Technology · NEWS EXPLAINER
Visa says autonomous AI attacks need agentic defenses with human oversight
Visa says future cyberattacks could adapt faster than human-led defenses can respond, and it is pushing more AI into vulnerability discovery, remediation and validation. Its open-source VVAH system automates much of that loop, but Visa says people still review findings, severity and remediation decisions before changes advance.
Visa is pushing its cyber defenses toward more autonomous AI as it prepares for attacks that could adapt and improve without direct human control. In a September 29 Reuters interview, Visa President of Technology Rajat Taneja argued that human-only defenses will not be fast enough if attackers begin operating through autonomous agents.
The company has already open-sourced the Visa Vulnerability Agentic Harness, or VVAH, a reference implementation that uses AI to help find, verify, prioritize and remediate software vulnerabilities. Visa's own technical material makes an important boundary clear: the system is designed to automate more of the security loop, but people still review findings, validate severity and determine remediation paths at critical stages.
Visa is automating more than vulnerability discovery
Visa's VVAH started as an open-source framework for using AI models to find and analyze software weaknesses. The company's current technical description says the system maps the codebase, deploys AI agents to search for vulnerabilities, prioritizes findings and produces structured reports for developers and remediation agents.
Visa has since extended the workflow into remediation and validation. That means the system can help generate fixes and test whether a proposed patch actually closes the attack path, rather than stopping after a scanner flags a problem. VentureBeat reported in August that this expansion moved VVAH beyond discovery and reporting into a closed-loop remediation process.
Visa's argument: machine-speed attacks need machine-speed defense
Taneja told Reuters that future attacks could be adaptive, continuously learning and improving without direct human intervention. His view is that a defense model built mainly around human triage would be mismatched against an attacker that can probe and change tactics at machine speed.
Visa's own technical post uses similar reasoning. It says cyber defense will need to move from alert-heavy workflows toward systems that can reason across signals, enforce policy and take bounded action quickly. That is the logic behind what Visa describes as an increasingly autonomous control plane for detection, defense, remediation and containment.
Human oversight is still part of the design
More automation does not mean Visa says security decisions should be handed over completely to AI. Its technical post says security and engineering teams review findings, validate severity and determine remediation paths before changes advance. Patch-validation agents can then help test whether a fix actually works.
That boundary matters because autonomous remediation can create its own risk if an agent is allowed to make high-impact changes without enforceable controls. VentureBeat quoted an external security expert arguing for authorization gates outside the model for sensitive actions. Visa's public material likewise says human accountability should remain at critical decision points.
The testing found weaknesses, but Visa says its underlying controls held
Visa joined Anthropic's Project Glasswing to test how frontier AI could accelerate vulnerability research. Visa says the exercise found new weaknesses and highlighted where it could improve, but it also says zero-trust controls, network segmentation and other safeguards would have prevented the critical findings from becoming successful external exploitation.
Reuters says the experience was serious enough to reinforce Visa's concern about autonomous cyberattacks. Taneja also pointed to a separate, longer-term challenge from quantum computing, which could eventually threaten current encryption standards. That is a future cryptography problem rather than evidence that today's payment encryption has already been broken.
