IBM and Red Hat announce Project Lightwell: a $5 billion investment to secure open source software with AI.
The initiative consists of a trusted clearinghouse combined with a global team of more than 20,000 engineers, supplemented by AI capabilities to detect and remediate vulnerabilities. IBM already uses more than 62,000 open source packages, with in-depth expertise in more than 10,000.
The clearinghouse serves as a secure coordination layer. Enterprises can report sensitive security issues they have discovered in their active software versions. IBM and Red Hat validate and test fixes using AI capabilities, after which companies receive validated patches suitable for production environments. This applies not only to Red Hat products but also to independent open-source libraries, AI frameworks, and data streaming platforms. Fixes are also shared upstream with the broader open-source community.
IBM is building on lessons learned from initiatives such as Anthropic’s Project Glasswing and OpenAI’s Trust Access for Cyber. The clearinghouse model is offered through commercial subscriptions, allowing enterprises to integrate validated patches directly into their existing software supply chains.
AI and 20,000 Engineers
While many technology companies are using AI to reduce technical headcount, IBM is going in the opposite direction. Its team of 20,000 engineers focuses on upstream maintenance alongside open-source community members, AI-assisted vulnerability analysis, and secure patch development. IBM explicitly positions this technical capacity as a strategic differentiator.
A Red Hat report from early 2026 already showed that 97 percent of organizations experienced at least one cloud security incident in the past year, and 74 percent run software with known vulnerabilities. Additionally, Red Hat and OpenSSF are collaborating on compliance with the EU Cyber Resilience Act to protect the open-source supply chain.
For the initial deployments, IBM and Red Hat are collaborating with a group of major financial institutions, including Bank of America, Goldman Sachs, JPMorgan Chase, Mastercard, Visa, and Wells Fargo. Insights from these deployments will further refine the approach to vulnerability management at scale.
Tip: Red Hat is unlocking the future with Model-as-a-Service and AgentOps