Turning security complexity into useful intelligence: What’s new in Red Hat Lightspeed

In a post-Mythos world, IT teams face a mounting crisis. Many are doing more with the same staff, and security work hasn’t gotten simpler. Alerts still land without context. Compliance still means chasing down answers across tools. A single incident can consume an afternoon before anyone knows the real risk.

To help teams move from static notification to proactive execution, Red Hat Lightspeed now delivers a series of updates to bridge the skills gap, break down operational barriers, and simplify security at scale.

From cryptic data to immediate, confident action

The cybersecurity skills gap means that infrastructure generalists are often expected to act as security experts, spending critical time trying to translate complex detection data from standard alerts before they can even decide on next steps.

Instead of presenting raw, cryptic YARA signatures, Red Hat Lightspeed now provides plain-language context. When a detection occurs, you receive an immediate, human-readable summary that explains exactly what the signature detects, and why it represents a risk to your specific workload. This empowers your existing team to triage with confidence.

Breaking down barriers for a synchronized defense grid

Security cannot operate in a vacuum, but many teams struggle with fragmented environments where vulnerability data is trapped in isolated tools.

Defensive coverage in Red Hat Lightspeed is now significantly broader, with more than 4,300 expert-verified YARA rules from CrowdStrike integrated natively into the malware service for joint Red Hat and CrowdStrike customers — a more than 20-fold increase. You can also now see the author of each rule clearly in the UI, allowing you to filter decisions by vendor. This expanded intelligence creates a more robust scanning canvas for joint customers.

Additionally, vulnerability data can now stream directly into your central security information and event management (SIEM) or security orchestration, automation, and response (SOAR) platforms such as Splunk or ServiceNow. This can happen the moment a threat is detected, reducing notification blind spots. By connecting this data to Event-Driven Ansible , you can even trigger automated playbooks to address threats across your environment instantly. This is the foundation for cohesive, portfolio-wide orchestration.

Eliminating the upgrade tax on compliance

Routine operating system upgrades are essential for security, but manually reconstructing compliance policies (SCAP) across RHEL minor versions can be a time-consuming, error-prone task.

Modernization no longer needs to be stalled by manual rule mapping. You can now use a visual interface to instantly copy and import tailored rules from one policy to another. Automated "diff" reports provide an instant view of exactly which rules have been added, removed, or modified during an upgrade. This provides an extra layer of scrutiny to catch unintended changes, so that your compliance posture stays intact without the hours of manual configuration that previously held back your infrastructure cycles.

Enterprise security, already included

These updates address 3 recurring bottlenecks: understanding what a detection actually means, getting threat data where your team already works, and keeping compliance policies current across RHEL upgrades.

These Red Hat Lightspeed updates are included with your Red Hat Enterprise Linux subscription, helping you scale infrastructure, automate remediation, and accelerate innovation—all while maintaining a strong security posture.

Next steps

Ready to see how Red Hat Lightspeed can help your team move from static notification to proactive execution? 

Learn more