IBM, Red Hat have launched a new program that will give Lightwell at no charge to more than 185 leading research universities, along with 100 major nongovernmental organizations (NGOs) and think tanks. The aim is to help these institutions secure open source software with validated fixes for vulnerabilities, while freeing up resources for research, education, humanitarian programs and other public-interest work.
Open source software sits at the heart of university research environments, teaching platforms and campus operations. It also powers the systems NGOs and think tanks use to support policy research and community programs.
But many of these organizations do not have the engineering capacity needed to keep up as AI speeds up the discovery, and potential exploitation, of software vulnerabilities.
What Lightwell provides
Through the initiative, eligible institutions will get access to Lightwell’s growing library of remediated, digitally signed and validated open source dependencies, which can be plugged into existing software pipelines.
The platform is designed to deliver fixes for the exact software versions organizations already use, helping them address vulnerabilities without disruptive upgrades or access to proprietary code, data or research.
The duo launched Lightwell in May 2026 with a $5 billion commitment and a global team of more than 20,000 engineers focused on securing the open source software supply chain.
In July, they introduced Lightwell and Lightwell Clearinghouse Premier, extending automated vulnerability remediation to the open source packages organizations use in active production. Since then, the number of validated and remediated package versions has grown from 6,500 to more than 8,000, including fixes for 64 previously undisclosed vulnerabilities.
The companies say Lightwell is intended to help participating universities, NGOs and think tanks:
- reduce the time and specialized engineering effort needed to fix open source vulnerabilities.
- apply validated fixes to current and long-lived software versions, without disruptive upgrades.
- receive digitally signed binaries, source code and compliance artifacts, including Software Bills of Materials (SBOMs).
- strengthen the broader open source ecosystem, as fixes are submitted back to originating communities under Red Hat’s upstream-always model.
Lightwell works within each institution’s existing environment and does not require IBM or Red Hat to access proprietary source code, data or research. Participating organizations will also receive information and support to assess their open source environments and integrate remediated packages into existing workflows.
Broader ecosystem
The expanded access program builds on Lightwell’s work with major financial institutions, including Bank of America, BNY, Citi, Goldman Sachs, JPMorganChase, Mastercard, Morgan Stanley, Royal Bank of Canada, State Street, Visa and Wells Fargo.
A wider technology ecosystem, including Amazon Web Services (AWS), AMD, F5, GitLab, Intel, JFrog, Microsoft, NVIDIA, Palo Alto Networks and ServiceNow, is also working with IBM and Red Hat on Lightwell. Together, they are trying to help security fixes move more efficiently across development tools, cloud environments, deployment pipelines and network controls.
Leadership Comment
“Lightwell combines automated remediation with deep open source engineering expertise and contributes fixes back upstream,” said Matt Hicks, President and Chief Executive Officer, Red Hat. “Expanding access will help strengthen both participating institutions and the open source communities on which they depend.”
IBM, Red Hat will begin onboarding for eligible institutions in August 2026.
To Know More About Lightwell, CLICK HERE & CLICK HERE
