Speed Issues with Traditional Patching

Open source has become an integral part of the business world; after all, 98 percent of commercial codebases now contain open-source software. Ultimately, hardly any modern application can do without open source—after all, why should companies develop everything from scratch themselves when there are reliable solutions that are actively maintained by a vibrant community? SAP, too, can be easily extended with the help of open source—the foundation for this is provided by SAP BTP, in which SAP itself also relies on open source in many areas.

However, what has so far dramatically increased the pace of innovation in companies is now turning into a massive security challenge, as advanced AI models are incredibly good at finding vulnerabilities in software. For example, using the preview version of Claude Mythos, Anthropic examined more than 1,000 open-source projects this spring—projects on which a large part of the internet and many corporate infrastructures are based. Thousands of vulnerabilities were discovered, which security experts subsequently rated as „high“ or „critical.“.

The Race Between Humans and AI

This marks the start of a race for companies—one they can hardly win on their own. After all, if AI finds more vulnerabilities than humans ever could—and does so in ever-shorter periods of time—their established patching and update processes will break down. They simply can no longer keep up with evaluating which applications contain vulnerable components and which systems are affected, and they lack the time to thoroughly test all available patches and new versions, customize them as needed, and deploy them. The mountain of updates keeps growing—as does the risk that cybercriminals will exploit one of the unpatched vulnerabilities.

AI can also help by analyzing code and vulnerability information and suggesting appropriate countermeasures to reduce response times. This is exactly where IBM and Red Hat come in with Lightwell—an initiative to secure complex open-source software supply chains, based on an AI-powered remediation engine and the expertise of more than 20,000 engineers. As part of Lightwell, vulnerabilities and dependencies are identified, security updates are developed, and production-ready update packages are deployed. Disruptive upgrades or extensive changes to production systems are not necessary, as the fixes and patches developed are always backported to earlier versions in accordance with the „Upstream Always“ model, allowing companies to continue using their existing software versions without having to switch to new major releases.

At launch, Lightwell maintains a catalog of over 6,500 digitally signed and certified components, which is constantly being expanded and includes not only source code but also compliance documents such as SBOMs. Initially available only for the financial sector, targeted individual updates for other components are also being developed—with other industries such as healthcare, telecommunications, and public administration set to follow. Ultimately, AI not only exacerbates the threat landscape but also helps reduce the attack surface. What previously required hundreds or thousands of manual checks, adjustments, and decisions can now be largely automated. To ensure nothing goes wrong, the processes must be carefully designed. And thanks to Lightwell, companies don’t have to do this on their own; instead, they can seek support from SAP partners and ISVs that join Lightwell to review applications—whether developed in-house or by integrators—against open-source components, identify vulnerabilities, and patch them.

Security, just like open source, is and always will be a team effort, and the best results are achieved when everyone involved works together.

To the partner entry: