IBM and Red Hat announced a new program providing Lightwell at no charge to over 185 leading research universities and 100 major nongovernmental organizations (NGOs) and think tanks. Eligible institutions can access Lightwell’s library of validated fixes for open source software vulnerabilities, helping them secure the software and focus resources supporting research, education, humanitarian programs and other public-interest work.
Open source software underpins university research environments, teaching platforms and campus operations, as well as the systems NGOs and think tanks use to conduct policy research and serve communities around the world. Yet many of these institutions lack the resources and specialized engineering capacity required to keep pace as AI accelerates the discovery and potential for exploitation of software vulnerabilities.
Through this initiative, eligible institutions will receive access to Lightwell including a growing library of remediated, digitally signed and validated open source dependencies that can be integrated into existing software pipelines. Lightwell is designed to deliver validated fixes for the specific software versions organizations already run, helping them address vulnerabilities without forcing disruptive upgrades or requiring access to their proprietary code, data or research.
“Lightwell combines automated remediation with deep open source engineering expertise and contributes fixes back upstream,” said Matt Hicks, President and Chief Executive Officer, Red Hat. “Expanding access will help strengthen both participating institutions and the open source communities on which they depend.”
How Lightwell Helps Secure Open Source Software
IBM and Red Hat launched Lightwell in May 2026 with a $5 billion commitment and a global force of more than 20,000 engineers to help secure the open source software supply chain. In July, the companies introduced Lightwell and Lightwell Clearinghouse Premier, extending automated vulnerability remediation to the open source packages organizations use in active production. Since its introduction, Lightwell has expanded the scale of validated open source remediation available to participating organizations, from 6,500 to more than 8,000 validated and remediated package versions, including fixes for 64 previously undisclosed vulnerabilities.
Lightwell combines a generative AI-powered remediation engine with human engineering expertise to identify, validate and remediate vulnerabilities across critical software dependencies. For participating universities, NGOs and think tanks, the initiative is intended to help:
- Reduce the time and specialized engineering effort required to address open source vulnerabilities;
- Apply validated fixes to current and long-lived software versions, reducing the need for disruptive upgrades;
- Receive digitally signed binaries, source code and compliance artifacts, including Software Bills of Materials (SBOMs); and
- Strengthen the broader open source ecosystem through Red Hat’s upstream-always model, under which fixes are submitted to originating communities for review and acceptance.
Lightwell works within an institution’s existing environment and does not require IBM or Red Hat to access its proprietary source code, data or research. Participating institutions will receive information and support to help them assess their open source environments and integrate applicable remediated packages into existing workflows.
Building on a Growing Global Network
The expanded access program builds on Lightwell’s work with leading financial institutions, including Bank of America, BNY, Citi, Goldman Sachs, JPMorganChase, Mastercard, Morgan Stanley, Royal Bank of Canada, State Street, Visa and Wells Fargo.
A growing technology ecosystem—including Amazon Web Services (AWS), AMD, F5, GitLab, Intel, JFrog, Microsoft, NVIDIA, Palo Alto Networks and ServiceNow—is also collaborating with IBM and Red Hat on Lightwell. Together, these organizations are working to help security fixes move across development tools, cloud environments, deployment pipelines and network controls.
IBM and Red Hat will begin onboarding for eligible institutions in August 2026. To learn more about Lightwell, visit ibm.com/products/lightwell and redhat.com/en/lightwell.
Frequently Asked Questions
What is Lightwell?
Lightwell is an IBM and Red Hat initiative that combines AI-driven automation with human engineering expertise to identify, validate and remediate vulnerabilities in open source software.
Who is eligible for no-charge Lightwell access?
The program is being made available to over 185 leading research universities and 100 major NGOs and think tanks in the U.S.
What will participating institutions receive?
Eligible institutions will receive access to Lightwell and its growing library of remediated, digitally signed and certified open source dependencies, along with source code and compliance documentation.
Does Lightwell require access to an institution’s proprietary code or data?
No. Lightwell works within an institution’s existing environment and does not require IBM or Red Hat to access its proprietary source code, data or research.
