From Discovery to Action: Rethinking AppSec with Agentic Pipelines and MTTA

Frontier AI models are compressing vulnerability discovery from weeks to minutes. In practice, that flips the constraint. Finding issues isn’t the hard part anymore—understanding which ones matter, proving exploitability, and actually closing the path is.

This talk is based on lessons learned running an agentic pipeline in real-world environments, implemented through the Visa Vulnerability Agentic Harness (VVAH), an open-source agentic pipeline. The focus isn’t the tool itself, but what changes when discovery runs at machine speed and what it takes to make the output usable by security and engineering teams.

We walk through how threat modeling and parallel analysis expose classes of issues traditional tools struggle with—missing controls, broken authorization, and multi-step exploit chains that only become visible when you follow the full path. We also discuss why early outputs were too noisy to use, and how that forced changes beyond prompt tuning, including adversarial validation, deterministic filtering, and structured outputs that can be consumed without re-triage.

The key shift is operational. It’s no longer about how many issues you find, but whether exploit paths are actually closed. We introduce Mean Time to Adapt (MTTA): the time from initial signal to a validated fix in production, and how it changes how security effectiveness is measured in practice.