RapidFort used Black Hat USA to announce RapidFort Runtime, a companion to the curated open-source packages it already sells that watches those packages once they are executing in production. Per the release, the runtime component runs in read-only mode, continuously monitoring workloads, tracking changes and surfacing what the company calls actionable mitigations. For CI/CD and platform teams, the interesting part of the announcement is not the product itself, it is the seam it aims at: what a pipeline signed and shipped versus what is actually running on the pod an hour later.
What RapidFort is claiming
The company frames Runtime as a natural extension of its existing business, which is selling reduced, hardened builds of common open-source components. Michael Wood, chief marketing officer at RapidFort, said the goal is to make it simpler for DevOps teams to run those curated packages in their production environments while getting continuous visibility into changes and mitigations. There is no enforcement layer in the description that has been made public: the tool watches, it does not block.
The operational read
Runtime security agents live on a small set of trade-offs. Read-only sidesteps the sharpest one, blast radius, at the cost of pushing enforcement onto whatever already handles admission control or restart policy in the cluster. Continuous monitoring adds another agent to justify to the platform, security and finance teams that already own the node budget. And the value depends entirely on the signal-to-noise ratio of the mitigation feed. A firehose of low-severity findings, keyed to production namespaces, is worse than none, because it burns the on-call attention the tool is supposed to protect.
