Visa has expanded its bet on AI-driven cybersecurity with a new version of the Visa Vulnerability Agentic Harness (VVAH), its open-source, model-agnostic framework. The main change is that the system no longer focuses solely on discovering and analyzing vulnerabilities: it now includes a workflow for proposing fixes, validating them, and reworking them when they fail those checks. Visa says certain processes can go from weeks to hours.
Visa VVAH key points in 30 seconds
- VVAH expands from vulnerability detection to remediation and subsequent validation.
- The framework is open source and supports models from Anthropic, OpenAI, and other providers.
- A closed loop sends fixes that fail validation back for refinement.
- Visa says it has cut some processes from weeks to hours, though it doesn’t publish a general metric that applies to every environment.
- Visa Consulting & Analytics is adding three cybersecurity- and AI-related services.
Visa’s original announcement came on August 27, 2026, though the news has since spread to other markets. The company frames the change around a metric it calls Mean Time to Adapt (MTTA), which it defines as the time between discovering and resolving an attack path. The reduction Visa reports reflects its own experience and shouldn’t be read as a guaranteed timeline for any organization deploying VVAH.
This development is especially interesting for another reason. Visa isn’t rolling out a new proprietary AI model — it’s introducing an orchestration layer that can work with different models. That separates the security workflow from the specific choice of AI provider.
VVAH wants to close the loop between finding a flaw and confirming the fix
VVAH was born out of Visa’s participation in Project Glasswing, an Anthropic initiative focused on using advanced AI models in cybersecurity. The first version showed how these systems could be used to locate vulnerabilities, assess their exploitability, and generate structured output.
The new version extends that process.
Visa’s workflow can be summed up in four stages:
| Stage | What VVAH does |
|---|---|
| Discovery | Locate potential vulnerabilities |
| Triage | Analyze and prioritize findings |
| Remediation | Prepare fixes |
| Validation | Check whether the fix resolves the issue |
The differentiator is what happens when a fix doesn’t work.
Visa has built in closed-loop remediation. If a proposed fix fails validation, the system generates structured information about the failure and uses it to refine the fix without having to restart the whole analysis from scratch.
It’s a meaningful step up from one of the most common uses of generative AI in security today: using a model as an assistant to analyze code and flag issues, then leaving the entire fix-and-verify process to a human team.
VVAH tries to keep those stages inside the same workflow.
Visa has also added optional real-time progress views. The goal is to provide more visibility when analysis or remediation runs take longer to complete.
The company says this automation has let some processes that previously took weeks get done in a matter of hours. It hasn’t, however, published a detailed enough comparison to extrapolate that reduction to any given repository, vulnerability, or infrastructure.
Visa’s approach echoes a broader industry shift toward AI-native remediation platforms. CrowdStrike, for instance, recently unveiled Falcon IQ, a system that uses more than 50 specialized AI agents to tackle vulnerabilities.
OpenAI, Anthropic, or any other model, by configuration
Another significant change is in the architecture.
VVAH is presented as a model-agnostic framework — it isn’t built around a single large language model (LLM). Organizations can use approved Anthropic and OpenAI models, but Visa says other models can also be integrated through configuration rather than by modifying the framework’s code.
That means the model in use can change while the rest of the security workflow stays the same.
| Feature | New VVAH version |
|---|---|
| Open source | Yes |
| Vulnerability detection | Yes |
| Assessment and triage | Yes |
| Remediation generation | Yes |
| Post-fix validation | Yes |
| Retry loop after failed validation | Yes |
| Anthropic models | Supported |
| OpenAI models | Supported |
| Other models | Integrable via configuration |
| Progress tracking | Optional, real-time |
That independence can be especially useful for companies that don’t want to tie their security processes to a single provider, or that apply different policies depending on the sensitivity of the code being analyzed.
It also opens the door to architectures where different models handle different tasks, though Visa doesn’t claim that setup is mandatory or that it always produces better results.
VVAH has been available as an open-source project since June 2026. According to Visa, it has since been downloaded by tens of thousands of developers worldwide. The company is also contributing the framework to Nvidia’s Open Secure AI Alliance and taking part in Project Lightwell, an IBM and Red Hat initiative focused on open-source software security.
The approach reflects a shift starting to show up in AI-agent security tools. Automatically finding vulnerabilities is useful, but it can end up creating a different problem if the result is hundreds or thousands of alerts that teams don’t have the capacity to work through.
Automating part of the remediation process tries to shift the focus from how many vulnerabilities a tool can find to how long an organization actually takes to fix them. The urgency behind that shift lines up with recent industry warnings: Gartner has said AI is now finding vulnerabilities faster than security teams can patch them, which is exactly the bottleneck Visa says it’s trying to close.
Visa turns VVAH into a consulting offer too
The technology update comes alongside a commercial expansion of Visa Consulting & Analytics (VCA).
The company has introduced three new advisory services related to cybersecurity and AI.
The first, AI Cyber Leadership Education, includes executive workshops, training, and Visa University certification courses taught by AI and security specialists.
The second is a VVAH-supported cybersecurity maturity assessment. The service uses the framework to identify and evaluate potential vulnerabilities, determine risk areas, and set remediation priorities.
The third, VVAH Cyber Risk Prioritization and Roadmap, is aimed at analyzing findings and defining longer-term risk-management priorities and plans.
Visa Consulting & Analytics had already been working with organizations on maturity and risk assessments. The company cites CAIXA Cartões as an example, which has used its services to assess its cybersecurity processes and prioritize initiatives related to risk and operational resilience.
The combination of open software and professional services is telling about the strategy. VVAH can be used as an open-source framework without hiring Visa’s consulting arm, while VCA sells services built around that experience and methodology.
Visa justifies the shift by pointing to how AI is also changing the offensive side of the equation. Rajat Taneja, the company’s President of Technology, argues that AI is shrinking the time between discovering a vulnerability and exploiting it, forcing defenders to speed up their response.
That idea has a practical consequence: applying AI only to finding more flaws might not fix the bottleneck if organizations still need weeks to triage them, fix them, and verify the fix works.
The new version of VVAH is specifically trying to automate a larger share of that chain. It remains to be seen how it performs outside the environments Visa itself has used, especially in large repositories, legacy applications, and systems where an automated change could have significant operational consequences.
The fact that an agent can generate a fix doesn’t remove the need for change controls, either. Automated validation adds another layer of checking, but organizations will still have to decide which changes can be made automatically and which need human review before reaching production.
That balance between autonomy and control will likely be one of the central issues as AI agents start intervening directly in code and critical infrastructure.
Frequently asked questions
What is Visa Vulnerability Agentic Harness?
Visa Vulnerability Agentic Harness (VVAH) is an open-source framework for using AI models in vulnerability management processes. The current version covers discovery, triage, remediation, and validation.
Does VVAH only work with Anthropic models?
No. Visa says VVAH can work with approved Anthropic and OpenAI models, in addition to integrating other models through configuration.
Can VVAH automatically fix a vulnerability?
The new workflow can generate fixes and validate them. When a fix fails the checks, the system can use the information it gathered to refine it within a closed loop.
Does Visa claim every vulnerability can be fixed in hours?
No. Visa says some processes that previously took weeks have been cut to hours. The company doesn’t present that timeframe as a general guarantee for every vulnerability or organization.
