IBM and Red Hat believe they have the answer to open source security risks
Project Lightwell is backed by a $5 billion investment and a team of more than 20,000 engineers
IBM and its subsidiary Red Hat are pumping $5 billion into improving the security of open-source projects.
Project Lightwell is designed as an enterprise clearinghouse for open source software, with a new AI-driven model for securing the software supply chain.
The idea is to use advanced AI capabilities, offered through commercial subscriptions, to validate and test fixes across a huge volume of open source code. Enterprises will be able to integrate secure patches directly into their existing software supply chains, say the firms, with enterprise-grade validation and lifecycle management.
They can report and resolve vulnerabilities, receive patches optimized for production environments, spanning both Red Hat offerings and independent community code, and share fixes upstream so that open source communities can include them in long-term maintenance.
And all this will be backed by a team of more than 20,000 engineers working across upstream and enterprise environments. The focus will be on upstream maintenance alongside open source community leaders; high-volume, AI-assisted vulnerability review, triage, and prioritization; and secure patch development, dependency hardening, and release engineering.
"Open source is the backbone of today's digital economy and the foundation of modern AI, and we are at an inflection point in how it is built, secured, and scaled," said Arvind Krishna, chairman and CEO of IBM.
"With Project Lightwell, IBM and Red Hat are helping define a new industry model, one that brings together AI, engineering expertise, and trusted collaboration, to secure open source software at its source and across the entire supply chain. This is about strengthening trust in the systems that power business, government, and society."
IBM and Red Hat are already working with a group of early adopters on Project Lightwell, including Bank of America, BNY, Citi, Goldman Sachs, JPMorganChase, Mastercard, Morgan Stanley, Royal Bank of Canada, State Street, Visa, and Wells Fargo.
"The real-world insights from these initial deployments will actively shape how vulnerabilities are identified, validated, and remediated at scale across complex software supply chains," the firms said.
More than nine-in-ten Fortune 500 companies rely on open source software - but security is an ever-present problem. Sonatype identified 454,648 malicious open source packages in 2025, up 67% on the previous year, with one state-linked group alone tied to more than 800 malicious packages.
Meanwhile, according to Black Duck, 86% of codebases contain open source vulnerabilities, with 81% of those classified as high or critical risk, up from 74% in the previous year.
"Most enterprises cannot keep up with the volume, complexity, and speed of risk. AI-driven vulnerability discovery is accelerating both the volume and speed of CVE creation, compounding an already unsustainable remediation gap," said IBM.
"Project Lightwell delivers validated fixes to the specific open source versions organizations already run. By combining large-scale engineering, AI, and a coordinated clearinghouse model, it enables organizations to move from detection to remediation without disrupting stability, certification, or compliance requirements."
-
‘The build pipeline is becoming the new frontline’: Axios npm compromise highlights growing software supply chain risks, experts warnNews Cyber criminals exploited a hijacked maintainer account to compromise one of the world's most widely used JavaScript libraries
-
Notepad++ hackers remained undetected and pushed malicious updates for six months – here’s who’s responsible, how they did it, and how to check if you’ve been affectedNews Hackers remained undetected for months and distributed malicious updates to Notepad++ users after breaching the text editor software – here's how to check if you've been affected.
-
Developers face a torrent of malware threats as malicious open source packages surge 188%News Researchers have identified more than 16,000 malicious open source packages across popular ecosystems
-
Open source malware surged by 156% in 2024News Hackers are taking advantage of lax verification and surging demand to distribute and scale malware in record time
-
The open source community relies on a loyal army of committed developers – but their security practices are putting the whole ecosystem at riskNews The security of individual developer accounts poses a serious threat to open source ecosystem, according to a new report from the Linux Foundation
-
Here's what you need to know about the upcoming curl security patchesNews Developers behind the open source library described one Curl vulnerability as one of the worst they've ever encountered
