IBM and its Red Hat operations are launching Project Lightwell, a new initiative backed by a $5 billion investment that aims to help enterprises identify, validate, and remediate vulnerabilities in open-source software.

The companies said the project combines AI-powered vulnerability analysis with a workforce of more than 20,000 engineers. It will operate through a "trusted enterprise clearinghouse" that organizations can use to report vulnerabilities, receive validated patches, and coordinate fixes with upstream open-source communities.

Project Lightwell will be offered through commercial subscriptions that allow enterprises to integrate vetted patches into their existing software supply chains.

The project’s unveiling comes as enterprises grapple with growing software supply chain risks. IBM and Red Hat cited advances in frontier AI as a factor accelerating both vulnerability discovery and potential exploitation. The companies also pointed to the widespread use of open-source software across enterprise infrastructure, noting that “more than 90% of Fortune 500 companies” rely on open-source technologies.

The Project Lightwell clearinghouse will serve as a security coordination layer that uses AI to validate and test fixes across large volumes of open-source code. Enterprises will be able to confidentially report vulnerabilities discovered in software they use, receive patches optimized for production environments, and coordinate the disclosure of fixes back to open-source projects.

The initiative extends beyond IBM and Red Hat's existing product portfolios, also covering independent software libraries, programming language toolchains, AI frameworks, data platforms, and technologies already supported through their commercial offerings.

Project Lightwell will be supported by thousands of engineers working across upstream and enterprise environments whose responsibilities will include open-source project maintenance, vulnerability review and prioritization, patch development, dependency hardening, and release engineering. IBM and Red Hat said AI will be used to assist with vulnerability triage and remediation efforts.

Several financial institutions are already participating as early adopters, including Bank of America, BNY, Citi, Goldman Sachs, JPMorganChase, Mastercard, Morgan Stanley, Royal Bank of Canada, State Street, Visa, and Wells Fargo. IBM and Red Hat said feedback from those deployments will help shape how the platform identifies and remediates vulnerabilities across enterprise software supply chains.