You will be provided with a reference and some statements. Please determine whether each statement is 'supported', 'unsupported', or 'unknown' with respect to the reference. Please note:
First, assess whether the reference contains any valid content. If the reference contains no valid information, such as a 'page not found' message, then all statements should be considered 'unknown'.
If the reference is valid, for a given statement: if the facts or data it contains can be found entirely or partially within the reference, it is considered 'supported' (data accepts rounding); if all facts and data in the statement cannot be found in the reference, it is considered 'unsupported'.

You should return the result in a JSON list format, where each item in the list contains the statement's index and the judgment result, for example:
[
    {
        "idx": 1,
        "result": "supported"
    },
    {
        "idx": 2,
        "result": "unsupported"
    }
]

Below are the reference and statements:
<reference>
IBM and Red Hat Commit $5 Billion to Redefine the Future of Open Source in the AI Era

IBM and Red Hat today announced Project Lightwell, a $5 billion commitment backed by new frontier AI capabilities and a global force of more than 20,000 engineers to help enterprises secure open source software. Together, these investments establish a new model for enterprise use of open source software, from upstream development through production environments.

IBM
Newsroom

News

All press releases

IBM Think 2026

Artificial intelligence

Hybrid cloud

Research and innovation

Corporate

Social impact

Mergers & acquisitions

Media resources

Asset gallery

B-roll gallery

Media contact

Global newsrooms

Inside IBM

Leadership

IBM boilerplate

Investor relations

Annual report

Analyst reports

CSR

IBM policy

Awards

Blog

IBM blog

IBM Research blog

securityintelligence.com

Subscribe

All press releases

IBM and Red Hat Commit $5 Billion to Redefine the Future of Open Source in the AI Era

Project Lightwell establishes a trusted enterprise clearinghouse for open source software with a new AI-driven model for securing the software supply chain

May 28, 2026

ARMONK, N.Y., May 28, 2026 —
IBM (NYSE:
IBM
) and Red Hat today announced
Project Lightwell,
a $5 billion commitment backed by new frontier AI capabilities and a global force of more than 20,000 engineers to help enterprises secure open source software. Together, these investments establish a new model for enterprise use of open source software, from upstream development through production environments.

Project Lightwell will establish a trusted enterprise clearinghouse combined with a global force of engineers to identify and fix vulnerabilities at scale. The clearinghouse will serve as a security coordination layer, using advanced AI capabilities to validate and test fixes across an unprecedented volume of open source code. These capabilities will be offered through commercial subscriptions, allowing enterprises to integrate secure patches directly into their existing software supply chains with enterprise-grade validation and lifecycle management.

Open source software underpins modern enterprise infrastructure, with more than 90% of Fortune 500 companies relying on OSS
[1]
. At the same time, advances in frontier AI are accelerating vulnerability discovery and exploitation. Anthropic recently reported that its Mythos Preview model identified nearly 3,900 high- or critical-severity vulnerabilities in open source software alone
[2]
.

IBM and Red Hat have already begun collaborating with a select group of early adopters on Project Lightwell, including Bank of America, BNY, Citi, Goldman Sachs, JPMorganChase, Mastercard, Morgan Stanley, Royal Bank of Canada, State Street, Visa and Wells Fargo. The real-world insights from these initial deployments will actively shape how vulnerabilities are identified, validated, and remediated at scale across complex software supply chains.

Project Lightwell builds on IBM and Red Hat’s leadership in open source, enterprise AI and security, and incorporates learnings from initiatives such as Anthropic’s Project Glasswing and OpenAI’s Trust Access for Cyber, with a goal of utilizing new IBM agentic security methods to protect the foundational open source layers that underpin modern enterprise and AI systems.

“Open source is the backbone of today’s digital economy and the foundation of modern AI, and we are at an inflection point in how it is built, secured, and scaled,” said
Arvind Krishna, Chairman and CEO, IBM
. “With Project Lightwell, IBM and Red Hat are helping define a new industry model, one that brings together AI, engineering expertise, and trusted collaboration, to secure open source software at its source and across the entire supply chain. This is about strengthening trust in the systems that power business, government, and society.”

Launching a Trusted Open Source Security Clearinghouse

Project Lightwell builds on IBM and Red Hat’s proven enterprise open source model, extending it beyond their traditional product footprint. IBM already uses more than 62,000 open source packages, with deep expertise in over 10,000. Across technologies like Linux, Java, Kubernetes, Kafka, Ansible, Terraform, Flink, Cassandra and more, the companies operate one of the industry’s broadest commercial open source ecosystems, historically providing lifecycle management, validation, and patching for components within their platforms. Now, IBM and Red Hat are applying the same engineering discipline to the broader application landscape, including independent libraries, language toolchains, AI frameworks, and data streaming platforms.

This approach directly addresses the operational vulnerabilities enterprises face when managing independent open source code on their own. Through the clearinghouse model, enterprise organizations can:

Report and resolve vulnerabilities: Responsibly share sensitive security issues discovered in their active software versions within a trusted intermediary framework.

Deploy validated patches: Receive patches optimized for production environments, spanning both Red Hat offerings and independent community code.

Coordinate upstream disclosures: Share fixes upstream so that open source communities can include them in long-term maintenance.

This model allows enterprises to engage IBM and Red Hat to resolve critical security issues while strengthening open source overall through responsible upstream disclosure.

AI-Powered Engineering at Global Scale

At a time when many technology companies are using AI to reduce technical headcount, IBM and Red Hat are taking a different approach, positioning technical engineering capacity as a premium strategic asset and a source of market differentiation.

IBM and Red Hat will deploy a team of more than 20,000 engineers, augmented by advanced AI capabilities. This global technical force will operate across upstream and enterprise environments, focusing on:

Upstream maintenance alongside open source community leaders;

High-volume, AI-assisted vulnerability review, triage, and prioritization;

Secure patch development, dependency hardening, and release engineering.

Project Lightwell supports government priorities to secure digital infrastructure, protect critical systems, and strengthen the overall resilience of open source software ecosystems.

More information about Project Lightwell is available
https://www.ibm.com/products/lightwell

[1]
Source: Worldmetrics;
worldmetrics.org/opensource-statistics/

[2]
Source: Anthropic;
anthropic.com/research/glasswing-initial-update

About IBM

IBM is a leading provider of global hybrid cloud and AI, and consulting expertise. We help clients in more than 175 countries capitalize on insights from their data, streamline business processes, reduce costs and gain the competitive edge in their industries. Thousands of governments and corporate entities in critical infrastructure areas such as financial services, telecommunications and healthcare rely on IBM's hybrid cloud platform and Red Hat OpenShift to affect their digital transformations quickly, efficiently and securely. IBM's breakthrough innovations in AI, quantum computing, industry-specific cloud solutions and consulting deliver open and flexible options to our clients. All of this is backed by IBM's long-standing commitment to trust, transparency, responsibility, inclusivity and service.

Visit
www.ibm.com
for more information.

About Red Hat

Red Hat is the open hybrid cloud technology leader, delivering a trusted, consistent and comprehensive foundation for transformative IT innovation and AI applications. Its portfolio of cloud, developer, AI, Linux, automation and application platform technologies enables any application, anywhere—from the datacenter to the edge. As the world's leading provider of enterprise open source software solutions, Red Hat invests in open ecosystems and communities to solve tomorrow's IT challenges. Collaborating with partners and customers, Red Hat helps them build, connect, automate, secure and manage their IT environments, supported by consulting services and award-winning training and certification offerings.

Media Contacts

Stephanie Wonderlick

Red Hat

swonderl@redhat.com

Kate Lehman

IBM

Kate.lehman@ibm.com

Subscribe to email

Release Categories

Artificial intelligence
Hybrid cloud

more articles

Artificial intelligence

|
Sep 10, 2026

IBM and NASA Release Open-Source AI Model to Support Lunar Exploration

Research and innovation

|
Sep 10, 2026

IBM, Lockheed Martin Announce Swiss Quantum Innovation Hub at ETH Zurich, Anchored by Switzerland’s First IBM Quantum Computer

Research and innovation

|
Sep 9, 2026

Cleveland Clinic, RIKEN and IBM Team Advance to Finals for 2026 ACM Gordon Bell Prize

Subscribe to email

Assets
</reference>

<statements>
1. The major consulting firms in this evidence pool have announced substantial dollar AI commitments since 2023, with Accenture, PwC US, EY, KPMG, Deloitte, Capgemini, and IBM/Red Hat all disclosing dollar commitments.
2. The common output pattern is platformization: an AI-assisted open-source security clearinghouse at IBM/Red Hat.
3. Talent scaling is equally prominent: more than 20,000 IBM/Red Hat engineers.
4. Client-facing examples include IBM/Red Hat financial-sector early adopters.
5. IBM and Red Hat's US$5 billion is tied to Project Lightwell, an open-source software security clearinghouse rather than a general consulting AI platform.
6. IBM/Red Hat's headline commitment is US$5 billion for Project Lightwell.
7. IBM/Red Hat's main commercial focus includes open-source AI security clearinghouse, commercial subscriptions.
8. As of 2026-09-13, the evidence also contains 2026 items, including IBM/Red Hat's May 2026 Project Lightwell, EY's July 2026 NVIDIA item, and Capgemini's May 2026 investment in the OpenAI Deployment Company, but it does not provide completion metrics for the 2023 commitments.
9. IBM and Red Hat's Project Lightwell is a trusted enterprise clearinghouse that uses advanced AI capabilities to validate and test fixes across open-source code, offered through commercial subscriptions
10. It is intended to let enterprises report and resolve vulnerabilities, deploy validated patches, and coordinate upstream disclosures
11. IBM and Red Hat say they already use more than 62,000 open-source packages with deep expertise in over 10,000, and that the clearinghouse extends that model to independent libraries, language toolchains, AI frameworks, and data streaming platforms
12. Client-level evidence is thinner than platform evidence, and the named cases in this section rest mainly on vendor announcements rather than audited outcome reports
13. IBM/Red Hat client or use case: Bank of America, BNY, Citi, Goldman Sachs, JPMorganChase, Mastercard, Morgan Stanley, Royal Bank of Canada, State Street, Visa, Wells Fargo
14. IBM/Red Hat application scenario: open-source vulnerability identification, validation, and patching
15. IBM/Red Hat evidence status: early adopters already collaborating
16. IBM and Red Hat's Project Lightwell incorporates learnings from Anthropic's Project Glasswing and OpenAI's Trust Access for Cyber, and cites Anthropic's report that its Mythos Preview model identified nearly 3,900 high- or critical-severity vulnerabilities in open-source software
17. IBM and Red Hat position their engineering capacity as a strategic asset at a time when many technology companies use AI to reduce technical headcount
18. IBM and Red Hat will deploy more than 20,000 engineers augmented by advanced AI capabilities for upstream maintenance, vulnerability review, triage, prioritization, secure patch development, dependency hardening, and release engineering
19. The evidence establishes dollar commitments for IBM/Red Hat
20. The evidence establishes application scenarios in open-source security at IBM/Red Hat
</statements>

Begin the assessment now. Output only the JSON list, without any conversational text or explanations.