CISO Tribune

Vendor comparison · 2 companies

Archipelo vs Minimus

Archipelo develops Salmon, Execution Verification Infrastructure for establishing cryptographically verifiable execution history and state lineage. Minimus sells minimal container images that it rebuilds from upstream source, with only the packages needed to run the application. CISO Tribune files both under Software supply chain security. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Archipelo
  • Minimus
Archipelo vs Minimus: Products, Customers and Funding Compared
ArchipeloArchipelo develops Salmon, Execution Verification Infrastructure for establishing cryptographically verifiable execution history and state lineage.archipelo.comMinimusMinimus sells minimal container images that it rebuilds from upstream source, with only the packages needed to run the application.minimus.io
What it sells
  • Salmon[1][2][3][4][5]Execution Verification Infrastructure for establishing cryptographically verifiable execution history and state lineage.
  • Minimus Images[1][4][5][6][8]Minimal container images rebuilt from upstream source with only the packages needed to run the application.
  • Hardened Helm Charts[6]Helm charts that are native and versioned by Minimus.
Categories
Headquarters
Not stated on its pagesNot stated on its pages
Founded
Not stated on its pagesNot stated on its pages
Ownership and funding
Not stated on its pagesNot stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
Not stated on its pagesNot stated on its pages
G2 and Gartner Peer Insights
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, Archipelo's Salmon addresses software in which autonomous agents, tools, runtimes, and controllers perform consequential actions. Archipelo describes incident investigation teams as needing to work backward from a consequential state change toward the execution associated with it. Archipelo names systems that investigate, evaluate, govern, and depend upon execution as the systems for which verifiable execution history matters.Global financial institutions and startups are named among its customers. Minimus offers open access to hardened images for everyone, with an upgrade for teams that need private builds and SLA-backed support. Minimus offers FIPS, STIG, NIST and CIS ready images for sensitive workloads.
Last verified
September 30, 2026November 5, 2026

Where they overlap

  • Software supply chain security is the primary category of both Archipelo and Minimus.

Where they differ, field by field

  • Archipelo is also filed under AI model and agent security and Insider risk management.
  • Archipelo lists Salmon. Minimus lists Minimus Images and Hardened Helm Charts.

How they differ

CISO Tribune files Archipelo under Software supply chain security, AI model and agent security, and Insider risk management, with Software supply chain security as its primary category. CISO Tribune files Minimus under Software supply chain security only, which is also its primary category.

Archipelo sells Salmon, Execution Verification Infrastructure for establishing cryptographically verifiable execution history and state lineage. Archipelo builds Salmon for autonomous multi-actor software systems, and it says Salmon captures execution as it occurs upstream within supported environments. Archipelo describes itself as a deep tech company building foundational infrastructure for verifiable autonomous systems. Minimus sells minimal container images that it rebuilds from upstream source, with only the packages needed to run the application. Minimus also sells Hardened Helm Charts, which are native and versioned by Minimus. Its images are built in a SLSA Level 3 pipeline when upstream updates occur, and FIPS 140-3 modules are available. Minimus names global financial institutions and startups as customers.

Minimus states that it is winding down operations, and that Echo has acquired key Minimus technology and assets. Minimus says it is working with the Echo team and meeting with every Minimus customer to provide support during the transition period. Archipelo states that Salmon does not manufacture execution continuity when continuity has not been established.

What it sells: Archipelo

What Salmon does[1][2][3][4][5]
Salmon is Execution Verification Infrastructure for establishing cryptographically verifiable execution history and state lineage. Execution is represented as a cryptographically signed event with explicit context. Salmon captures execution as it occurs upstream within supported environments.

What it sells: Minimus

What Minimus Images does[1][4][5][6][8]
Minimus images contain only the software needed to run an application, with shells, package managers, and network utilities stripped out. Minimus builds them from source continuously, and they are OCI-compliant, with FIPS 140-3 modules available. Minimus rebuilds images in a SLSA Level 3 pipeline when upstream updates occur.
What Hardened Helm Charts does[6]
Minimus publishes Hardened Helm Charts that are native and versioned by Minimus. Customers can pull from the registry of their choice, and fully air-gapped support is available.

Questions about Archipelo and Minimus

What do Archipelo and Minimus sell?
Archipelo sells Salmon. Minimus sells Minimus Images and Hardened Helm Charts.
Are Archipelo and Minimus in the same category?
Yes. Software supply chain security is the primary category of both on CISO Tribune.
Who are Archipelo and Minimus sold to?
From its own pages, Archipelo's Salmon addresses software in which autonomous agents, tools, runtimes, and controllers perform consequential actions. Global financial institutions and startups are named among its customers.

About Archipelo

Archipelo develops Salmon, Execution Verification Infrastructure for establishing cryptographically verifiable execution history and state lineage. Archipelo builds Salmon for autonomous multi-actor software systems. Archipelo, Inc. is the company developing and stewarding Salmon.[1][3][4][5]

Archipelo states that autonomous agents, tools, runtimes, and controllers increasingly perform consequential actions themselves. Archipelo states that the resulting state alone cannot show which execution occurred, in what order, or how each state transition derived from the ones before it. Archipelo develops infrastructure that makes autonomous multi-actor software execution independently verifiable. Archipelo states that safe and reliable agents need verifiable evidence of their execution history.[4][5]

Archipelo points to Git as showing the value of persistent, linked source code history. Archipelo says Execution Verification Infrastructure addresses a different problem, which is establishing a verifiable record of state transitions and the resulting state.

Archipelo describes execution as represented by a cryptographically signed event with explicit context. Archipelo states that Salmon captures execution as it occurs upstream within supported environments, not downstream after the event has already taken place. Archipelo states that Salmon does not visually or structurally manufacture execution continuity when execution continuity has not been established.

Archipelo states that agent generated changes can involve delegated execution, tools, subprocesses and multiple state transitions. Archipelo states that execution history provides a durable record of supported execution relationships to verify outcomes. Archipelo states that during incident investigation, teams need to work backward from a consequential state change toward the execution associated with it, to determine what caused the outcome.

One principle is that downstream systems should not be forced to establish execution history solely through retrospective inference where it can be captured during supported execution. Archipelo states that what an actor was permitted or instructed to do is distinct from what it actually executed. Archipelo states that machine-speed software systems require execution evidence that other software systems can consume and verify. Archipelo describes identity, policy, observability, security, engineering, and governance systems as solving adjacent problems.[5]

Archipelo describes itself as a deep tech company building foundational infrastructure for verifiable autonomous systems.[1][3][4][5]

Archipelo on the record

Sources

Archipelo full record

  1. [1]archipelo.comArchipelo · archipelo.com · undated page, accessed September 30, 2026 · Tier A
  2. [2]Archipelo - Making Autonomous Software Execution VerifiableArchipelo · undated page, accessed October 30, 2026 · Tier A
  3. [3]Terms of Service — SalmonArchipelo, Inc. · published September 20, 2026 · Tier A
  4. [4]Archipelo - This page has been retiredArchipelo · undated page, accessed October 30, 2026 · Tier A
  5. [5]About — SalmonArchipelo · undated page, accessed November 10, 2026 · Tier A

Minimus full record

  1. [1]minimus.ioMinimus · minimus.io · undated page, accessed November 5, 2026 · Tier A
  2. [2]Meet Minimus | Innovators in Container and Cloud SecurityMinimus · undated page, accessed November 5, 2026 · Tier A
  3. [3]CVE Reduction Calculator | Minimus Container SecurityMinimus · undated page, accessed November 10, 2026 · Tier A
  4. [4]Free Hardened Container Images | MinimusMinimus · undated page, accessed November 10, 2026 · Tier A
  5. [5]Build Faster with Hardened Images | How Minimus WorksMinimus · undated page, accessed November 10, 2026 · Tier A
  6. [6]Zero CVEs - Minimus PlatformMinimus · undated page, accessed November 10, 2026 · Tier A
  7. [7]Minimus Trust Center | SOC-2 & ISO 27001 Certified Security StandardsMinimus · undated page, accessed November 10, 2026 · Tier A
  8. [8]Pricing Plans - Free & Enterprise | MinimusMinimus · undated page, accessed November 10, 2026 · Tier A

Spot a factual error? Request a correction.