IBM, Red Hat launch open source security project for AI Era

IBM and Red Hat have announced Project Lightwell, a $5 billion effort to help enterprises secure open source software as AI accelerates vulnerability discovery and exploitation. The project will create a trusted enterprise clearinghouse for open source security, backed by frontier AI capabilities and more than 20,000 engineers across IBM and Red Hat.

The clearinghouse is designed to help enterprises identify, validate, and fix vulnerabilities across open source software used in production environments. IBM and Red Hat said the service will support vulnerability reporting, validated patch deployment, and coordinated upstream disclosure, giving enterprises a way to address critical issues while contributing fixes back to open source communities.

The move comes as open source software remains deeply embedded in enterprise infrastructure, including cloud platforms, application stacks, AI systems, and developer toolchains. IBM said more than 90% of Fortune 500 companies rely on open source software, while recent AI research has shown how frontier models can identify thousands of high- and critical-severity vulnerabilities across open source code. That raises the pressure on enterprises to secure the software components they depend on before attackers use similar capabilities at scale.

For MSPs, MSSPs, and security partners, Project Lightwell points to a larger shift in software supply chain security. Customers will need more help understanding where open source risk sits inside their environments, which vulnerabilities matter most, and how quickly validated fixes can move into production. That could create more demand for managed services tied to vulnerability prioritization, patch coordination, software supply chain visibility, and security governance across hybrid cloud and AI systems