Overview
- Project Lightwell, which IBM and Red Hat announced Thursday, commits $5 billion and more than 20,000 engineers to scale open‑source security across enterprise software supply chains.
- The program centers on a trusted enterprise clearinghouse where firms can confidentially report flaws, receive AI‑validated and tested patches, and obtain a clearinghouse 'stamp' that signals production readiness.
- IBM and Red Hat say pilots with major banks and payment firms such as Bank of America, JPMorgan Chase, Visa and Mastercard shaped the approach and the service will move to commercial subscriptions priced likely by package counts.
- The effort pairs automated, AI‑assisted triage and validation with human engineers who will perform upstream maintenance, patch development, dependency hardening and release engineering for production environments.
- The launch responds to faster, AI‑driven discovery of vulnerabilities—cited by reports that large language models found thousands of high‑severity flaws—and raises questions about how a commercial clearinghouse will coordinate fixes with open‑source communities for long‑term maintenance.