There is a peculiar ritual in software security. A scanner discovers several hundred vulnerabilities, everyone admires the dashboard, and then the findings are exported into tickets for developers who did not introduce the vulnerable code and may not control it. The tool has technically succeeded. The humans have inherited a second job. Root built its company around refusing that handoff.
The Boston startup's proposition was blunt: do not merely tell a team which open-source package is vulnerable. Produce a fixed version of the container image or library it already uses, test that artifact, sign the evidence and deliver it through the registry and pipeline already in place. An ordinary onboarding example changed one Dockerfile line from FROM node:20 to FROM cr.root.io/node:20. The application remained itself. Root took responsibility for the patching churn behind it.
That idea eventually made Root attractive to Aikido Security, which acquired the company on June 30, 2026 for an undisclosed price. Aikido had the finding side of the loop. Root had spent years learning how to make a tested fix arrive without the standard instruction to "just upgrade" and hope production survived.
The company inside the pivot
Root did not begin as Root. In 2020, John Amaral and Kyle Quest founded Slim.AI around DockerSlim, Quest's popular open-source project for analyzing and reducing container images. The original product helped developers understand what lived inside an image, remove excess components and ship a smaller attack surface. It was practical, developer-friendly work at a moment when containers were becoming the default package for cloud software.
Investors liked the terrain. Slim.AI announced a $6.6 million seed round in January 2021, followed by a $31 million Series A in January 2022 co-led by Insight Partners and StepStone Group. The company had raised $37.6 million in disclosed capital. Its pitch was optimization and security for cloud-native applications, with the charmingly economical slogan that the best vulnerability is one you never ship.
But smaller images were only adjacent to the expensive problem. Customers still faced giant vulnerability backlogs. Scanners differed over what counted as a finding. Official fixes could require a major-version jump, and that jump might break the application. Teams either delayed the upgrade or spent sprint after sprint researching, rebuilding, testing and documenting patches. Root's leadership saw that its container expertise could remove the work instead of improving the description of it.
The product moved toward automated vulnerability remediation in 2024, and the company rebranded as Root in early 2025. Ian Riopel, a former military counterintelligence agent with security roles at Cisco, CloudLock and Rapid7, became CEO. Amaral served as CTO. Benji Kalman and Mickey Gordon joined the founding group behind the new direction. The name carried a tidy joke: the company wanted the root cause, not another branch of alerts.
“The cybersecurity industry assumes you have to start with a long list of vulnerabilities. We can just fix it all.”Ian Riopel, co-founder and CEO
A patch factory, not a magic wand
Root's agents monitored open-source packages, inspected dependency graphs and matched vulnerabilities to affected code. Where an upstream fix existed, the system could apply it. Where the customer's version had no official fix, Root could backport the smallest relevant change. A validation pipeline then checked whether the vulnerability disappeared, whether the software still functioned, whether performance held and whether the result worked across supported environments.
The distinction from hardened-image vendors matters. Chainguard and Docker Hardened Images often start with a deliberately minimal new base. Root's pitch was preservation: keep the base, configuration and version line, then change only the vulnerable pieces. The trade can reduce migration risk, although every backport still creates something that must be trusted and maintained. Root answered that concern with rollback mechanisms, source publication where licenses required it, and SBOM, VEX, provenance and attestation artifacts.
The business model paired free distribution with enterprise urgency. Root launched a public catalog of nearly 40 curated images and offered a Community tier for up to three images. Paid plans added private remediation, broader coverage, integration, support and contractual response commitments. Its AWS Marketplace listing described Essentials, Professional and Enterprise tiers on 12-month terms billed monthly, but did not post dollar prices. In other words, the free artifact demonstrated the machinery; enterprises paid to point that machinery at their own backlog and attach an SLA.
Who bought the result
Root fit best with application-security, platform and DevSecOps teams running Linux containers, particularly where pinned dependencies and audit requirements made wholesale upgrades unpleasant. Public customers included defense consultancy SixWorks, data-governance company BigID, privacy service DeleteMe and data-integration provider Datuum. These were not lifestyle users polishing a homelab. They had production fleets, regulated buyers and expensive engineers losing time to CVE housekeeping.
Datuum supplied the cleanest case study. A three-person security team managed more than a million daily data transformations and a fleet that grew from 100 to more than 200 containers. Root reported a 98 percent reduction in critical and high vulnerabilities during the first week, a cut in manual security review from 40 hours to four per week, and 24-hour patch deployment. SixWorks said a vulnerability fix that had taken two to three weeks could take two to three minutes. BigID reported getting 15-plus hours back each week. DeleteMe said it reached zero critical and high CVEs across its fleet in two weeks.
Those figures come from Root's customer material, so they should be read as reported outcomes rather than universal benchmarks. Still, they reveal what customers were buying: elapsed time and recovered attention. Root did not need to convince a CISO that vulnerabilities existed. It needed to prove the queue could shrink without turning developers into an unpaid patch department.
The partnership that became the exit
Distribution followed the tools developers already used. Root supported GitHub Actions, GitLab CI and Jenkins, plus Docker Hub, GitHub Container Registry, GitLab, Amazon ECR, Google registries, Red Hat Quay and Sonatype Nexus. A Trivy integration let the open-source scanner hand findings to Root's remediation system. The relationship was deliberately complementary: Trivy found; Root fixed.
Aikido offered an even clearer match. In July 2025, the companies connected Aikido's Autofix workflow to Root's hardened container images. That partnership gave both sides a year to watch the combined experience under real customer conditions. When Aikido acquired Root in June 2026, the logic was already visible: one platform could detect vulnerable or malicious open source and then deliver a drop-in patched version at the exact version a customer ran.
The acquisition also answered what had changed Root's mind. The original thesis assumed developers needed better container tools. The later thesis observed that developers had become the unwilling last mile of security operations. Then AI coding agents increased the rate at which dependencies entered software. Root's response was not a louder warning system but another set of agents working on repair. Aikido bought that capability because detection without action was becoming an incomplete product.
What a builder can copy
- Follow the hated work. Slimming was useful; patching was the recurring task customers urgently wanted gone.
- Sell a finished state. "Zero critical findings" is easier to value than another configurable dashboard.
- Preserve the workflow. A one-line registry change lowered adoption cost more than a grand platform migration would.
- Make proof part of the output. The patch, tests, SBOM, VEX and provenance traveled together.
- Partner before combining. Aikido and Root integrated first, turning customer use into practical acquisition diligence.
Where the model stops
Root was not a universal cure. It focused on Linux-based container stacks and explicitly did not support Windows containers. A team still needed a compatible image, library, registry or CI/CD route. Bespoke binaries, unusual distributions and unsupported ecosystems could sit outside the catalog. Organizations unwilling to trust a third party to rebuild or backport critical components would prefer internal ownership, even if it cost more time.
Nor did in-place patching erase the need for architecture, access control, runtime defense or secure code. A clean base image cannot rescue a vulnerable business-logic path. And version preservation has a natural limit: eventually an obsolete stack should be upgraded rather than indefinitely embalmed with patches. Root worked when the immediate risk of a known vulnerability outweighed the cost of consuming a verified replacement artifact, and when preserving behavior was more valuable than chasing the newest release.
Within those conditions, the company found a sharp place in the market. Scanners made risk visible. Minimal-image vendors offered a safer new foundation. Internal teams could rebuild and backport by hand. Root occupied the awkward middle: the current artifact, still needed, currently vulnerable, and too risky to casually replace. It turned that exception queue into a product.
The final lesson is less about containers than ownership. A category can spend years moving work between teams while calling the motion progress. Root's useful provocation was to ask whether the vendor could own more of the result. The answer was expensive to build, bounded in practice and valuable enough that a former partner decided to buy it.