IBM and Red Hat Expand Lightwell with Commercial Offerings for AI-Era Software Supply Chain Security

Lightwell Expansion for AI-Era Software

IBM and Red Hat announced an expansion of Lightwell, introducing new commercial offerings. These offerings are designed to help organizations create trusted and verifiable software supply chains, particularly in the context of AI-assisted software development. The goal is to simplify key security processes such as software signing, provenance tracking, artifact verification, and policy enforcement.

Addressing Evolving Software Security Needs

This expansion addresses a shift in software security, driven by the acceleration of software creation through AI. The challenge now extends beyond rapid code production to proving software origin, build process, modification status, and compliance with security policies before deployment. IBM states that a verifiable "trust infrastructure" is becoming essential as enterprises increasingly use AI-generated code, open-source components, and automated supply chains.

Integration of Security Standards

Lightwell incorporates existing security standards including Sigstore, in-toto, SLSA (Supply-chain Levels for Software Artifacts), and software bill of materials (SBOM) initiatives. Instead of treating these as separate activities, Lightwell integrates them into a cohesive platform. This integration allows organizations to verify every stage of the software delivery process comprehensively.

Commercial Offerings and Impact

The new commercial offerings provide capabilities for artifact signing, provenance generation, policy validation, and lifecycle management. These features help organizations implement supply chain security without needing to integrate multiple disconnected open-source projects themselves. This is particularly relevant as AI-assisted development increases the speed and volume of software changes entering enterprise delivery pipelines, shifting focus to cryptographic provenance and continuous verification.