Representative End User Clients
Representative Automation Clients
Representative Software Clients
Open source software underpins a vast swath of modern enterprise infrastructure. At the same time, advances in frontier AI are accelerating vulnerability discovery and exploitation. AI provider Anthropic recently reported that its Mythos Preview model has helped identify a large volume of open source software vulnerabilities, with estimates suggesting that nearly 3,900 high- or critical-severity vulnerabilities could be confirmed.
To address this concern, IBM and Red Hat announced Project Lightwell, a $5 billion commitment backed by new frontier AI capabilities and a global force of more than 20,000 engineers to help enterprises secure open source software. Together, these investments are intended to establish a new model for enterprise use of open source software, from upstream development through production environments.
Project Lightwell is slated to establish a trusted enterprise clearinghouse combined with a global force of engineers to identify and fix vulnerabilities at scale. The clearinghouse will serve as a security coordination layer, using advanced AI capabilities to validate and test fixes across an unprecedented volume of open source code. These capabilities will be offered through commercial subscriptions, allowing enterprises to integrate secure patches directly into their existing software supply chains with enterprise-grade validation and lifecycle management.
Project Lightwell builds on IBM and Red Hat’s enterprise open source model, extending it beyond their traditional product footprint while incorporating learnings from initiatives such as Anthropic’s Project Glasswing and OpenAI’s Trusted Access for Cyber. The goal is to use new IBM agentic security methods to protect the foundational open source layers that underpin modern enterprise and AI systems.
IBM already uses more than 62,000 open source packages. Across technologies such as Linux, Java, Kubernetes, Kafka, Ansible, Terraform, Flink, Cassandra, and more, the companies operate one of the industry’s broadest commercial open source ecosystems, historically providing lifecycle management, validation, and patching for components within their platforms. Now, IBM and Red Hat are applying the same engineering discipline to the broader application landscape, including independent libraries, language toolchains, AI frameworks, and data streaming platforms.
This approach is intended to directly address the operational vulnerabilities enterprises face when managing independent open source code on their own. Through the clearinghouse model, enterprise organizations can:
Report and Resolve Vulnerabilities: Responsibly share sensitive security issues discovered in their active software versions within a trusted intermediary framework.
Deploy Validated Patches: Receive patches optimized for production environments, spanning both Red Hat offerings and independent community code.
Coordinate Upstream Disclosures: Share fixes upstream so that open source communities can include them in long-term maintenance.
AI-Powered Engineering at Global Scale
At a time when many technology companies are using AI to reduce technical headcount, IBM and Red Hat are taking a different approach, positioning technical engineering capacity as a premium strategic asset and a source of market differentiation. IBM and Red Hat will deploy a team of more than 20,000 engineers, augmented by advanced AI capabilities. This global technical force will operate across upstream and enterprise environments, focusing on:
Upstream maintenance alongside open source community leaders.
High-volume, AI-assisted vulnerability review, triage, and prioritization.
Secure patch development, dependency hardening, and release engineering.
Project Lightwell supports government priorities to secure digital infrastructure, protect critical systems, and strengthen the overall resilience of open source software ecosystems.
Find out more about the digital transformation of industry, energy, and critical infrastructure.