RapidFort points its hardened open-source business at what actually runs in production

RapidFort used Black Hat USA to announce RapidFort Runtime, a companion to the curated open-source packages it already sells that watches those packages once they are executing in production. Per the release, the runtime component runs in read-only mode, continuously monitoring workloads, tracking changes and surfacing what the company calls actionable mitigations. For CI/CD and platform teams, the interesting part of the announcement is not the product itself, it is the seam it aims at: what a pipeline signed and shipped versus what is actually running on the pod an hour later.

What RapidFort is claiming

The company frames Runtime as a natural extension of its existing business, which is selling reduced, hardened builds of common open-source components. Michael Wood, chief marketing officer at RapidFort, said the goal is to make it simpler for DevOps teams to run those curated packages in their production environments while getting continuous visibility into changes and mitigations. There is no enforcement layer in the description that has been made public: the tool watches, it does not block.

The operational read

Runtime security agents live on a small set of trade-offs. Read-only sidesteps the sharpest one, blast radius, at the cost of pushing enforcement onto whatever already handles admission control or restart policy in the cluster. Continuous monitoring adds another agent to justify to the platform, security and finance teams that already own the node budget. And the value depends entirely on the signal-to-noise ratio of the mitigation feed. A firehose of low-severity findings, keyed to production namespaces, is worse than none, because it burns the on-call attention the tool is supposed to protect.

The gap RapidFort is describing is a real one. Most teams learn about drift between the built artifact and the running workload from a scheduled scan a day later, or by grepping incident logs after the fact. A live change stream, in principle, shortens that loop. Whether Runtime is the tool that closes it depends on details the announcement does not cover: pricing, general availability, orchestrator support, and whether the mitigation feed is model-generated, curated by RapidFort staff, or fed from the same hardening pipeline that produces the company's package catalogue. Those are the questions a platform lead will ask before the trial ends.

For now the announcement stakes a claim on the SBOM-to-runtime handoff. The deployment guide is what will decide who buys it.