![](\"https:\/\/mms.businesswire.com\/media\/20260626616311\/en\/719420\/5\/Red_Hat_new_BW.jpg\")
<\/a><\/a>\nMost organizations rely on a mix of first-party code, open source software, and third-party commercial software. Because a single business application can include all three, an unpatched vulnerability can introduce immediate risk across the entire corporate estate. Frontier AI models have accelerated this risk and can enable adversaries to discover and exploit zero-day flaws in minutes.<\/p>
\nLightwell aims to help address this operational pressure by decoupling open source software security remediation from the traditional software upgrade cycle. The initiative combines an enterprise open source security model with an active engineering force. Supported by IBM and Red Hat, Lightwell coordinates upstream threat disclosures with independent maintainers while developing, testing, and backporting patches directly to the pinned software versions running in production environments. Lightwell delivers validated patches to those specific, in-use software versions, protecting critical systems without forcing disruptive upgrades.<\/p>
\nThrough this collaboration, the three organizations will coordinate across the software lifecycle to help clients manage security threats:<\/p>
- \n
- \nContinuous Visibility & Discovery:<\/b> Continuously mapping and scanning first-party, open source, and third-party software to identify exactly what code exists, where it runs, and which critical business functions it supports.<\/li>\n<\/ul>
- \n
- \nContextual Prioritization: <\/b>Separating active threats from noise by analyzing severity, exposure, threat-chaining, and exploitability to inform operational decisions.<\/li>\n<\/ul>
- \n
- \nMachine-Speed Remediation: <\/b>Combining Red Hat and IBM\u2019s automated patch validation with Deloitte\u2019s orchestration services to rapidly coordinate, test, and deploy validated fixes into production repositories, limiting disruption. To achieve this, Deloitte will maintain a bench of Forward Deployed Engineers (FDEs) to support ongoing remediation and maintenance of client applications.<\/li>\n<\/ul>
- \n
- \nEcosystem Trust & Compliance:<\/b> Through the collaboration, the organizations will help enterprises manage upstream open source and vendor relationships, including pre-disclosure vulnerability handovers, while delivering continuous, evidence-based reporting for boards, auditors, and regulators.<\/li>\n<\/ul>
\n\u201cExploits don't wait for manual patching processes, and neither can enterprise response,\u201d said Adnan Amjad<\/a>, Deloitte\u2019s US Cyber leader.<\/b> \u201cTogether, we're enabling clients to operate at machine speed to identify, validate, and remediate vulnerabilities. This collaboration is about building the operational resilience needed to maintain trust across increasingly complex software ecosystems \u2014 creating systems that can withstand and neutralize risk without disrupting the business.\u201d<\/p>
\n\u201cLightwell was created to address the growing challenge of securing open source software in an AI-driven threat landscape,\u201d said Savio Rodrigues, Vice President, Service Partners at IBM. \u201cIt brings together the engineering, automation, and ecosystem partnerships needed to tackle this risk at scale. We\u2019re excited to collaborate with Deloitte and leverage their capabilities in cyber risk management to extend this model to more organizations.\u201d<\/p>
\n\"Open source drives innovation, but the volume of AI-generated threats requires engineering capacity that matches the speed of the attacker,\" says Kevin Kennedy, Vice President, Global Partner Ecosystem at Red Hat. \"Our work with Deloitte will bring the remediation capabilities we developed with IBM with Lightwell directly to enterprise application environments. Together we will isolate, patch, and deliver the fixes, supporting the open source ecosystem while protecting the specific versions our customers depend on.\"<\/p>
\nAs the pace of vulnerability discovery increases, organizations are looking for solutions that help reduce exposure while improving accountability across the software lifecycle. This collaboration aims to help clients do exactly that \u2014 transform software supply chain security from a fragmented, reactive process into a coordinated, evidence-based operating model.<\/p>
\nThis collaboration builds on the broader Deloitte and IBM relationship focused on helping clients address cybersecurity, resilience, digital trust, and other emerging technology risks. It also draws on the decade-long Deloitte and Red Hat alliance, which combines open source technologies and IT automation to help enterprises manage hybrid cloud complexity and accelerate business integration. Learn more about the Deloitte and IBM relationship here<\/a>, and explore Deloitte\u2019s alliance with Red Hat here<\/a>.<\/p>
\nAbout Deloitte<\/b><\/p>
\nDeloitte provides industry-leading audit, consulting, tax and advisory services to many of the world\u2019s most admired brands, including nearly 90% of the Fortune 500\u00ae and more than 9,000 U.S.-based private companies. At Deloitte, we strive to live our purpose of making an impact that matters for our people, clients, and communities. We bring together distinct talents, technologies, disciplines, and an ecosystem of alliances to help tackle today\u2019s most complex business challenges and drive long-term progress. Deloitte is proud to be part of the largest global professional services network serving our clients in the markets that are most important to them. Bringing more than 180 years of service, our network of member firms spans more than 150 countries and territories. Learn how Deloitte\u2019s approximately 470,000 people worldwide connect for impact at www.deloitte.com<\/a>.<\/p>
- \nEcosystem Trust & Compliance:<\/b> Through the collaboration, the organizations will help enterprises manage upstream open source and vendor relationships, including pre-disclosure vulnerability handovers, while delivering continuous, evidence-based reporting for boards, auditors, and regulators.<\/li>\n<\/ul>
- \nMachine-Speed Remediation: <\/b>Combining Red Hat and IBM\u2019s automated patch validation with Deloitte\u2019s orchestration services to rapidly coordinate, test, and deploy validated fixes into production repositories, limiting disruption. To achieve this, Deloitte will maintain a bench of Forward Deployed Engineers (FDEs) to support ongoing remediation and maintenance of client applications.<\/li>\n<\/ul>
- \nContextual Prioritization: <\/b>Separating active threats from noise by analyzing severity, exposure, threat-chaining, and exploitability to inform operational decisions.<\/li>\n<\/ul>