BIZTECH: What was the driving need behind the Project Lightwell collaboration?
BREARD: Several things happened all within a very close time frame, probably the biggest being what we call the “Claude Mythos moment” that a lot of people had once they had access to it. We realized that a lot of the traditional metrics and security vulnerability tracking — basically the status quo — was heavily challenged, unlike anything previous challenges. We’ve always had a growing volume of CVEs (Common Vulnerabilities and Exposures) that were difficult to handle, but now we were seeing, just from the patching process alone, the volume grow so quickly since bad actors could access Mythos.
First, it brought unknown vulnerabilities to new code it delivered, which most users didn’t know or understand. Second, bad actors could now chain together low-severity things that devalued the existing threat rating system that software providers rely on to determine where to focus their resources and time on security fixes. All of this really changed the risk profiles enterprise customers see across their estates.
On the other side with AI, the time to exploit has dropped to almost negative. Five years ago, it was about a one- to two-year window, and a small number of CVEs were exploited. We don’t live in those times anymore. Both companies heard very loudly from our customers, “We need help.” The so-called library space of publicly disclosed cybersecurity flaws and vulnerability catalogs is absolutely massive today. Companies like Red Hat and IBM have done a really good job over the course of our companies’ histories focusing at the platform level and have robust practices around that.
When you start to look at these scans, all of a sudden, the library space is this glaring void of risk. Seeing that made it clear there’s a serious problem that we have an opportunity to solve.
BIZTECH: Explain how it works.
BREARD: It starts with the various communities that make the code libraries we all know and depend on, from all applications basically, with shared common building blocks. Lightwell’s central clearinghouse serves as a security coordination layer and leverages advanced AI capabilities to validate and test fixes across an unprecedented volume of open-source code. Right now, members with frontier AI models are giving us their top prioritized findings, all anonymized.
As that happens, we come back to queueing theory and how you approach things, or what you can do at different speeds to achieve the maximum throughput — all of those have been codified into our build systems. From there, we either put a patch on a particular version — that’s the lowest-hanging fruit — or we’ll create new code, test it, put it through various test harnesses and then ask the member to see whether it breaks their application. Volume matters, but quality matters more because if you have a high volume of bad code, it’s not worth anything. The number of quality gates we have today is something I’m really proud of.
Once we complete the code fixes, they go out to the entire Lightwell network, which includes members beyond the clearinghouse who can take advantage of all of the content available within Lightwell. The more members that join at this tier and at the frontier tier, the sooner we’ll start to see this flywheel effect of patched content that can be delivered to everybody. We’re also handling the disclosure, the reporting, and trying to shepherd through fixes and vulnerabilities, not just report them on the CVE side, and are working with the communities to get it all accepted back upstream. We are looking at taking on more members after meeting current capacity demands. We’ll probably adjust requirements a bit as we go because we want the input here to be as big as possible.
LEARN MORE: How can businesses enhance security for legacy applications?
BIZTECH: Would vendor partners have come together so readily to solve this a few years ago?
BREARD: Marketplace need and alignment on the problem is what drives that good behavior. When you all see the same problem space, and people connect what we’re doing with what they’re doing, everything has value, and people win. If there were no Lightwell, everybody would keep paying for tokens to do the same work and not share it back. That just fractures everything, and we’re all doing the same work over and over again. With this, we use smarter economics to solve things once.
BIZTECH: Are there other factors driving this kind of collaboration?
BREARD: A lot of large shops don’t want the risk. Once they know and discover these vulnerabilities, all of a sudden, they have risk on their hands. There are definitely a lot of dynamics at play, but everything revolves around open source right now, and this collaboration is essentially how communities operate within open source. Essentially, Project Lightwell is that, pushed to another scale. When you think about why collaboration is so important, it’s important down the entire value chain of open source, from the very building blocks to the absolute top of patch development and pushing that out. This is the next evolution of that kind of collaboration, extended to a very specific purpose to solve a very real, global problem. I live for this stuff.
