IBM’s experience shows how contributing to open source can support business strategy, inform security decisions, and develop the people who lead technology forward. Through OpenSSF, that participation brings enterprise experience into a community working to secure the software upon which everyone depends.
For Jamie Thomas, open source comes with a responsibility: understand what you use and help sustain it.
In her conversation with CRob for Big Thoughts, Open Sources, published June 16, 2026, Thomas describes how IBM’s journey through Java, Linux, and Red Hat shaped its approach to enterprise participation. As IBM Enterprise Security Executive and an OpenSSF Governing Board member and former chair, she connects that history to a practical challenge: turning dependence on open source into intentional stewardship.
“If you are a direct consumer of open source, do it with intent.” – Jamie Thomas, IBM
What Does Open Source Commitment Look Like at Scale?
IBM’s investments demonstrate the strategic importance of open source, while OpenSSF provides practical resources for organizations managing their dependencies.
| $5 billion | Approximately $34 billion | $3.4B in Red Hat annual revenue |
| IBM and Red Hat commitment to Project Lightwell, an AI-driven security model. | Equity value of IBM’s Red Hat acquisition, completed in July 2019. | Red Hat’s fiscal year 2019 revenue, up 15% year over year before the acquisition. |
| Project Lightwell | Red Hat acquisition announcement | Red Hat’s reported revenue |
What Challenge Did IBM Need to Solve?
IBM needed to engage developers at scale while helping enterprise customers run open source reliably and securely.
Thomas recalls IBM’s early recognition that building a broad Java ecosystem required a different approach to software development. IBM invested in Linux contributors and opened its Java development tooling through Eclipse, giving developers a shared foundation on which to build.
The transition involved real debate. Thomas remembers customers arguing over whether Linux belonged on IBM mainframes. The benefit that emerged was portability: software developed for Linux could reach different hardware platforms.
As adoption expanded, the questions changed. Enterprise customers wanted to know who would maintain the software, support its operation, and address security needs. Experimenting with a project was one step. Depending on it in production required sustained care.
Why Does IBM Participate in OpenSSF?
OpenSSF gives IBM a place to learn from other organizations, contribute enterprise security experience, and help shape shared approaches.
Thomas joined OpenSSF’s Governing Board at its beginning. In the interview, she recalls SolarWinds and Log4j as significant events during her move into enterprise security, underscoring the importance of understanding risks across the software supply chain.
For IBM, participation helps keep the company informed about an evolving security landscape. It also creates opportunities to bring enterprise needs into discussions alongside startups, maintainers, and other software consumers.
Thomas emphasizes that software extends beyond the boundaries of any single company. Participation gives organizations a way to explain their requirements, understand competing perspectives, and contribute to decisions affecting the projects upon which they rely.
How Does IBM Connect Open Source Contribution to Business Value?
IBM connects community innovation with developer adoption, platform capabilities, and enterprise support.
Thomas explains that IBM’s investment in Linux helped expand its use across IBM platforms, giving customers greater portability and flexibility. Its acquisition of Red Hat deepened the company’s connection to open source communities and expanded its ability to reach developers.
Red Hat demonstrates how open source can support a commercial business through curation, maintenance, and enterprise support. Those capabilities help organizations move from experimenting with software to depending on it in production.
For other enterprises, the lesson is practical: identify where community participation supports a business need, then invest in the people and relationships that make that contribution effective.
How Does Open Source Participation Help Employees Become Leaders?
Community work gives employees opportunities to practice influence, communication, and problem-solving across organizational boundaries.
Thomas sees open source participation as one of several ways engineers can improve their career trajectory. Contributors learn to explain ideas, understand different priorities, and help groups reach agreement.
At OpenSSF, she values hearing the collective perspective of the community. Employees can bring that broader understanding into customer conversations and internal decisions.
IBM also makes contributions visible. Thomas describes an annual Open Innovation Award recognizing outstanding participation in open communities, including contributions by executives and non-executives. She recognizes recipients in her all-hands meetings.
That creates a tangible connection between work in the community and recognition inside the company.
What Can Employees Contribute Beyond Code?
Security expertise, testing, automation, communication, and coordination can all help open source projects succeed.
Thomas highlights a persistent challenge: creating security tools and guidance is only part of the work. Projects also need help adopting them. Initiatives like Akrites address this by coordinating industry efforts around vulnerability response and disclosure for critical software.
She points to automated testing and continuous integration and delivery as areas where experienced contributors can make a substantial difference. Recalling IBM’s work on WebSphere, she describes automation at scale as a turning point for her team.
That experience informs her perspective on AI-assisted vulnerability discovery. Finding defects creates another task: fixing them and testing the changes without breaking downstream systems.
People who can help projects make that transition bring valuable skills, whether or not writing application code is their primary role.
How Can Enterprises Put “Consuming With Intent” Into Practice?
Understand which open source projects your organization depends on, identify who maintains them, and make a plan to support their continued development.
Jamie emphasizes that participation can include contributing code, testing releases, sharing security expertise, or bringing enterprise requirements into community discussions. Through OpenSSF, organizations can contribute their experience, learn from peers, and help projects adopt stronger security practices.
How Can Your Organization Get Started?
Choose a project or community relevant to your business and define a concrete way to contribute.
Thomas closes with a question every enterprise can use:
“What is your strategy to give back?”
Contributing might mean supporting developers’ upstream work, sharing security expertise, testing a release, or bringing an enterprise perspective to a working group.
A practical starting point is to identify one important dependency, ask its community where help is needed, and assign time for a useful contribution. Recognize that work internally and share what the team learns.
Get involved with OpenSSF to connect your organization’s experience with the community securing open source.
Based on Jamie Thomas’s conversation with CRob on Big Thoughts, Open Sources. Watch the interview.