IBM and Red Hat Launch Lightwell Platform to Automate Open-Source Security

IBM and Red Hat have commercially launched Lightwell, an enterprise-grade subscription platform designed to automate vulnerability remediation for open-source software. The system pairs automated artificial intelligence with human engineering verification to deliver secure, pre-patched versions of widely used software packages directly to enterprise developers.

The commercial release builds on Project Lightwell, a joint $5 billion open-source security commitment announced in May 2026. By scaling up Red Hat’s established model of backporting security patches, the platform extends enterprise-grade protection to a broad footprint of third-party open-source components that sit outside of Red Hat’s traditional product portfolio.

Structured as an annual subscription, the platform enters the market with two distinct product tiers integrated directly into existing continuous integration and continuous delivery (CI/CD) pipelines.

---

Continuous SBOM Delivery and Signed Repositories

The first of the two offerings, Lightwell Network, is generally available. The service provides enterprises with access to a secured catalog of verified dependencies. Rather than replacing public registries like Maven Central or PyPI, developers access these Lightwell repositories alongside their existing public open-source registries, integrating them into current build processes.

At launch, the network provides access to more than 6,500 application-layer dependencies across major ecosystems, including Java and Python. Key features of the Lightwell Network include:

• Certified Binaries: Access to compiled, ready-to-deploy assets that have been verified and digitally signed.
• Automated Backporting: Security fixes applied directly to the older, stable software versions running in production, bypassing the breaking changes and regression testing often triggered by major upstream upgrades.
• Active Compliance Mapping: A continuous stream of comprehensive compliance materials, including complete Software Bills of Materials (SBOMs).

This model addresses a critical vulnerability lifecycle challenge. While modern applications rely extensively on nested open-source libraries, manually patching these dependencies often introduces breaking changes. By delivering automated, targeted backports directly into existing pipelines, organizations can resolve vulnerabilities without having to upgrade their entire software stack.

---

Secure Infrastructure for Vulnerability Embargoes

The second offering, Lightwell Clearinghouse Premier, is entering a limited-availability commercial onboarding phase. Designed to serve as a trusted intermediary between enterprise users and the broader open-source ecosystem, its initial rollout focuses on organizations in regulated sectors, starting with financial services.

The clearinghouse is structured to handle patch embargoes—the period between the initial discovery of a security flaw and its public disclosure. This specialized tier provides:

• Secured channels for coordinating industry threat intelligence under strict confidentiality.
• The ability for participating organizations to submit vulnerabilities and request targeted version remediations during an active embargo window.
• Access to Technical Account Manager (TAM) services and anonymized views of other member requests.

This structural coordination allows security teams to verify vulnerabilities, preview patches, and plan mitigations before exploit details are published. Following the initial financial services phase, IBM and Red Hat plan to expand Clearinghouse Premier to other critical infrastructure verticals, including government, healthcare, and telecommunications.

---

The Dual Engine of AI and Human Validation

To manage vulnerability remediation across thousands of distinct open-source packages, the platform uses a hybrid model that pairs generative AI with human oversight.

The technical pipeline operates through structured phases:

1. AI Ingestion and Triage: Automated generative AI engines ingest public and private vulnerability disclosures, analyze the affected code paths, and generate targeted patch fixes.
2. Human Engineering Review: The AI-generated patches are triaged, tested, and validated by a global engineering force of more than 20,000 specialists across IBM and Red Hat.
3. Upstream Contribution: Validated security fixes are contributed back to upstream open-source project communities to maintain ecosystem health.
4. Subscription Delivery: Verified and signed binaries are pushed to the subscription registries for immediate enterprise developer access.

This automated workflow is designed to compress remediation timelines while preventing unverified AI code from slipping into production systems. The platform’s rollout is supported by over 22 technology and deployment partners, including AWS, AMD, Accenture, Deloitte, Intel, Microsoft, and NVIDIA.