IBM $IBM and Red Hat announced Project Lightwell on Thursday, a $5 billion commitment to help enterprises secure open-source software using a combination of AI tools and more than 20,000 engineers.
At the heart of the initiative is what IBM and Red Hat call a trusted enterprise clearinghouse, where advanced AI capabilities are used to vet and verify patches at a scale that spans large portions of the open-source ecosystem. The service will be offered through commercial subscriptions, the company said, allowing enterprises to integrate vetted patches directly into their software supply chains.
IBM and Red Hat have already begun piloting the project with a group of financial institutions, including Bank of America $BAC, BNY, Citi, Goldman Sachs $GS, JPMorganChase, Mastercard $MA, Morgan Stanley $MS, Royal Bank of Canada, State Street $STT, Visa $V, and Wells Fargo $WFC, the company said. The commercial offering will launch within 30 days, Rob Thomas, IBM's senior vice president of software, told Reuters.
Under the clearinghouse structure, participating enterprises gain access to a confidential channel for disclosing security weaknesses, production-ready patches developed and tested by IBM and Red Hat engineers, and a mechanism for contributing those solutions back to the wider open-source ecosystem, the company said.
The companies framed the initiative partly as a response to AI's growing role in identifying software weaknesses. Anthropic's Mythos Preview model identified nearly 3,900 high- or critical-severity vulnerabilities in open-source software, the company noted.
IBM said it uses more than 62,000 open-source packages and has deep expertise in more than 10,000 of them, spanning technologies including Linux, Kubernetes, Kafka, and Ansible. Project Lightwell extends that engineering discipline to a broader landscape of independent libraries, language toolchains, AI frameworks, and data streaming platforms, the company said.
"Open source is the backbone of today's digital economy and the foundation of modern AI, and we are at an inflection point in how it is built, secured, and scaled," IBM Chairman and CEO Arvind Krishna said in a statement. "This is about strengthening trust in the systems that power business, government, and society."
The companies noted that more than 90% of Fortune 500 companies rely on open-source software. Pricing for the subscription offering will most likely be tied to the volume of packages a client uses, Thomas told Reuters, adding that customers effectively receive a "stamp of approval from the clearinghouse that their open source is safe to use in production."