IBM and Red Hat launch $5B Project Lightwell

IBM and Red Hat announced Project Lightwell, a $5 billion initiative to secure open-source software across enterprise supply chains using AI tools and a global engineering team of more than 20,000 people. The program is designed as a trusted clearinghouse where enterprises can report sensitive vulnerabilities, receive validated fixes, and push remediations back upstream to open-source communities.

The companies said Lightwell will extend Red Hat’s existing maintenance model beyond its own platforms to a broader set of open-source components, including independent libraries, language toolchains, AI frameworks, and data streaming software. IBM plans to offer the capabilities through commercial subscriptions, with validated patches and lifecycle management integrated into enterprise deployment workflows rather than as a standalone scanning product.

Project Lightwell is positioned to reduce the burden of managing vulnerabilities in complex software supply chains, especially in regulated industries that depend on pinned versions and coordinated patching. IBM and Red Hat said early adopters include major financial institutions such as Bank of America, Citi, Goldman Sachs, JPMorganChase, Mastercard, Morgan Stanley, Royal Bank of Canada, State Street, Visa, and Wells Fargo, underscoring the program’s focus on high-risk enterprise environments.