Visa’s Open-Source AI Initiative and Cybersecurity Evolution

Visa leverages AI to enhance cybersecurity in payment systems, open-sourcing its Vulnerability Agentic Harness to optimize security measures across networks.

Visa recently demonstrated how an AI-driven approach could redefine cybersecurity within its extensive payment network. The initiative involved applying Anthropic’s Claude Mythos to discover vulnerabilities in a system that connects billions of transactions across more than 200 countries. By using advanced AI models, Visa aimed to reveal flaws deep within its infrastructure, often exposed only during exhaustive penetration testing.

Rajat Taneja, Visa’s president of technology, explained at the VB Transform 2026 how Mythos’ deployment allowed the identification of weaknesses that traditional security measures might miss. This process not only underscored the sheer scale of the network’s integrity but also prompted Visa to abandon conventional metrics, adopting a new standard they call ‘Mean Time to Adapt’ (MTTA) to ensure genuine remediation over superficial patching.

AI-Driven Security Insights

Visa’s AI-driven security approach confirmed and expanded upon the potential of Mythos for analyzing applications. It surfaced vulnerabilities by employing context-aware analysis, enabling Visa to detect complex issues, such as exploit chains that human analysts may overlook. This method streamlined the decision-making process, allowing Visa’s teams to focus on actionable insights rather than sorting through a deluge of data.

Pattern detected: user workflows shift toward partial automation.

Open-Sourcing: The Visa Vulnerability Agentic Harness

To cultivate a collaborative approach to cybersecurity, Visa open-sourced its Visa Vulnerability Agentic Harness, a tool designed to orchestrate AI models for security tasks. Unlike traditional scanners, this harness was developed as a complex system that integrates threat modeling, multi-agent voting, and structured artifacts to swiftly transition from detection to remediation.

The harness supports various AI models, including Anthropic Claude and OpenAI, offering flexibility and provider independence which is crucial in an ever-evolving digital landscape. However, certain features like file-editing tools are optimized for Anthropic backends, demonstrating a limitation in current cross-model functionalities.

Introducing ‘Mean Time to Adapt’

Visa’s ‘Mean Time to Adapt’ introduces a new dimension in cybersecurity metrics. It focuses on the adaptability of an organization in confirming, fixing, and validating vulnerabilities to prevent exploit chains. This approach is designed to ensure that patches not only close a particular vulnerability but also eliminate potential attack paths, thus prioritizing effective and protective measures over mere vulnerability management.

By ensuring that security updates genuinely close vulnerabilities, MTTA redefines success from merely detecting issues to addressing and preventing them from manifesting within the network’s operations.

Beyond the Traditional Perimeter

As AI technology gains traction, Visa recognizes the need to extend security beyond its internal networks. It emphasizes the importance of a robust supplier and open-source component security framework, applying continuous validation and adherence to MTTA across its supply chain. Partnering with initiatives like Project Lightwell, Visa aims to reinforce security measures in collaboration with giants like IBM and Red Hat.

Agent-Driven Commerce and Future Challenges

Visa’s strategic foresight includes preparing for a future where AI agents might perform transactions autonomously. This scenario requires a strong trust framework and identity protocols to ensure secure transactions. It is a proactive step towards mitigating risks associated with agent-driven commerce.

The integration of AI agents changes how enterprises manage credentials. With a significant portion of companies already using shared credentials within agent deployments, Visa underscores the need for scoped identities and precise access permissions to prevent security breaches.

Proactive Systems and Human-Driven Governance

Visa’s harness on GitHub exemplifies that groundbreaking security does not always demand immense resources but rather a strategic shift in approach. Prioritizing adaptive responses, enhanced security measures, and proactive governance are critical in staying ahead of sophisticated AI-enabled threats.

In conclusion, Visa’s deployment of AI in cybersecurity showcases a shift from reactive to anticipatory security measures. Through open-sourcing its tools and embracing new metrics like MTTA, Visa not only strengthens its infrastructure but also provides a blueprint for the broader industry, encouraging a collective movement towards advanced, AI-powered security solutions. Monitoring continues.