Startup Echo Software Ltd. announced today that it is acquiring the assets of Minimus Inc., a company that focused on minimal, hardened containers. The deal follows Minimus’s decision to wind down operations, allowing Echo to integrate the technology into its existing platform. This move expands Echo’s ability to support a wider range of Linux distributions, making its approach to secure software more flexible.
Echo’s core business uses artificial intelligence agents to identify and fix vulnerable components in container images before they reach production. Instead of just scanning for problems, the company rebuilds software artifacts to ensure they are free of known issues. This process provides customers with containerized software images, software bills of materials, and digital signatures that verify the integrity of the software.
Minimus specialized in creating minimal container images that included only the runtime dependencies an application needed. By removing unnecessary tools like package managers or shells, the company reduced the potential attack surface. Echo plans to add this technology to its fleet of AI agents, which investigate vulnerabilities and develop patches. The company notes that these agents require fresh, high-quality data to operate accurately.
Related: Z.ai Releases Open-Source Ox Alpha as GLM-5.3-Flash
Minimus co-founder Ben Bernstein said the priority was finding a home for the technology and ensuring a good path forward for their customers. Echo co-founder and Chief Executive Eilon Elhadad agreed, stating that organizations should not inherit unnecessary risk simply because they depend on open-source software.
Market context for hardened containers
Containers are lightweight, portable packages that bundle application code, runtime libraries, and dependencies. This bundling is standard for software distribution in both on-premises and cloud environments. However, if a container or its dependencies contains a vulnerability, an attacker can exploit the flaw to access secure systems. By providing continuously updated, hardened containers and libraries, Echo aims to reduce exposure to these unvetted components.
The open-source ecosystem continues to face challenges with complex dependencies. Black Duck Software Inc. found that 87% of audited commercial codebases contained at least one open-source vulnerability, with an average of 581 vulnerabilities per codebase. The report also noted that 65% of surveyed organizations reported a software supply-chain attack in the preceding year.