Surprisingly Useful AI Article Enhancements
IBM and Red Hat have commercially launched Lightwell, a platform that delivers automated vulnerability remediation through two offerings: Lightwell Network and Lightwell Clearinghouse Premier.
Lightwell Network gives enterprises access to a catalogue of more than 6,500 remediated, digitally signed and certified application-layer dependencies across ecosystems including Java and Python. Lightwell Clearinghouse Premier has entered a limited-availability phase, serving as an intermediary for secured patch embargoes and vertical threat coordination.
The launch builds on a $5 billion commitment to open source security that IBM and Red Hat announced in May 2026, backed by more than 20,000 engineers tasked with overseeing and scaling the platform’s AI-driven remediation capabilities.
The Problem Lightwell Aims To Solve
Open source software comprises up to 90 per cent of enterprise codebases and drove 9.8 trillion downloads in 2025. According to industry research, codebases carry an average of 581 vulnerabilities, while AI-generated exploits can now be produced for as little as $50.
Traditional patch management has struggled to keep up with this volume, and organisations often face a difficult choice between applying disruptive upstream upgrades or leaving known vulnerabilities unaddressed.
Lightwell is designed to break that deadlock by using automation to backport fixes directly to specific, long-lived production software versions. This avoids the lengthy regression testing and breaking changes that often accompany major upstream upgrades.
Matt Hicks, President and CEO of Red Hat, described the launch as “a structural shift in how we secure enterprise software.”
“By pairing automated remediation with our engineering heritage, we aim to deliver the infrastructure required to consume open source reliably, sustainably and at AI speeds,” Hicks added.
How The Platform Works
At the core of Lightwell is a generative AI-powered remediation engine that combines frontier and open AI models with human engineering expertise to identify, validate and remediate vulnerabilities across dependencies embedded within software architectures.
The engine is designed to evaluate application context and dependency interactions, delivering validated fixes into active workflows rather than requiring organisations to overhaul their existing environments.
Red Hat and IBM expect the catalogue of remediated packages to scale from thousands to millions as the AI engine continues to operate.
Rob Thomas, Senior Vice President of Software and Chief Commercial Officer at IBM, explained that the platform is designed to slot into existing infrastructure.
“IBM and Red Hat are giving enterprises certified fixes they can pull straight into the systems they already run, with no retooling or disruption, backed by a growing network of technology and delivery partners,” Thomas commented. “Making that possible takes scale most organisations don’t have – a team of engineers and AI systems working around the clock to protect the open source software the world’s enterprises run on.”
Two Commercial Offerings
Lightwell Network is generally available, providing access to a library of content spanning latest to legacy libraries with remediations. Members receive a continuous stream of digitally signed binaries, source code and compliance artefacts including Software Bills of Materials (SBOMs), delivered into existing pipelines without code drift.
Lightwell Clearinghouse Premier is entering a limited-availability commercial onboarding phase. It is designed as an intermediary for industry collaboration, threat coordination and secured patch embargoes. Participating organisations can submit vulnerabilities and request targeted version remediation under an embargo window.
Related: Best Business Laptops for work & school
Related: Best Gaming Laptops
Related: Best Portable Laptop
The Clearinghouse Premier tier is initially limited to the financial services industry, with plans to expand to government, healthcare and telecommunications in subsequent phases. Commercial entry remains gated to qualified participating organisations due to the specialised legal, geographic and disclosure frameworks required to operate sector-specific clearinghouse networks.
Financial Services As A Starting Point
The platform’s initial rollout reflects active collaboration with design partners from the financial services sector, where regulatory pressure and compliance costs around open source software are particularly acute.
Scott DePasquale, President and CEO of ARC, noted: “No single institution can keep pace with the growing scale and complexity of open source vulnerabilities alone. The financial sector has long demonstrated the value of collaboration in addressing shared security challenges, and initiatives that enable coordinated remediation have the potential to strengthen resilience across the industry.”
Jerry Silva, Program Vice President for IDC Financial Insights, observed that regulated industries “take security seriously, especially in the use of open source software.”
“The partnership bringing Red Hat and IBM together under the Lightwell banner to identify, triage and remediate vulnerabilities will bolster the security and resiliency posture of these organisations globally, ensuring the trust that is the hallmark of the services they provide,” Silva added.
Upstream-Always Model
Lightwell operates under Red Hat’s upstream-always model, in which security fixes are submitted back to the originating open source community for review and acceptance. The approach is intended to ensure commercial protections and community health reinforce one another, preventing project fragmentation without risking in-production zero-day vulnerabilities.
A Growing Partner Ecosystem
More than 22 technology and service providers have aligned with the Lightwell launch.
Technology partners include Amazon Web Services, AMD, F5, GitLab, Intel, JFrog, Microsoft, Nvidia, Palo Alto Networks and ServiceNow.
Deployment and strategy services partners include IBM Consulting, Red Hat Consulting, Accenture, Atos, Cognizant, Deloitte, EY cyber and risk consulting teams, HCLTech, Infosys, Kyndryl, LTM, NTT DATA, Tata Consultancy Services and Tech Mahindra.
These partners help enterprise customers map SBOMs, manage version mapping, ingest Lightwell registries and evaluate pipelines.
What Partners Are Saying
Harpreet Sidhu, Global Cybersecurity Lead at Accenture, stated: “Securing the open source software supply chain has become a complex operational challenge, particularly in regulated industries where the cost of disruption is high. Lightwell can help organisations maintain stability in production environments without forcing them into disruptive upgrade cycles.”
Adnan Amjad, US Cyber Leader at Deloitte, remarked: “As AI accelerates both the pace of software development and the sophistication of threats, enterprises are grappling with open source software risk. Through Deloitte’s alliance with IBM and Red Hat, together we’re helping organisations deploy Lightwell’s capabilities to secure their software supply chains to remediate vulnerabilities without sacrificing speed or operational continuity.”
Mark Hughes, Global Managing Partner for Cybersecurity Services at IBM Consulting, commented: “Lightwell introduces a new model for addressing software supply chain risk through rapid validation and trusted remediation. IBM Consulting is helping enterprises build on that foundation by expanding our services to help organisations prepare for Lightwell and create an operating model that makes cyber operations more continuous and adaptive, rather than reactive.”
Philip Guido, Executive Vice President and Chief Commercial Officer at AMD, pointed to the connection between AI production workloads and supply chain trust.
“As enterprises and the financial sector move AI into full production, trust in the open source software supply chain becomes essential to innovation,” Guido explained. “AMD is proud to work with Red Hat and IBM to advance open source, standards-based technologies that give customers choice and confidence.”
Gal Marder, Chief Strategy Officer at JFrog, highlighted the speed at which threats are evolving.
“We have entered an era of adversarial symmetry. The good guys are innovating rapidly, but bad actors are moving just as fast,” Marder warned. “Today’s AI models are finding gaps far faster than most organisations can patch them, leaving enterprises highly vulnerable to attack.”
Michael Montoya, Chief Technology Operations Officer at F5, echoed this sentiment: “The attack capabilities of frontier AI models have inverted traditional software patching windows. Ecosystem collaboration across regulated industries such as financial services provides tangible blueprints for enterprise cybersecurity going forward.”
Justin Boitano, Vice President of Enterprise AI Platforms at Nvidia, argued that transparency in cyber defence is essential.
“The future of cyber defence cannot be a black box. Defenders need an open ecosystem that combines models with open harnesses, giving them the context, customisation and speed to close vulnerabilities before adversaries can exploit them,” Boitano said.
Anand Oswal, Executive Vice President of AI and Network Security at Palo Alto Networks, described how the integration works in practice: “By integrating their automated remediation engine with Palo Alto Networks virtual patching capabilities, we deliver network-level protection across our customers’ control points through our platformisation strategy.”
Sandy Gupta, Vice President of Partner Development ISV at Microsoft, emphasised the importance of speed: “We’re already working together with IBM and Red Hat as part of the Linux Foundation’s Akrites effort and now extending that collaboration to Lightwell to ensure fixes reach customers as quickly as possible using the fastest delivery mechanisms and tools.”
Bill Pearson, Vice President of Data Centre and AI Software at Intel, noted: “As AI accelerates the scale of software development, it also accelerates cyber risk. Securing the modern software supply chain requires a holistic approach that connects silicon-level trust with community-driven code.”
Systems Integrators Prepare For Deployment
Several consulting firms are positioning themselves to help enterprises adopt Lightwell within their existing environments.
Kevin Sherry, Global Vice President of Services at Red Hat, outlined the consulting approach: “Closing the vulnerability gap from discovery to remediation requires a combination of automation, expertise and technology. Red Hat Consulting has over 20 years of open source development and knowledge and, together with our Security Technical Account Management offering, provides the Lightwell foundation for proactively supporting our customers’ defence posture and remediation processes.”
Vishal Salvi, Global Head of Cybersecurity Service Line at Cognizant, described the firm’s role: “Through Red Hat and IBM’s Lightwell, Cognizant helps organisations address this systematic challenge through refactoring and remediation of core code. We aim to provide clients with the visibility they need to map SBOMs, support the adoption of fixes and assist organisations as they modernise their core systems.”
Sanjeev Mehrotra, Global Head of Cyber Security and Risk Management at Tech Mahindra, added: “Organisations face the challenge of securing increasingly complex dependency ecosystems while maintaining development velocity and operational resilience. Our collaboration with IBM and Red Hat on Lightwell reinforces Tech Mahindra’s commitment to helping enterprises strengthen software supply chain security and operationalise trusted open source at scale.”
Paul Savill, Global Practice Leader for Cyber Resilience and Connectivity at Kyndryl, commented: “Addressing open source software supply chain risk at enterprise scale is a priority for customers across industries. Kyndryl is committed to helping organisations mitigate risk by integrating AI and automation capabilities into their development and operations workflows.”
Kalyan Kumar, President of HCLSoftware, outlined how the firm’s own products complement Lightwell: “Lightwell closes the package-level gap at exactly the right moment in the supply chain. HCLSoftware closes it at the application and endpoint layers through AppScan, BigFix Remediate and HCL DevOps Loop, with AIForce adding intelligence to prioritise and act at pipeline speed.”
Last Updated on July 9, 2026 by Nick Ross
