AI Vulnerability Patching Moves Into a New Phase
AI vulnerability patching is becoming a higher priority as models expose technical debt across older enterprise systems. In this Techstrong TV interview, Mike Vizard discusses the issue with Brian Gracely, senior director of portfolio strategy at Red Hat. The conversation focuses on Lightwell, a Red Hat and IBM initiative designed to help organizations address open source vulnerabilities at scale.

Gracely explains that AI models are changing the pace of vulnerability discovery. Enterprises rely on years-old Java, Python and other software systems that may be difficult to upgrade without new testing, certification and operational risk. Many organizations want a way to patch the systems they run today without forcing broad platform changes.
Lightwell Applies Open Source Scale to Security
Lightwell is positioned as a clearinghouse model for AI vulnerability patching. Customers can bring older CVEs and vulnerable dependencies into the process. Red Hat and IBM can then triage, fix, verify and package remediations for member environments.

The model is designed to avoid one-off fixes that never travel beyond a single organization. Gracely notes that many enterprises share 80% to 85% of the same software patterns. That means one fix may help dozens or hundreds of organizations. After members receive an embargoed head start, fixes can also flow back to the upstream open source communities.
Maintainers Still Need Control
The discussion also highlights the role of open source maintainers. Red Hat is not trying to bypass community governance. Instead, Gracely says fixes can be returned with testing details, verification and an SBOM so maintainers can review them and decide how to proceed.

That approach gives communities help with volume while preserving their decision-making authority. It also gives enterprise users a practical way to contribute back to the projects they depend on. As AI increases the number of discovered flaws, that shared model could become more important.
Patch Speed Becomes a Business Issue
AI vulnerability patching also changes expectations for response time. Gracely says the gap between finding a vulnerability and seeing exploitation is shrinking fast. Organizations can no longer assume they have long windows to evaluate fixes while attackers wait.

The conversation connects this problem to broader DevSecOps maturity. Companies that manage software better can move faster, reduce risk and adapt to dynamic markets. Lightwell gives Red Hat and IBM a specific use case for improving patch-to-production workflows. The larger lesson is that software management discipline is becoming central to security, resilience and competitive advantage.