During Anthropic’s Project Glasswing initiative, Visa evaluated Claude Mythos Preview against its global payment processing network. Operating across 200 countries and processing transactions across 160 currencies, Visa’s network connects 5 billion payment identifiers with more than 175 million merchant locations. 

Initial findings across participating critical infrastructure entities surfaced over 10,000 high- or critical-severity vulnerabilities within the initiative's first month. Beyond simple static scans, static flaw detection, the Mythos framework demonstrated the capacity to connect separate, minor flaws into across distinct network sectors into complex, composite attack chains. 

In response, Visa’s zero-trust architecture, network segmentation, and defense-in-depth controls successfully contained these hidden attack paths" or "potential entry points , keeping attackers from reaching them from the outside. After the Glasswing evaluation, Visa open-sourced its internal framework, the Visa Vulnerability Agentic Harness (VVAH). This system is meant to connect automated checks with reviews. 

VVAH has an 11-step process divided into four parts.

Using wide-ranging scans VVAH uses STRIDE/OWASP methods, in Phase 1 (Discovery & Modeling) to map the active attack surface before scanning. 

Results are checked using paths where agents vote, which helps filter out false positives before alerting security teams. 

Built on a vendor-neutral architecture VVAH works with Anthropic Claude and OpenAI-compatible tools during the checking steps. However full automatic code changes (Stage 10) and testing against attacks (Stage 11) still need models that can edit files directly. 

Visa’s adoption of these agentic security tools is part of a larger trend in enterprise measurement evolving past Mean Time to Detect (MTTD) and towards Mean Time to Adapt (MTTA), or how quickly an enterprise can validate, patch, and verify an exposure in their systems. To secure its software supply chain, Visa has required continuous software composition analysis and SBOM validation throughout their vendors. Visa is also involved with Project Lightwell, a collaboration between IBM, Red Hat, and Visa to help secure open-source components through AI-powered validation and patching processes. 

Visa ran Mythos against itself to prove that as offensive technologies become more automated in their reasoning, defensive systems need to be just as quick and sophisticated. “We open sourced VVAH to provide the community with a governed reference implementation and shift cybersecurity, so teams can patch flaws as fast as automated tools find them,” said Visa.