IBM, Red Hat, and Deloitte Announce Lightwell Collaboration to Help Strengthen Open Source Software Supply Chain Trust
| Source: IBM Newsroom AI
Tags: IBM, Red Hat, Deloitte, software supply chain, open source security, vulnerability patching, Lightwell
IBM, Red Hat, and Deloitte launched Project Lightwell — an automated OSS security service that decouples vulnerability patching from the traditional upgrade cycle, letting enterprises fix specific in-production software versions without disruptive full upgrades, at machine speed.
Details
Project Lightwell directly addresses what the three partners call 'machine-speed' threat discovery: AI tools now allow adversaries to find and exploit zero-day vulnerabilities in minutes, making the traditional monthly patch cycle obsolete. The initiative decouples OSS remediation from version upgrades — backporting validated fixes to the exact pinned versions already running in production. The architecture has four operational pillars: continuous visibility and discovery (mapping all first-party, open source, and third-party software with business function context), contextual prioritization (distinguishing active threats from noise using severity, exploitability, and threat-chaining analysis), machine-speed remediation (Red Hat/IBM automated patch validation combined with Deloitte orchestration), and ecosystem trust and compliance (handling upstream pre-disclosure handovers with OSS maintainers). Deloitte brings Forward Deployed Engineers who maintain ongoing remediation capacity for clients, plus compliance reporting designed for board, auditor, and regulatory audiences. The collaboration targets regulated industries where unpatched vulnerabilities create both security and compliance risk simultaneously.