New services from Visa’s Consulting and Analytics unit are helping institutions identify their most critical security vulnerabilities and act before malicious actors do. The new version of Visa Vulnerability Agentic Harness (VVAH) extends AI-powered cyber risk management into a process that spans from vulnerability detection through to verification of remediation.
Visa continues to expand its cybersecurity portfolio to help institutions more effectively identify and remediate security vulnerabilities. As part of this effort, Visa has released a new version of its open-source, model-agnostic framework, Visa Vulnerability Agentic Harness (VVAH).
The new version aims to significantly reduce institutions’ Mean Time to Adapt (MTTA) — the time between the discovery of attack paths and the remediation of those vulnerabilities. For some vulnerabilities, this timeframe can be reduced from weeks to hours.
Visa is also expanding its Visa Consulting and Analytics (VCA) Cybersecurity Advisory Practice to help institutions better manage the evolving threat landscape. The new advisory services help institutions assess their risks, prioritize vulnerabilities that need to be addressed, and strengthen their resilience against the changing threat environment.
Visa Chief Technology Officer Rajat Taneja said, “AI is shortening the time between the discovery of a vulnerability and its exploitation. That means defense teams need a much faster and more reliable path to act. By advancing VVAH and expanding our cybersecurity advisory capabilities, we’re helping institutions move faster from insight to remediation — while also helping them build resilience in a threat landscape increasingly shaped by AI.”
VVAH’s scope is expanding
Released following Visa’s participation in Project Glasswing, Anthropic’s cybersecurity initiative focused on advanced AI systems, VVAH helps security teams detect vulnerabilities using AI, assess the likelihood of those vulnerabilities being exploited, and systematically present the results.
The new version extends this process beyond the discovery stage, also enabling the remediation of vulnerabilities and verification of the fixes applied.
Key improvements in the new version include:
Feedback-driven remediation refinement: When a fix fails verification, teams receive feedback on what still needs to be corrected, so they don’t have to restart the process from scratch.
Flexible model selection: Institutions can now use approved Anthropic models and OpenAI models, among many other AI models, purely through configuration — without any code changes.
Greater visibility: Optional real-time progress views provide greater transparency during long-running scanning and vulnerability remediation processes.
The framework helps institutions detect, assess, remediate, and verify fixes for security vulnerabilities.
New cybersecurity services
To help institutions translate findings and insights into business processes, Visa Consulting and Analytics is also offering three new cybersecurity advisory services developed from Visa’s AI-powered cybersecurity experience:
AI Cyber Leadership Education — covers executive training, workshops, and Visa University certificate programs led by Visa’s AI and cybersecurity experts. These programs are built on Visa’s expertise in AI and cybersecurity, helping leaders prepare for a threat landscape increasingly shaped by AI.
VVAH-Informed Cybersecurity Maturity Assessment — helps institutions use the VVAH framework to identify and assess potential security vulnerabilities, understand risk areas, and prioritize vulnerabilities that need to be addressed.
VVAH Cyber Risk Prioritisation and Roadmap — provides institutions with strategic guidance on evaluating findings, prioritizing vulnerabilities that need remediation, and building a long-term cyber risk management roadmap.
Visa Türkiye General Manager Samile Mümin said, “AI is accelerating both cyberattacks and the detection of cyber risks. In this environment, it matters just as much for institutions to be able to see the risks they face as it does for them to take concrete steps to remediate vulnerabilities faster. Through the cybersecurity advisory services we’ve developed, we’re bringing together the experience we’ve gained from Project Glasswing, our open-source VVAH solutions, and our expertise in payment systems across Europe. We’re helping institutions focus on their most significant risks, strengthen their response capabilities against those risks, and build the resilience needed to keep pace with a threat landscape being rapidly reshaped by AI.”
Growing interest in VVAH across the cybersecurity world
Since VVAH was made available as open source in June 2026, it has been downloaded by tens of thousands of developers worldwide, reflecting growing interest in AI-powered vulnerability management.
Visa is also involved in industry initiatives supporting the development of secure and open applications amid the rapid pace of progress in AI.
As part of NVIDIA’s Open Secure AI Alliance initiative, Visa is making VVAH available to developers as a model-agnostic framework. Visa is also working alongside other institutions under IBM and Red Hat’s Project Lightwell initiative to strengthen the security of open-source software.
