Visa is transitioning from periodic cybersecurity checks to a continuous, AI-driven defence model in response to the increasing speed of cyber threats. The shift comes as India experiences a sharp rise in cyber fraud, with cases climbing 24% year-on-year to 2.81 million in 2025.
The company has moved away from schedule-based vulnerability management toward a system of continuous detection, testing, remediation, and validation. Central to this approach is the open-source Visa Vulnerability Agentic Harness (VVAH), which employs multiple AI agents to identify vulnerabilities, test them, develop fixes, and validate those fixes before they reach production. Visa is also adopting "Mean Time to Adapt" (MTTA) as its primary metric, focusing on how quickly it can close exploitable paths rather than relying solely on detection or patch counts.
This new strategy was tested through "Project Glasswing," a defensive cybersecurity initiative conducted in collaboration with Anthropic. During this exercise, frontier AI models were used against Visa’s internet-facing services, core platforms, and critical infrastructure. While the tests exposed complex vulnerabilities, Visa stated that its zero-trust architecture and network segmentation successfully prevented these vulnerabilities from becoming successful attack chains.
Suresh Sethi, Group Country Manager at Visa, noted during the launch of a whitepaper on Project Glasswing at the Global Fintech Fest in Mumbai that the challenge is no longer just finding vulnerabilities but fixing them faster than they can be exploited. He emphasized that sustaining trust in India's digital payments ecosystem requires innovation in security and resilience at the same pace as financial innovation.
Beyond internal measures, Visa has developed an agentic control plane to govern the identities, permissions, and operating boundaries of its AI agents. Its Payment Threats Lab continues to test fraud and AI attacks against payment rules and configurations. Additionally, Visa is working with IBM and Red Hat on "Project Lightwell" to secure open-source software and has tightened supplier requirements regarding continuous vulnerability testing and software bills of materials.
The urgency for these measures is driven by significant losses in the Indian market. In 2025, losses from investment scams reached Rs 22,495 crore, while digital-arrest scams accounted for 9% of total losses. The national cyber-fraud helpline logged 32.4 million calls during the year, averaging roughly one call every second.
