Attackers now weaponise vulnerabilities faster than most teams can patch them. With AI collapsing the window between a flaw being discovered and being exploited, simply scanning for weaknesses is no longer enough — what payments and fintech firms need is a fast, trustworthy path from finding a problem to actually fixing and verifying it.

That is the gap Visa is targeting with the next iteration of its Visa Vulnerability Agentic Harness (VVAH), paired with broadened advisory work from its consulting and analytics arm. The framework, released as open source and built to work with any model, now stretches AI-driven risk management all the way from discovery to confirmed remediation.

From spotting flaws to proving the fix worked

The hard part of security has quietly shifted: the difficulty is no longer locating vulnerabilities but reacting quickly enough to shut the door before an attacker walks through it.

VVAH first emerged after Visa took part in a frontier AI cybersecurity effort focused on stress-testing model-driven defence, where agentic systems demonstrated they could trace tangled exploit chains running through critical infrastructure. The latest version pushes that capability past triage, folding the actual fixing and validation of issues into one structured pipeline.

The upgrade adds closed-loop remediation with structured feedback, so a fix that fails can be reworked without tearing down the whole workflow. Teams can swap between approved frontier models, OpenAI-compatible models and open-weight options through configuration rather than rewritten code. Optional live progress views give visibility into long-running scans, human oversight is baked into every stage to keep control over high-risk actions, and reporting follows a standard format that plugs findings straight into developer and security-operations tooling. Taken together, the features let teams discover, rank, repair and verify weaknesses inside a single governed flow, narrowing the window in which an intruder can operate.

Turning insight into an operating playbook

Detecting a problem means little if an organisation cannot act on it — so Visa is wrapping the technology in hands-on guidance.

The company's consulting practice is expanding its cybersecurity advisory offering with three services shaped by its own experience running AI-powered defence. Executive workshops walk leadership through lessons from frontier AI security work and how to brace for an increasingly automated threat environment. A maturity assessment applies the VVAH lens to surface and weigh potential weaknesses, map risk areas and sequence remediation. And a prioritisation-and-roadmap service offers strategic direction for evaluating findings, ordering fixes and shaping a longer-term risk-management plan tied to business goals.

Leaders inside the company frame the shift bluntly: uncovering vulnerabilities is no longer the toughest challenge — speed to remediation is where the fight is now won or lost. When AI-enabled adversaries move faster and probe at scale, the argument goes, defenders need AI-powered countermeasures of their own.

AI is shrinking the distance between a flaw being found and a flaw being exploited — defenders now need a quicker, more dependable route to action. — Visa's technology leadership

Betting on open standards, not walled gardens

Rather than keeping the tooling proprietary, Visa is pushing it outward into the wider security community.

Since its open-source debut in June 2026, the harness has been pulled down by tens of thousands of developers around the world — a signal of real appetite for practical, AI-driven vulnerability management. Visa is also channelling the framework into broader efforts to secure agentic AI and open-source software.

As a member of an industry alliance spanning more than 120 organisations focused on safe, secure agentic AI, Visa is offering VVAH as a model-agnostic building block to help standardise secure practices across the sector. Through a separate collaborative initiative aimed at hardening open-source components, it is working with other firms to improve security patterns for AI-enabled development and operations — an acknowledgement that resilience in payments depends on the health of the whole ecosystem, not any single company's defences.