and monitored for tampering.
The fourth is untrusted intake. Malicious, typosquatted, or hijacked packages enter through pip and npm. RapidFort Curated Libraries filter known malicious packages and enforce a cooldown window on brand-new releases.
The fifth is compliance evidence. RapidFort CART and our Continuous Compliance view turn STIG, CIS, FIPS, and risk-based remediation tracking into audit-ready output rather than spreadsheet work.
VMblog: The industry narrative has shifted from “Kubernetes for web scale” to “Kubernetes for AI scale.” How has your technology evolved to meet that shift, particularly as inference is projected to overtake training as the dominant AI compute workload?
Wood: RapidFort does not schedule GPUs or serve models; we secure the software that AI workloads are built from and run on. That layer becomes more important as inference moves into production, because inference servers, model gateways, and agent runtimes are long-running, often internet-facing services built on deep Python dependency trees. A single exploitable CVE in that stack is an attack vector into the AI decision loop.
Our platform has evolved in four ways to meet that shift. Curated near-zero CVE Python, Node.js, Go, and Java images now include runtime-only and scratch variants that exclude compilers and package managers from production inference containers. RapidFort Curated Libraries protect the PyPI dependency chain with malware filtering powered by ReversingLabs threat intelligence. RapidFort Runtime profiles what actually executes inside long-running inference services and watches for drift. And our strict FIPS Python images close a gap where Python’s hashlib could otherwise fall back to non-approved algorithms, which matters for regulated AI deployments.
AI builders already rely on this foundation. Seven of the ten top AI companies are RapidFort customers, Legion Intelligence builds its LLM inference engines and agent orchestration runtimes on RapidFort images for defense users, and our partnership with Nutanix brings hardened images to enterprise AI workloads on the Nutanix Kubernetes Platform.
VMblog: Where does your solution fit within the modern cloud-native stack? How do you integrate with and complement projects like vLLM, KServe, Ray, and OpenTelemetry that are anchoring the new AI Inference + Agentic track?
Wood: RapidFort sits underneath those projects rather than beside them. We work at the container image, package, and node layers, which makes the platform framework-agnostic. RapidFort Runtime is installed with Helm and runs on standard Kubernetes distributions including Amazon EKS, Azure AKS, Google GKE Standard, Red Hat OpenShift, RKE2, K3s, k0s, and MicroK8s, scanning and profiling whatever pods are running, including inference and distributed-compute workloads, without sidecars or code changes.
Python-based serving and orchestration frameworks pull large numbers of packages from PyPI. Pointing pip, uv, or Poetry at RapidFort Curated Libraries means those dependencies are malware-screened before they reach the build. Teams that build their own serving images can base them on RapidFort curated Python images and optimize them with the RapidFort Profiler. On observability, RapidFort complements OpenTelemetry: OpenTelemetry tells you how a service is performing, while the RBOM® tells you what software is actually executing inside it and whether it has changed. RapidFort exports SBOM and RBOM® data in standard formats such as CycloneDX so it can flow into the tools teams already use.
VMblog: Can you share a compelling customer story or use case that demonstrates tangible outcomes — whether that’s cost savings, performance improvements, or accelerated delivery cycles?
Wood: Beyond Identity, a provider of identity and access management solutions, used RapidFort on its path to FedRAMP certification. By starting from pre-hardened, near-zero CVE RapidFort Curated Images aligned with NIST 800-70 and FIPS 140-2 and 140-3, using RapidFort scanning to streamline STIG benchmarking, and generating compliance documentation such as the Plan of Action and Milestones and the SBOM, Beyond Identity cut the cost of image hardening and secure SDLC work by 50% and shortened its overall compliance timeline by three months.
In the AI space, Legion Intelligence, whose governed AI platform serves U.S. defense customers, uses RapidFort curated images as the secure base for its LLM inference engines, agent orchestration runtimes, and data pipelines, with images hardened and rebuilt every 24 hours and continuously validated against STIG, CIS, FedRAMP, and CMMC benchmarks. And early RapidFort Runtime users such as Sisense highlight the value of a precise, continuously updated RBOM® as real-time evidence of what is executing in production for audit and compliance.
VMblog: Agentic AI workflows are emerging as a new class of Kubernetes workload, with autonomy and orchestration requirements that differ from traditional services. How is your platform adapting to support these agentic systems?
Wood: Agentic systems change the security question from “what did we deploy?” to “what is running right now, and has it changed?” Agents may install packages, invoke tools, and spawn processes on their own, which means the software inside a container can drift after deployment. RapidFort addresses that in three ways.
First, RapidFort Runtime establishes a verifiable baseline of approved software and continuously detects changes to packages, binaries, libraries, processes, and runtime behavior, with an RBOM® that provides evidence of what changed and where. Second, hardened images remove shells, package managers, and unused binaries, which limits the blast radius if an agent is manipulated into running something it should not. Third, when agents or their builders do need new dependencies, RapidFort Curated Libraries ensure those installs flow through a malware-screened source with a cooldown on brand-new releases. Legion Intelligence already runs its agent orchestration runtimes on RapidFort-hardened containers, and securing the agentic enterprise, including identity, authority, and blast radius, was a featured topic at the conference RapidFort co-hosted with SpaceWERX in October.
VMblog: Platform engineering continues reshaping how organizations approach cloud-native infrastructure. What’s your perspective on this shift, and how does your technology enable effective platform teams and internal developer platforms?
Wood: Platform engineering is the right model for security because it lets a small team make the secure path the easy path for everyone. RapidFort is designed to be the security layer of that golden path. Platform teams curate an approved set of near-zero CVE images and libraries once, and developers keep coding the way they always have, with the same distributions, the same package managers such as apt, apk, pip, and npm, and the same CLI syntax.
RapidFort plugs into the platform team’s existing tooling: pull-through configurations for JFrog Artifactory, Sonatype Nexus, Harbor, Azure Container Registry, and Google Artifact Registry; registry integrations for Amazon ECR (including GovCloud), GitHub, GitLab, Quay, and Cloudsmith; Renovate for keeping image references current; Bazel rules for hardened package substitution and reproducible builds; Bitnami Helm chart-compatible images; signed-image verification; and SSO with Okta, Microsoft Entra ID, Google, and Keycloak. Policy-driven gates powered by our Software Supply Chain Risk Analysis let platform teams block non-compliant images without becoming a bottleneck, so security becomes part of the internal developer platform rather than a ticket queue.
VMblog: Multi-cloud and hybrid strategies are now table stakes, and GPU capacity is often the scarcest resource across those environments. How does your solution help organizations navigate distributed, heterogeneous infrastructure — including accelerator availability?
Wood: Accelerator scheduling is outside RapidFort’s scope, but delivering a consistent security posture across heterogeneous infrastructure is central to it. RapidFort Curated Images are published for both amd64 and arm64, so the same hardened foundation works across cloud instance types and edge hardware. RapidFort Runtime runs on the major managed services and on self-managed and edge distributions such as OpenShift, RKE2, K3s, k0s, and MicroK8s. Through our partnership with Nutanix, hardened images are available to workloads on the Nutanix Kubernetes Platform across data center, edge, and public cloud. RapidFort also supports air-gapped and classified deployments for defense customers, and is available through the AWS, Microsoft Azure, and Google Cloud marketplaces. The result is one set of security policies and evidence, regardless of where a workload lands.
VMblog: Security, compliance, and governance remain top concerns, especially as AI systems introduce new supply chain and runtime risks. What’s your approach to helping organizations build secure, compliant cloud-native systems without sacrificing velocity?
Wood: Our approach is elimination rather than detection, applied continuously across intake, build, and runtime. At intake, every image and package can be assessed for malware, tampering, and hidden threats through RapidFort Software Supply Chain Risk Analysis, powered by ReversingLabs Spectra Assure, including version-to-version differential analysis that verifies whether a supplier actually fixed the vulnerabilities it claimed. At build, teams replace public images with RapidFort Curated Images, including FIPS 140-3 variants and STIG-hardened images for Ubuntu, Red Hat UBI, and Amazon Linux, and then optimize them to remove unused components. At runtime, RapidFort Runtime provides continuous CVE monitoring, tamper and drift detection, and secret scanning.
Governance is built in. RapidFort CART compiles security benchmarks into audit-ready reports for ATO, NIST, FedRAMP, and other standards, and our Continuous Compliance view assigns every CVE a remediation deadline according to CISA BOD 26-04 and based on live risk signals, including internet exposure, CISA KEV status, automatability, and technical impact, rather than a flat severity clock. Velocity is preserved because none of this requires code changes: images are drop-in replacements, and the work of patching open source is done for the team. That combination is how customers accelerate FedRAMP, cATO, CMMC, SOC 2, CRA, NIS2, and DORA readiness while shipping on schedule.
VMblog: As we head toward 2027, what’s your unique value proposition? With dozens of vendors claiming similar AI-infrastructure capabilities, why should CTOs choose your solution?
Wood: RapidFort is not another AI-infrastructure tool; we are the security foundation underneath all of them. Our value proposition is simple: deliver fast, reduce risk, stay secure. Four things set us apart. We eliminate vulnerabilities instead of detecting and prioritizing them, removing up to 99.9% of CVEs. We are an end-to-end platform spanning intake, build, and runtime, so there are no gaps, no handoffs, and no blind spots. We are true to open source: RapidFort images are built on genuine LTS distributions and standard package managers, which means no proprietary operating system, no lock-in, and always a second source.
For a CTO, that translates into developers spending their time on the features that differentiate the business instead of the undifferentiated heavy lifting of patching open source. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, was named a Gartner® Cool Vendor™, and serves more than 200 enterprise and public sector customers.
VMblog: Are you launching any new products, unveiling significant features, or announcing partnerships at KubeCon NA 2026? What should attendees watch for?
Wood: Attendees will see our most significant recent innovations in action. RapidFort Runtime, launched at Black Hat USA in August 2026 and now generally available, extends RapidFort into live production for the industry’s first end-to-end continuous threat elimination, with continuous CVE monitoring, tamper detection, dynamic RBOM® generation, and mitigation recommendations. RapidFort Curated Libraries, developed with ReversingLabs, deliver independently malware-scanned open-source packages for Python and JavaScript, and our Software Supply Chain Risk Analysis pipeline, powered by ReversingLabs Spectra Assure, assesses third-party software before intake.
Platform updates since summer include secret scanning for container images, a Continuous Compliance view that calculates risk-based remediation deadlines for every CVE according to BOD 26-04, in-app notifications for active secrets and supply chain threats, a new cluster dashboard for Runtime, project comparison, and new integrations for Google Artifact Registry, Cloudsmith, and Bazel. On the partnership front, we will highlight our work with Nutanix to bring hardened images to the Nutanix Kubernetes Platform, along with integrations with CrowdStrike Falcon Cloud Security, Wiz, and Aqua Trivy.
VMblog: Give us your executive pitch — how do you articulate ROI and business value to C-suite leaders who need to justify cloud-native and AI infrastructure investments?
Wood: We frame it in three numbers and one risk. RapidFort customers reduce development costs by 10% or more because engineers stop spending their time patching open source they did not write. They speed up software releases by two to three weeks because vulnerability backlogs no longer block go-live. And they cut manual remediation effort by roughly 60%. Beyond Identity, for example, cut its hardening and secure SDLC costs by 50% and reached FedRAMP three months sooner, which means revenue from government customers arrives a quarter earlier.
The risk side is just as concrete. AI has compressed the time between vulnerability disclosure and exploitation to hours, and no engineering organization can patch at that speed manually. Eliminating up to 99.9% of CVEs and up to 90% of the attack surface removes most of that exposure before it can be exploited, and continuous evidence from SBOMs, RBOM®s, and benchmark reports makes audits, customer security reviews, and cyber insurance conversations faster. Executives can model their own numbers with the ROI calculator on rapidfort.com.
VMblog: FinOps and cost optimization have become even more critical as GPU spend joins cloud spend under scrutiny. How does your solution help organizations maximize efficiency and control costs across both traditional and AI workloads
Wood: RapidFort does not manage GPU allocation, but it reduces cost in three places FinOps teams care about. The first is infrastructure efficiency: hardened containers are dramatically smaller, as in the example of an image reduced from 1.8 GB to 262 MB, an 86% reduction. Smaller images pull and start faster and consume fewer resources, which lowers registry storage, network transfer, and compute costs across both traditional and AI workloads.
The second is engineering time, usually the largest hidden cost of vulnerability management. Eliminating CVEs at the source rather than triaging them returns developer hours to product work. The third is compliance cost, where pre-hardened images and generated evidence shorten audits and certifications. Together these turn security from a growing line item into a lever for efficiency.
VMblog: Looking beyond KubeCon NA 2026, what emerging trends or technologies should cloud-native practitioners be preparing for? What’s on your company’s innovation roadmap that signals where the industry is heading?
Wood: Practitioners should prepare for vulnerability discovery and exploitation at machine speed. Frontier AI models can now surface vulnerabilities in a major open source project in minutes, which is why the industry came together around Akrites for coordinated upstream remediation. Downstream, the only sustainable response is to carry less vulnerable code into production and to know precisely what is executing, which is why runtime evidence such as the RBOM® will matter more than static inventories.
Several other shifts are coming. Attacks are moving up the stack into package registries, so library-level curation will become as standard as image scanning. Remediation is shifting from flat severity SLAs to risk-based deadlines driven by CISA BOD 26-04. Regulation such as the EU Cyber Resilience Act and NIS2 is turning software transparency into a legal requirement. Agentic workloads will make drift and blast-radius control a first-class concern, and the migration to FIPS 140-3 and, eventually, post-quantum cryptography is already beginning. RapidFort’s direction follows those trends: extending continuous threat elimination deeper into production, across more open-source ecosystems, and into more of the evidence that security and compliance teams need.
VMblog: Open-source registries such as PyPI and npm are seeing a steady stream of malicious and hijacked packages. How does RapidFort protect teams at the library level, not just the container image level?
Wood: RapidFort Curated Libraries act as a protected proxy between the build environment and public registries. Known malicious packages identified by third-party threat intelligence, including ReversingLabs, are filtered out, and newly published versions are held for a cooldown period, 14 days by default, so they have time to be scanned, reviewed, and flagged before anyone can install them. That closes the window that typosquatting, dependency confusion, and malicious version bumps exploit. If a critical fix lands inside the cooldown window, RapidFort can include it after a rigorous review.
Adoption is a configuration change rather than a code change. Teams point pip, uv, Poetry, or their JavaScript package manager at RapidFort, or set it up as a remote repository in JFrog Artifactory or Sonatype Nexus, and keep using the same packages and versions they already rely on, with pin-for-pin compatibility.
VMblog: Many teams are evaluating minimal or “distroless”-style images. How does RapidFort’s approach differ?
Wood: Minimal images are a good goal, but many approaches force teams to adopt a new operating system, a proprietary package manager, or a single vendor’s build pipeline. RapidFort gets to the same place without that migration. Teams stay on the distribution they already run, whether Ubuntu, Red Hat UBI, Debian, Alpine, Oracle Linux, or Amazon Linux, and swap in a RapidFort Curated Image as a drop-in replacement. When they want a smaller footprint, they can choose runtime-only or scratch variants, or use the RapidFort Profiler to harden their own image based on what actually executes, removing shells, package managers, and unused libraries.
Because RapidFort is built on genuine open source, customers always have a second source, keep full developer choice, and avoid being locked into one vendor’s operating system for the life of their applications.
##
