RapidFort links hardened container images with Wiz

RapidFort has integrated its container image offerings with the Wiz cloud security platform, giving joint customers access to RapidFort advisory data inside Wiz.

The integration lets Wiz users scan RapidFort-curated and hardened container images for common vulnerabilities and exposures while viewing RapidFort's assessment of remediation status in the same interface. Customers do not need to change their existing scanning workflows to use it, according to the companies.

Wiz is a cloud and AI security platform now part of Google Cloud. RapidFort focuses on software supply chain security and provides curated open-source container images designed to reduce the number of reported vulnerabilities.

Under the integration, when Wiz detects a CVE affecting a RapidFort-curated or hardened image, the platform can display RapidFort advisory context alongside the finding. It can also direct users to an alternative RapidFort curated image that the company describes as a near-zero CVE equivalent.

RapidFort says those curated images keep the same operating system, language stack, size, and version tags that customers already use. That allows remediation by changing a single line in the container build file rather than moving to a different software base.

Scanner workflow

The arrangement reflects a broader push by security vendors to connect detection tools more closely with remediation options. In container security, one persistent challenge is that scanners can generate long lists of vulnerabilities, including findings that may not be exploitable in practice or that require significant work to resolve.

RapidFort says its advisories rely on primary sources including the National Vulnerability Database, distribution trackers, and upstream code commits. The company says that approach gives customers a documented explanation for false-positive determinations instead of simply suppressing alerts without supporting evidence.

"We're happy to welcome RapidFort to the Wiz Integration Network," said Oron Noah, VP of Product, Extensibility and Partnerships at Wiz.

"Managing cloud vulnerabilities isn't just about identifying risk, it's about making remediation as seamless as possible. By surfacing RapidFort advisory feed directly within the Wiz platform, we're helping joint customers clear out false positives and fix CVEs quickly," said Noah.

Image catalogue

RapidFort says its catalogue covers major long-term support operating system releases including Ubuntu, Debian, Red Hat UBI, and Alpine. The company says it differs from suppliers that standardize customers on a single Linux distribution.

That matters for organizations trying to reduce vulnerabilities without changing the underlying operating system used by development teams. RapidFort says customers can keep existing operating system choices, image sizes, and version tags, which it argues reduces the need for retesting and limits disruption for security and engineering teams.

The company has also published patch-time service level targets tied to upstream fixes. It aims to address Critical and High severity issues within seven calendar days once an upstream patch exists, Medium severity issues within 21 days, and Low severity issues within 28 days.

RapidFort adds that its images are DISA STIG-verified and support FIPS 140-3 requirements. Those specifications are often relevant for regulated sectors and public sector users assessing software supply chain controls.

Partnership signal

The integration is also a commercial marker for RapidFort, which describes the move as part of a scanner-agnostic strategy. Rather than asking customers to replace existing vulnerability tools, the company is positioning its advisory data and image catalogue as an add-on that can fit into established security workflows.

"This important integration extends the stated scanner-agnostic strategy of RapidFort into a named, directory-listed partnership with one of the most prominent players in the category," said George Manuelian, Chief Strategy Officer at RapidFort.

"Joint Wiz customers can now spend fewer hours triaging CVEs that were never exploitable in the first place, and have a documented remediation path the moment a real CVE is found, all inside the scanning tool they already run. Now they do not have to choose between their existing scanner investment and adopting a near-zero CVE image supply chain - these two solutions now work together natively," said Manuelian.

The integration is available through the Wiz integrations directory. RapidFort says the arrangement is intended to show that its advisory feeds and curated image catalogue can plug into partner products rather than requiring customers to adopt a single-vendor security stack.