Red Hat’s first Security Signals report models the value of reusable fixes

Red Hat has published the first edition of Open Source Security Signals, a report that argues vulnerability counts and severity scores are incomplete measures of open-source security health. The company proposes three signals instead: risk relevance, remediation health and the value created when a fix can be reused across many downstream applications.

From vulnerability scores to attack paths

The Q3 2026 report says practical exposure depends on reachability, configuration, credentials, dependency relationships and the paths an attacker can combine—not only a CVSS-style severity label. It uses the 2024 compromise of Ultralytics’ GitHub Actions environment as an example of a supply-chain attack in which malicious PyPI packages were produced through legitimate build infrastructure rather than appearing in the project’s public source.

That framing matters for platform and application teams because remediation has to move through dependency trees and across software generations. Red Hat says that, as of October 1, its Lightwell work had delivered more than 30,000 validated Java and Python package versions. The observed population spans frameworks, authentication, cryptography, observability, cloud services, build tooling, AI and agent development.

A model, not a measured customer outcome

The report’s largest number is explicitly an estimate. Red Hat models a global population of 3 million production Java applications, then applies assumptions about Java 8 adoption, JAXB use and the persistence of vulnerable versions. That produces an estimated 285,000 applications using an affected JAXB version.

Using a further assumption of 20 engineering hours at $125 per hour for each application to assess, fix, test and deploy a remediation, Red Hat calculates 5.7 million hours and $712.5 million of potentially duplicated effort. The report argues that a validated, backward-compatible reusable fix could prevent much of that repeated engineering work, although organizations would still have to assess exposure, consume the fix, test applications and deploy it.

Red Hat also models a 10-day accelerated remediation scenario against a cited 54.81-day industry baseline, yielding a theoretical reduction of 44.81 exposure days per affected application, or about 12.8 million application-days across its estimated population. The company is careful to label this as a modeled scenario rather than an observed Lightwell customer benchmark.

What teams should take from it

The useful operational idea is narrower than the headline dollar figure: measure whether relevant risks can be understood and remediated quickly, and whether fixes reach the older software that enterprises still run. The exact economic total depends on several adoption and cost assumptions, but the report gives platform teams a concrete framework for evaluating remediation velocity and downstream reuse instead of treating every vulnerability count as equally informative.

Red Hat says future editions will track changes in vulnerabilities, assessment and remediation speed, dependency resilience, and the repeated work that reusable fixes can reduce.