Lightwell aims to address the growing workload by helping businesses validate vulnerabilities, develop repairs and distribute fixes for software already in use. According to Breard, AI-powered scanners can identify security flaws faster than companies can fix them. Developing and testing patches takes time, particularly for older software that businesses still rely on. Lightwell aims to close that gap by combining AI-assisted fixes with human engineering and allowing companies to report vulnerabilities privately before disclosing them publicly.
When a customer reports a suspected vulnerability, Red Hat removes identifying information before engineers evaluate it, Breard said. This measure helps protect the organization while allowing the team to investigate the problem.
The first challenge is determining whether the finding is valid. Automated security tools can produce incomplete or inaccurate reports, resulting in false positives, so engineers must review the evidence before attempting a repair.
“We have to do an upfront quality check to validate that these are real,” Breard said. Once engineers confirm a flaw, Lightwell helps generate a patch—a software modification that corrects the weakness. Human reviewers then check the proposed fix and consult specialists when necessary.
The team must also consider customers that depend on older software versions. Rather than requiring a major upgrade, Lightwell can adapt repairs to the version a company already uses, a process known as backporting.
Breard described a recent incident in which engineers had to repeat part of their work after researchers disclosed additional vulnerabilities while the team was preparing a package of fixes.
“New CVEs were coming out for it, [so] we had to stop the process, go back, do it again,” he said. Common Vulnerabilities and Exposures (CVEs) are standardized identifiers for publicly documented security flaws. Breard said the growing volume of reports had complicated the work of producing reliable fixes.
Before distributing repaired software, Red Hat also tests whether the changes preserve the connections that other applications rely on. The company aims to fix vulnerabilities without introducing issues that could disrupt business operations.
According to Breard, participating customers receive 14 days of advance access to fixes before Red Hat coordinates broader disclosure and collaborates with open-source maintainers to make the applicable repairs publicly available.