IBM and Red Hat are offering Lightwell free to more than 285 research and public-interest organisations, using AI-assisted vulnerability remediation and upstream contributions to strengthen the open source software ecosystem.
IBM and Red Hat are expanding their AI-powered open source security initiative by providing Lightwell at no charge to more than 185 leading U.S. research universities and 100 major NGOs and think tanks. The programme gives eligible institutions access to validated fixes for open source software vulnerabilities, helping secure research, education and public-interest infrastructure while reinforcing the broader open source ecosystem.
Lightwell combines generative AI-driven automation with human engineering expertise to identify, validate and remediate vulnerabilities. Under Red Hat’s upstream-always development model, validated fixes are contributed back to the originating open source communities, extending the benefits beyond participating organisations.
The platform delivers validated fixes for the software versions institutions already run, reducing the need for disruptive upgrades. It operates within existing environments without requiring IBM or Red Hat to access proprietary source code, data or research. Participants also receive digitally signed binaries, source code, Software Bills of Materials (SBOMs), compliance artefacts, and remediated open source dependencies.
Launched in May 2026 with a US$5 billion commitment and more than 20,000 engineers, Lightwell has expanded from 6,500 to more than 8,000 validated and remediated package versions, including fixes for 64 previously undisclosed vulnerabilities. IBM and Red Hat introduced Lightwell Clearinghouse Premier in July to extend automated remediation to production open source packages.
“Lightwell combines automated remediation with deep open source engineering expertise and contributes fixes back upstream,” said Matt Hicks, President and Chief Executive Officer, Red Hat. “Expanding access will help strengthen both participating institutions and the open source communities on which they depend.”
Onboarding for eligible institutions begins in August 2026.
