Visa pointed Anthropic's Claude Mythos at its own payment network: 200 countries, 160 currencies, 5 billion credentials, 175 million merchant locations. The model found critical-severity vulnerabilities and stitched minor weaknesses into working exploit chains that traditional penetration testing would have caught only late in the cycle. Visa's zero-trust controls and network segmentation broke those chains before they became exposure, but the confirmation was not the point. The epiphany, per Rajat Taneja, Visa's president of technology, was this: agentic attacks require agentic defense.
Visa's answer is the Visa Vulnerability Agentic Harness, now in its fifth generation and live on GitHub as of June 10. It is not a scanner. It is a governed pipeline running four phases and eleven stages: code ingestion, threat modeling, deep-dive verification, exploit chain synthesis, remediation, and fix validation. Three design choices drive quality. Threat modeling runs before analysis. Multi-agent deterministic voting requires convergence across independent reasoning chains before a finding advances. Structured triage artifacts compress the time from discovery to a result developers can ship. In default fix mode, the pipeline edits source files directly and applies candidate patches unless an operator intervenes. The file-editing capability currently requires Anthropic backends. OpenAI-compatible models are limited to report-only output in remediation stages.
The metric Visa invented to measure all of this is Mean Time to Adapt, tracked across three dimensions: inventory freshness, exploitable paths per release, and validation cycle time. It replaces CVE closure counts and mean time to detect, which Taneja argues can improve on paper while actual exposure grows underneath. CISA data backs the prioritization logic: fewer than 1% of CVEs are ever actively exploited. Visa's SSDLC policy now treats every exploitable path as one that will be. The white paper also publishes 12 non-negotiable architectural practices for critical infrastructure. That document, the harness repo, and the methodology behind MTTA are the reason to read the full piece.
[READ ORIGINAL →]