IBM and Red Hat want to become the 'security clearinghouse' for open source applications in the enterprise

Project Lightwell is a $5 billion initiative that pairs AI systems with 20,000 IBM and Red Hat engineers to create an enterprise clearinghouse for open-source vulnerability discovery and remediation. The clearinghouse is intended to function as an AI-powered security coordination layer that enables enterprises to integrate patches directly into existing software supply chains. The project is in a design phase with 11 financial partners and is expected to be offered as a commercial subscription. The initiative targets the difficulty of patching open-source vulnerabilities quickly enough, despite widespread use of open-source code across enterprise software supply chains. Open-source security risk is supported by high volumes of published CVEs and newly found high- or critical-severity vulnerabilities.

"The $5 billion Project Lightwell initiative combines AI systems with 20,000 engineers to deliver validated fixes directly into enterprise software supply chains without disruptive upgrades."

"Announced today, the project will commit $5 billion and 20,000 IBM and Red Hat engineers to build a new 'enterprise clearinghouse' to accelerate discovery and remediation of vulnerabilities in open source software. The companies say the clearinghouse will serve as an AI-powered "security coordination layer," giving enterprises the ability to integrate patches directly into their existing software supply chains."

""The advancement in AI tools has broken the patching map, which is the ability to discover vulnerabilities in software without losing the speed of remediation," Ashesh Badani, Red Hat SVP and CPO, told CSOonline. "Everyone's running open source software, and the challenge is not being able to fix vulnerabilities quickly enough.""

"Open source security issues have been well documented: Almost 50,000 common vulnerabilities and exposures (CVEs) were published in 2025, and Anthropic's Project Glasswing, powered by its Mythos Preview model, found roughly 3,900 previously undiscovered high or critical severity vulnerabilities in open source software shortly after launch."

Read at InfoWorld