Visa Open-Sources Agentic Vulnerability Testing Harness

Visa has published VVAH as code that security teams can inspect, adapt, and contribute to, according to the company's post. The company describes the tool as a reference implementation rather than a packaged security product.

The official description identifies several functions:

• •Systematic codebase and environment mapping
• •Agent-based vulnerability discovery, categorization, and prioritization
• •Detailed artifacts for developer review and remediation workflows
• •Support for identifying issues, remediation, and validation

OpenSourceForU reports that the implementation organizes its process into four phases and 11 stages, including threat modeling, exploit-chain synthesis, remediation, and fix validation. That report also describes a vendor-neutral design that supports Anthropic Claude, OpenAI-compatible models, and mixed-model deployments during assessment stages, while automated code changes require models with file-editing capabilities.

Visa cites Anthropic's Project Glasswing update, which reported that participants found more than 10,000 high- or critical-severity vulnerabilities in widely used and systemically important software during the initiative's first month. That figure covers the program's participants collectively, not Visa's network alone.

Visa also relayed Anthropic's assessment that the limiting factor in software security is increasingly verification, disclosure, and patching rather than initial discovery. VentureBeat similarly reported that Visa moved beyond traditional remediation measures for an internally developed measurement. OpenSourceForU identifies that measure as mean time to adapt (MTTA), encompassing inventory freshness, exploitable paths per release, and validation-cycle time.

For security and ML practitioners, the release provides a concrete example of an agentic security workflow built around more than model inference. Comparable systems generally require deterministic controls, policy gates, structured evidence, human review, and validation stages to make automated findings operationally useful. The publicly reported emphasis on exploit-path verification is especially relevant because increasing vulnerability discovery without effective triage can raise alert volume faster than remediation capacity.