IBM‑Red Hat Project Lightwell development

In late May 2026 IBM and its Red Hat subsidiary unveiled Project Lightwell, a $5 billion program that uses frontier AI and a global engineering team to create a clearinghouse for discovering, validating, testing and back‑porting security patches to open‑source components in enterprise software. Early adopters include major U.S. banks and payment firms, and the service is offered through commercial subscriptions. A month later IBM, Red Hat and Palo Alto Networks announced an expansion that adds Palo Alto’s virtual‑patching technology. The combined solution seeks to speed up protection against AI‑accelerated vulnerabilities by delivering network‑level virtual patches while IBM and Red Hat provide software‑level fixes across a wide range of systems. IBM Security Services will assist customers in prioritising and validating these defenses. On 7 July 2026 IBM, Red Hat and Deloitte announced that Lightwell will also operate a Lightwell Network for immediate access to remediated dependencies and a Clearinghouse Premier to coordinate patch embargoes. Deloitte will supply orchestration, compliance reporting and forward‑deployed engineers, extending the platform’s auditability and regulatory‑grade evidence. Major financial institutions such as Goldman Sachs, JPMorgan Chase and Visa are listed as early users. Later that day IBM and Red Hat confirmed the Lightwell Network catalog is generally available, containing more than 6,500 digitally signed, remediated dependencies with complete SBOMs. The platform integrates artifacts from partners including JFrog, AWS, AMD, GitLab, Microsoft and ServiceNow, and implementation support comes from IT service firms such as Accenture, Infosys and Kyndryl in addition to Deloitte. Red Hat CEO Matt Hicks called Lightwell a “fundamental structural shift” in enterprise software security, and the consortium signalled plans to broaden the service beyond finance into healthcare, government and telecom sectors.