Red Hat Launches Lightwell AI Security Clearing House
The open source supply chain tool, built with IBM, automates detection and patching of vulnerabilities as exploit windows shrink to hours.
Updated on Nov. 3, 2026 in Artificial Intelligence
Live Poll
Do you trust large tech companies to keep software secure from hackers?
Red Hat launched Lightwell, an AI-driven open source supply chain security clearing house, developed with IBM. The initiative responds to vulnerability exploitation timelines that have collapsed from years to hours.
Why it matters
Attackers can now exploit newly disclosed flaws within about 18 hours, far faster than traditional patching cycles allow. Automated remediation aims to close the gap between disclosure and defense across open source software.
Mean Time-to-Exploit for a CVE fell from about 2.3 years in 2018 to 18 hours in 2026, according to the keynote. Typical patch deployment still takes 10 to 40 days, a gap the automated system is designed to address.
The players
Red Hat
A leading enterprise open source software company best known for its Linux distribution and OpenShift platform, now expanding into AI-driven security tooling.
IBM
A global technology company that co-founded Lightwell with Red Hat to strengthen open source supply chain security.
NVIDIA
A leading maker of GPUs and AI computing platforms whose enterprise AI software is paired with Red Hat's offerings in the Red Hat AI Factory.
Miho Miura
President of Red Hat Japan, who delivered the opening keynote at Red Hat Summit Connect Tokyo 2026.
The details
Lightwell automatically identifies, patches, and distributes fixes for open source vulnerabilities, with an AI agent detecting where patches must be applied. It is embedded into Red Hat OpenShift continuous integration and was founded by Red Hat together with IBM. The initiative was presented alongside the Red Hat AI Factory with NVIDIA at Red Hat Summit Connect Tokyo 2026.
Timeline
2018: Mean Time-to-Exploit of a CVE was about 2.3 years.
2026: Mean Time-to-Exploit collapsed to about 18 hours.
2026: Red Hat Summit Connect Tokyo opened with a keynote from Miho Miura.
The Tech Race
Lightwell sits alongside NVIDIA OpenShell, an open source runtime that sandboxes autonomous AI agents, as enterprise vendors race to automate security. Both efforts respond to exploit timelines that now run in hours rather than the 2.3 years recorded in 2018.
Organizations running open source software may see faster automated patching as Lightwell integrates into OpenShift continuous integration pipelines. Developers face less manual remediation work, though adoption depends on how quickly teams can deploy the fixes it generates.
The takeaway
Shrinking exploit windows mean that patching speed now matters as much as detection. Teams that automate remediation in their build pipelines are better positioned to keep pace with attackers.
Further reading
Explore more on Artificial Intelligence developments shaping enterprise security.
Source note: This article includes information reported by Enterprise IT News.
Live Poll
Do you trust large tech companies to keep software secure from hackers?
