Visa has announced updates to its open-source Visa Vulnerability Agentic Harness (VVAH) framework and an expansion of cybersecurity advisory services through Visa Consulting & Analytics, as organisations face faster exploitation cycles driven by AI-enabled threats.
The company said the latest VVAH release aims to reduce “Mean Time to Adapt” (MTTA) — the time between discovery and resolution of attack paths — reporting that some resolutions have been reduced from weeks to hours.
“AI is compressing the time between vulnerability discovery and exploitation, which means defenders need a faster, more reliable path to action,” said Rajat Taneja, President, Technology, Visa. “By advancing VVAH and expanding our cybersecurity advisory capabilities, we’re helping organisations move from insight to validated remediation while strengthening resilience in an increasingly AI-driven threat landscape.”
The updated VVAH release extends workflows beyond vulnerability discovery into remediation and validation. Visa said enhancements include closed-loop remediation to help teams refine fixes that fail validation, optional real-time progress views for long-running scans and remediation workflows, and expanded support for deploying approved Anthropic models and OpenAI models, alongside other models via configuration rather than code changes.
Visa said VCA is introducing three new cybersecurity advisory services: AI Cyber Leadership Education, VVAH-Informed Cybersecurity Maturity Assessment, and VVAH Cyber Risk Prioritisation and Roadmap. The company positioned the services as support for assessing risk, prioritising remediation and strengthening resilience.
“Finding vulnerabilities is no longer the hardest part. Speed to remediation is the new battleground. When AI-enabled attackers move faster and probe at scale, companies need AI-powered defenses,” said Carl Rutstein, global head of Visa Consulting & Analytics. “Our enhanced cybersecurity advisory services combine insights from implementing frontier AI models for cybersecurity, VVAH, and decades of payments expertise to help clients prioritise risk areas, act quickly and build sustainable cyber resilience.”
Visa also cited uptake of VVAH since its open-source release in June 2026, saying it has been downloaded by tens of thousands of developers. The company said it has joined NVIDIA’s Open Secure AI Alliance and is contributing VVAH as a model-agnostic framework, and is collaborating through IBM and Red Hat’s Project Lightwell initiative focused on securing open-source software.
