IBM and Red Hat launch Lightwell to automate open source vulnerability remediation

IBM and Red Hat have commercially launched Lightwell, a trust infrastructure platform designed to automate vulnerability remediation across enterprise open source software at scale.

The launch delivers two offerings: Lightwell Network, which is generally available now, and Lightwell Clearinghouse Premier, which has entered a limited-availability commercial onboarding phase.

Lightwell Network gives organisations access to a catalogue of more than 6,500 remediated, digitally signed and certified application-layer dependencies across major ecosystems including Java and Python.

Members receive digitally signed binaries, source code and compliance artefacts - including Software Bills of Materials (SBOMs) - delivered directly into existing pipelines.

Lightwell Clearinghouse Premier is designed to act as a trusted intermediary for secured patch embargoes and vertical threat coordination. Its initial commercial phase is limited to the financial services industry, with Red Hat and IBM planning to expand to government, healthcare and telecommunications in future phases.

The launch builds on a $5 billion commitment to open source security that IBM and Red Hat announced in May 2026, backed by a global team of more than 20,000 engineers.

Lightwell uses a generative AI-powered remediation engine that the companies said is already operating at scale, combining frontier and open AI models with human engineering to identify, validate and remediate vulnerabilities.

A core feature is the ability to backport critical fixes to specific long-lived production software versions, the companies said, avoiding the regression testing burden that can arise from major upstream upgrades.

Red Hat and IBM said they expect Lightwell's remediated package catalogue to scale from thousands to millions of packages.

"Lightwell represents a fundamental structural shift in how we secure all enterprise software," said Matt Hicks, president and chief executive at Red Hat.

"By pairing automated remediation with our deep engineering heritage, we aim to deliver the trusted infrastructure required to consume open source reliably, sustainably, and at AI speeds."

"IBM and Red Hat are giving enterprises certified fixes they can pull straight into the systems they already run, with no retooling or disruption, backed by a growing network of technology and delivery partners," Rob Thomas, senior vice president of software and chief commercial officer at IBM, said.

"Making that possible takes scale most organisations don't have, a world-class team of engineers and AI systems working around the clock to protect the open source software the world's enterprises run on."

Lightwell is supported by a technology partner ecosystem that includes AWS, AMD, F5, GitLab, Intel, JFrog, Microsoft, NVIDIA, Palo Alto Networks and ServiceNow.

Deployment and integration services are available through IBM Consulting, Red Hat Consulting, Accenture, Deloitte, Infosys, Kyndryl, NTT DATA and Tata Consultancy Services, among others.