- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,448
The largest financial corporations in the world became the first participants in the new security project from IBM.
IBM and Red Hat announced the launch of Project Lightwell, a $5 billion project to protect open source software. The companies expect that the new initiative will help organizations to quickly find vulnerabilities in the open code, check the fixes and implement updates to work systems.
Project Lightwell will operate as a trusted platform for companies that use open software in products and internal infrastructure. IBM and Red Hat plan to use tools based on artificial intelligence and more than 20 000 engineers in the project. The system should help identify vulnerabilities, check patches on a large volume of open source code and transfer proven updates to organizations.
According to IBM and Red Hat, open software is at the heart of modern enterprise infrastructure, and more than 90% of Fortune 500 companies depend on such solutions. The companies also point out that the development of artificial intelligence helps not only to find mistakes faster, but also speeds up the work of intruders who exploit them. IBM refers to Anthropic data, according to which the Mythos Preview model found almost 3900 high- and critical hazard vulnerabilities in open software.
Project Lightwell should become an intermediate between open source companies, suppliers and communities. Organizations will be able to transmit information about security issues through a trusted intermediary, receive verified fixes for working environments, and send patches to open project developers so that they include fixes in long-term support.
IBM and Red Hat have already started working with the first participants of the project. Among them are Bank of America, BNY, Citi, Goldman Sachs, JPMorganChase, Mastercard, Morgan Stanley, Royal Bank of Canada, State Street, and Wells Fargo. The companies plan to build on the first experience to refine the way they find, verify, and address vulnerabilities in software supply chains.
Project Lightwell expands the existing corporate open source support model. IBM reports that it uses more than 62 000 open packages and has a deep examination of more than 10 000 of them. Previously, IBM and Red Hat mostly checked, corrected and accompanied the components inside their own platforms. Now a similar approach is wanted to be applied to a wider set of projects, including independent libraries, language tools, artificial intelligence platforms, and data streaming systems.
Companies say they intend to use artificial intelligence as a tool for engineering teams, not as a replacement for engineers. Among the tasks of Project Lightwell, IBM and Red Hat are the following: massively check vulnerabilities, sort finds, develop fixes, strengthen addictions and prepare releases.
Project Lightwell will be available via commercial subscriptions. IBM and Red Hat expect companies to be able to build proven fixes into their own software supply chains. At the same time, patches are planned to be transferred to open projects through a responsible disclosure of vulnerabilities.
IBM and Red Hat announced the launch of Project Lightwell, a $5 billion project to protect open source software. The companies expect that the new initiative will help organizations to quickly find vulnerabilities in the open code, check the fixes and implement updates to work systems.
Project Lightwell will operate as a trusted platform for companies that use open software in products and internal infrastructure. IBM and Red Hat plan to use tools based on artificial intelligence and more than 20 000 engineers in the project. The system should help identify vulnerabilities, check patches on a large volume of open source code and transfer proven updates to organizations.
According to IBM and Red Hat, open software is at the heart of modern enterprise infrastructure, and more than 90% of Fortune 500 companies depend on such solutions. The companies also point out that the development of artificial intelligence helps not only to find mistakes faster, but also speeds up the work of intruders who exploit them. IBM refers to Anthropic data, according to which the Mythos Preview model found almost 3900 high- and critical hazard vulnerabilities in open software.
Project Lightwell should become an intermediate between open source companies, suppliers and communities. Organizations will be able to transmit information about security issues through a trusted intermediary, receive verified fixes for working environments, and send patches to open project developers so that they include fixes in long-term support.
IBM and Red Hat have already started working with the first participants of the project. Among them are Bank of America, BNY, Citi, Goldman Sachs, JPMorganChase, Mastercard, Morgan Stanley, Royal Bank of Canada, State Street, and Wells Fargo. The companies plan to build on the first experience to refine the way they find, verify, and address vulnerabilities in software supply chains.
Project Lightwell expands the existing corporate open source support model. IBM reports that it uses more than 62 000 open packages and has a deep examination of more than 10 000 of them. Previously, IBM and Red Hat mostly checked, corrected and accompanied the components inside their own platforms. Now a similar approach is wanted to be applied to a wider set of projects, including independent libraries, language tools, artificial intelligence platforms, and data streaming systems.
Companies say they intend to use artificial intelligence as a tool for engineering teams, not as a replacement for engineers. Among the tasks of Project Lightwell, IBM and Red Hat are the following: massively check vulnerabilities, sort finds, develop fixes, strengthen addictions and prepare releases.
Project Lightwell will be available via commercial subscriptions. IBM and Red Hat expect companies to be able to build proven fixes into their own software supply chains. At the same time, patches are planned to be transferred to open projects through a responsible disclosure of vulnerabilities.
