The natural assumption about AI-powered security tooling is that the hard part is finding vulnerabilities. The model has to understand the code, reason about attack surfaces, identify exploitable paths — and this requires frontier reasoning at every step.
Visa's newly open-sourced VVAH (Visa Vulnerability Agentic Harness) is built around a different premise. The hardest part isn't discovery. It's triage — moving from a raw AI-discovered signal to an actionable, human-reviewable finding fast enough to matter. And the design of VVAH follows directly from that constraint.
What VVAH Is
VVAH is a four-phase, eleven-stage pipeline that automates the journey from code repository to validated fix. It is built on Project Glasswing — Anthropic's initiative for AI-assisted vulnerability research — and works with Claude, OpenAI-compatible models, or both via a vendor-neutral abstraction layer.
The pipeline runs as a deterministic sequence:
--stop-after s9 for detection-only (no code edits).The Triage Design
The most interesting structural choice in VVAH is where the deterministic controls sit relative to the LLM reasoning. Discovery runs with multi-model, multi-lens analysis in S4 — six specialized roles: Language, Crypto, Logic-bug, Access-control, Batch/ETL, and IaC. But before expensive downstream work runs, S5 applies deterministic policy gates. Semantic deduplication only fires when survivor count exceeds a configured threshold (default: 25).
Then S6 adds adversarial verification: a separate LLM pass specifically tasked with constructing an exploit chain and tracing trust boundaries. Findings that survive S5 + S6 have been confirmed exploitable — not just flagged as suspicious.
The result: S7–S9 synthesis stages work on a clean, pre-confirmed signal. Chaining and SARIF emission happen over verified findings, not raw model speculation.
Skills as the Modularity Unit
Each LLM-driven stage is implemented as a composable, independently replaceable skill. S9 (SARIF emission) and the S5 pre-filter are deterministic; every other stage wraps a skill that can be tuned, versioned, or swapped without rewiring the pipeline.
This has a direct practical implication: organizations that want detection only (no source file edits) pass --stop-after s9. The remediation stage (S10) runs in fix mode by default — a plain vvaharness scan modifies your target repo. That default is documented prominently, but worth knowing before you run it.
The S11 adversarial panel — two always-on personas (security-architect + penetration-tester) plus a conditional cross-repo analyzer — can be independently updated as model capabilities improve, without touching the detection pipeline.
Multi-Model by Design
VVAH uses a vendor-neutral LLM abstraction layer with three backends: Anthropic Python SDK, a claude CLI subprocess adapter, and an OpenAI-compatible API path. The shipped profiles (default.yaml, sdk.yaml, full.yaml) cover common configurations. Any stage can be routed to any backend.
One asymmetry worth noting: current remediation and validation capabilities (S10–S11) require Anthropic models for full functionality. The detection pipeline (S1–S9) is backend-agnostic.
Why This Matters for PropTech
Security in PropTech is not an audit event — it's a continuous compliance requirement. Platforms handling lease data, payment rails, tenant identity, and property valuations operate under overlapping regulatory regimes. A vulnerability in how a document extraction agent handles authentication tokens isn't just a technical finding; it's a compliance exposure.
What VVAH demonstrates is a design pattern that scales to this complexity:
- Threat modeling before analysis — the LLM isn't reasoning in a vacuum; S1–S3 ground it in business context and attack surface
- Adversarial verification before synthesis — findings are confirmed exploitable before they're escalated
- A measurable output metric — MTTA connects AI capability to operational velocity, not just coverage
- Composable skills — each stage can be tuned to a specific language/framework/CWE without rewiring the whole pipeline
The same architectural constraints that make VVAH effective for security apply to any agentic pipeline that needs to convert AI-discovered signals into validated, actionable outputs. That's increasingly the core engineering challenge across the PropTech stack — and across agentic systems generally.
The repo is at github.com/visa/visa-vulnerability-agentic-harness. It is not currently accepting external code contributions, but the Project Glasswing white paper is worth reading as a reference architecture for agentic security pipelines.