Visa expands open-source AI vulnerability tool

Visa announced updates to its open-source Visa Vulnerability Agentic Harness (VVAH) that extend the framework from finding vulnerabilities to verifying and remediating them. The company said the changes can cut Mean Time to Adapt (MTTA) — the time from discovery to resolution of attack paths — with some fixes shrinking from weeks to hours.

The release adds a closed-loop remediation process that returns structured feedback when a fix fails validation so teams can refine repairs without restarting the workflow. Organizations can choose approved Anthropic or OpenAI models, or swap other AI models through configuration rather than changing code. An optional real-time progress view shows status for long scans and remediation runs.

Visa described VVAH as model-agnostic software designed to let security teams discover, triage, remediate and validate vulnerabilities inside a single, structured workflow. The company linked the update to its earlier work with Anthropic on Project Glasswing, which focused on AI-assisted vulnerability discovery.

Visa also expanded its Visa Consulting & Analytics (VCA) Cybersecurity Advisory Practice with three services based on VVAH and Visa’s experience with frontier AI. The services include executive training and certification through Visa University, a VVAH-informed cybersecurity maturity assessment to locate and evaluate risk areas, and a cyber risk prioritization and roadmap service to help organizations rank findings and plan remediation efforts.

Rajat Taneja, Visa’s president of technology, said AI is compressing the time between vulnerability discovery and exploitation and urged faster paths to validated remediation. Carl Rutstein, global head of Visa Consulting & Analytics, added that speed to remediation is now a key focus for defenders facing AI-enabled attackers.

Visa cited a recent engagement with Brazilian card issuer CAIXA Cartões as an example of how the advisory services are applied. Lessandro Thomaz, executive director at CAIXA Cartões, noted the engagement provided a structured assessment of process maturity and helped prioritize initiatives for risk management and operational resilience.

VVAH has been available as open-source software since June 2026 and, according to Visa, has been downloaded by tens of thousands of developers. Visa said it is contributing the model-agnostic framework to NVIDIA’s Open Secure AI Alliance and is collaborating through IBM and Red Hat’s Project Lightwell to support security for open-source software.