RapidFort Lands $42M to Scale Software Supply Chain Security

A supply chain security startup led by the ex-CEO of Percipio raised $42 million to bring years of internally developed technology into the commercial market.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

The Blue Cloud Ventures and Forgepoint Capital-led Series A funding will help San Francisco-based RapidFort reduce developer lift by delivering secure, clean images and tooling that integrates seamlessly into existing workflows, said founder and CEO Mehran Farimani. He said customer demand is driven by compliance, open-source risk and the growing complexity of containerized environments.

“We thought that it was a good idea to get additional investment to increase our firepower, especially on the GTM side, as we introduce the products that we’ve been building for the past four or five years into the commercial market,” Farimani told Information Security Media Group.

RapidFort, founded in 2020, employs 85 people and has raised nearly $53 million, having last completed an $8.5 million seed round in June 2022 led by Felicis. The company has been led since inception by Farimani, who previously spent more than 11 years leading artificial intelligence development company Percipio, which focused on how computers interact with humans.

Why Modern Software Is Difficult to Safeguard

Unlike many startups that follow a rigid venture funding timeline, Farimani said RapidFort deliberately combined bootstrapping with selective fundraising over several years. This approach allowed the company to mature its technology quietly, including work with U.S. defense agencies, before pushing aggressively into the commercial market, Farimani said.

“We’ve taken a different path than a typical startup in terms of fundraising,” Farimani said. “It’s been a mix of bootstrapping and fundraising for the most part. We worked with several defense agencies previously, and we still are engaged with them at this point.”

As RapidFort’s platform has grown richer and more capable, he said the engineering effort required to maintain, scale and extend it has increased correspondingly. RapidFort wants to ensure its platform remains fast, reliable and capable as customer demands grow, and the funding will help the company identify emerging market needs, validate them with customers and selectively invest in new product initiatives, Farimani said.

“There are a number of new opportunities in the market as the market shifts very quickly for addressing customer pain points and building things that actually add value to businesses,” Farimani said. “You have to invest in the research phase. You have to test it with customers, see if there’s a market, that there’s a need, if it’s really the thing that customers want.”

Modern software is overwhelmingly composed of third-party and open-source components written by unknown contributors, and Farimani said customers are focused on reducing measurable, quantifiable risk. True market demand emerges where organizations feel real pressure from customers, regulators or internal risk assessments to address these vulnerabilities in a concrete way, Farimani said.

“We have a much more complex system in place today that we had three years ago just in terms of capabilities and functionalities and the amount of software that’s in it,” Farimani said. “And to scale that obviously requires some amounts of engineering scaling as well.”

Why AI Adoption Introduces New, Poorly Understood Risks

RapidFort wants to address security risks in ways that feel natural and non-intrusive to development teams by providing clean, secure images that behave just like the images developers already use, he said. A low-lift approach is key to adoption and is also what enables security and engineering teams to collaborate rather than conflict, Farimani said.

“We wake up in the morning and we are workers to invent systems, design systems, create features, solve customer problems,” Farimani said. “It’s not necessarily chasing down issues in open-source software. That’s a large part of what we used to build. But it’s not really that focus. It’s not what we wake up in the morning and think about – the quality of that software, security risk that it brings in.”

AI adoption introduces new and poorly understood risks due to the systems that AI models touch, the data they can reach and how they interact with infrastructure, he said. RapidFort’s experience with instrumentation, workflow analysis and system-level visibility positions it well to address these challenges, he said.

“One of the key things is, ‘Who’s doing what? What are the security risks of doing that? What kind of technologies are they using? And what kind of access do they have to the infrastructure?'” Farimani said. “And that is actually a very unsolved problem today. So first, understanding what they’re doing. And then secondly, ‘What are the solutions to mitigate risk and lower that risk?'”

Much of the current demand for software supply chain security is compliance-driven, which includes not only government regulations, but also customer-imposed requirements. Firms increasingly quantify risk through scanning results and CVE counts, which creates pressure to remediate vulnerabilities quickly. As regulatory frameworks proliferate beyond FedRAMP into other standards, behavior changes follow.

“If I build software and I sell that software to my customers who deployed on prem, they have a set of requirements that I have to adhere to and that has transpired itself in a measurable way,” Farimani said. “If I scan your software, how many CVEs do I see and can you minimize that?”