✦ Lightwell: $5 Billion to Police Open SourceThin moat

IBM's newest bet was announced in the letter that explained its worst quarter. Lightwell, Krishna wrote, "is a $5 billion commitment backed by new frontier AI capabilities and a global force of more than 20,000 engineers creating a trusted enterprise clearinghouse to address open source software vulnerabilities"¹. General availability was announced on 8 July 2026².

The early adopters named are mostly banks and payment companies: Bank of America, BNY, Citi, Goldman Sachs, JPMorganChase, Mastercard, Morgan Stanley, Royal Bank of Canada, State Street, Visa and Wells Fargo³. The list is dominated by banks and payment networks, large regulated institutions that depend on open-source code they did not write.

The strategic fit is Red Hat's. Red Hat already sells supported, tested versions of open-source software; Lightwell extends that promise to the vulnerabilities in it. IBM did not say how much of the $5 billion is cash spending, how it will be charged for, or when revenue will appear.

The cost falls on margins that are only just improving. IBM's operating pre-tax margin, which excludes some acquisition and pension items, was 19.2% in the second quarter of 2026, up 30 basis points⁴. A commitment of this size will show in that figure if it is spent quickly.

Lightwell also extends an existing IBM habit of selling trust rather than technology. Red Hat's business is selling tested, supported versions of software that is otherwise free; Lightwell sells assurance about the vulnerabilities in it. IBM's first-half cash flow was strong enough to start: free cash flow of $4.8 billion was flat on the year⁵. Whether the commitment is spent faster than that is the question the next quarters will answer.

The bet is thin until it has a price. The test is that operating margin: if it falls in the second half of 2026 while IBM reports no Lightwell revenue, the commitment will be a cost before it is a product.