Deloitte, IBM and Red Hat Partner to Strengthen Software Supply Chain Security Against Emerging Cyber Threats
Deloitte, IBM, and Red Hat have announced a strategic collaboration aimed at helping organisations strengthen software supply chain security and respond more effectively to increasingly sophisticated cyber threats.
The partnership brings together Deloitte’s cybersecurity and risk management expertise with IBM and Red Hat’s enterprise open source security capabilities through Lightwell, an initiative designed to improve the way organisations identify, manage, and remediate vulnerabilities across complex software environments.
As businesses increasingly depend on a combination of internally developed applications, open source components, and third-party software, securing the software supply chain has become a major priority. A single vulnerability within a software component can expose critical systems, creating significant operational and security risks.
Addressing New Software Security Challenges
Modern applications often contain thousands of software components from multiple sources, making visibility and vulnerability management increasingly complex.
The rise of artificial intelligence has further accelerated cybersecurity challenges by enabling attackers to identify and exploit software weaknesses faster than traditional security processes can respond.
Lightwell aims to address these challenges by separating open source security fixes from conventional software upgrade cycles. Instead of requiring organisations to wait for major software updates, the initiative focuses on delivering validated security patches directly to the specific software versions running in production environments.
This approach allows companies to strengthen protection while reducing operational disruption caused by forced upgrades or system changes.
Deloitte Brings Cyber Risk and Integration Expertise
As an integration collaborator for Lightwell, Deloitte will contribute its secured software supply chain architecture and cyber risk services to support enterprise adoption.
The collaboration will help organisations manage software security across the entire development and operational lifecycle through improved visibility, risk assessment, remediation, and compliance reporting.
The three companies will work together across several key areas:
Continuous Software Visibility and Discovery
The initiative will help organisations identify and monitor first-party applications, open source software, and third-party components to understand what software exists, where it operates, and which business functions depend on it.
Smarter Risk Prioritisation
Rather than treating every vulnerability equally, organisations will be able to evaluate risks based on factors such as severity, exposure level, exploit potential, and real-world impact.
This enables security teams to focus resources on the vulnerabilities that pose the greatest threat.
Faster Vulnerability Remediation
IBM and Red Hat’s automated patch validation capabilities, combined with Deloitte’s cybersecurity services, will help organisations test and deploy security fixes more quickly.
Deloitte will also provide Forward Deployed Engineers to support ongoing remediation activities and help maintain secure application environments.
Stronger Compliance and Trust
The collaboration will support enterprises in managing relationships with open source communities and software vendors while providing evidence-based reporting for executives, auditors, and regulators.
Building Resilience in an AI-Driven Threat Environment
Adnan Amjad, US Cyber Leader at Deloitte, said organisations need faster and more effective approaches to software security as cyber threats continue to evolve.
“Exploits don’t wait for manual patching processes, and neither can enterprise response. Together, we’re enabling clients to operate at machine speed to identify, validate, and remediate vulnerabilities.”
Adnan Amjad, US Cyber Leader, Deloitte
Savio Rodrigues, Vice President, Service Partners at IBM, said Lightwell was created to address the growing challenge of securing open source software in an increasingly AI-driven threat landscape.
He noted that the collaboration with Deloitte will help extend Lightwell’s security model to more organisations by combining engineering expertise, automation, and cyber risk management capabilities.
Kevin Kennedy, Vice President of Global Partner Ecosystem at Red Hat, highlighted the importance of matching the speed of cyber threats with stronger engineering capabilities.
He explained that the partnership will help isolate vulnerabilities, develop fixes, and deliver validated patches to protect the software versions organisations rely on.
Transforming Software Security from Reactive to Proactive
The partnership reflects the growing need for organisations to move beyond traditional vulnerability management approaches and adopt more proactive software supply chain security strategies.
By combining automation, open source expertise, and cybersecurity services, Deloitte, IBM, and Red Hat aim to help businesses improve resilience, reduce exposure, and maintain trust in increasingly complex digital environments.
The collaboration builds on existing relationships between Deloitte and IBM, as well as the decade-long alliance between Deloitte and Red Hat focused on open source technology, automation, and hybrid cloud transformation.
Frequently Asked Questions (FAQs)
1. What is software supply chain security?
Software supply chain security focuses on protecting the different components involved in building and delivering software, including source code, open source libraries, third-party applications, and development tools.
2. Why is software supply chain security becoming more important?
As organisations use more open source and third-party software components, vulnerabilities in one component can create risks across entire business systems. Increasing cyber threats and AI-powered attacks have made stronger protection necessary.
3. What is Lightwell?
Lightwell is an enterprise open source security initiative supported by IBM and Red Hat that helps organisations identify, validate, and apply security fixes to software versions already running in production environments.
4. How does this collaboration help businesses?
The partnership helps businesses improve software visibility, prioritise security risks, deploy validated patches faster, and strengthen compliance reporting across their technology environments.
5. What role does Deloitte play in the partnership?
Deloitte contributes cybersecurity expertise, secured software supply chain architecture, risk management services, and engineering support to help organisations implement stronger software security practices.
6. How does artificial intelligence affect software security?
AI can help attackers discover software vulnerabilities faster, increasing the speed and scale of cyber threats. Organisations need automated and proactive security approaches to respond effectively.
7. Will Lightwell require organisations to upgrade all their software?
No. Lightwell is designed to provide validated patches for specific software versions already running in production, reducing the need for disruptive upgrades.
8. How does this partnership support enterprise digital transformation?
By improving software security and resilience, organisations can adopt new technologies such as cloud platforms, AI solutions, and open source applications with greater confidence.
About The Author
