Visa Implements Agentic AI Workflow for Security Alert Triage

Visa's cybersecurity team just quietly shipped something that sounds boring on paper but matters a lot in practice: an AI-assisted workflow that cuts triage time on a specific mainframe security alert from up to 20 minutes down to a few seconds. This happened as a side effect of a bigger, less glamorous project — migrating detection logic off a legacy SIEM and onto Elastic Security. Migrations like that are usually just rule-by-rule conversion work. Visa's team used the opportunity to build something new instead.

The detection they picked wasn't random. It flags suspicious mainframe identity activity, but historically the alert only told analysts that something happened, not who did it. Because terminal IDs get reused across different people, analysts had to log into a separate system, run a second manual query, and cross-reference the timing to figure out which user was actually behind the terminal at that moment. Experienced analysts could do this fast. Newer ones, less fluent in mainframe log codes, could burn real time on it, and results varied in quality depending on who was on shift.

Visa's fix chains four steps together inside Elastic's Workflows tool, all running natively in one platform rather than bolted onto a separate SOAR system. First, a narrow query scans mainframe logs every five minutes for the specific activity pattern. Second, an automatic follow-up query finds the closest prior login to that terminal, effectively doing the manual detective work analysts used to do by hand. Third — and this is the part getting attention — a large language model checks whether that enrichment data actually supports the conclusion, then writes a short structured summary naming the user and explaining the logic. Fourth, that summary gets pushed straight into Visa's incident-response ticketing system via webhook.crucially, the AI here isn't freelancing. It gets a tightly constrained prompt, only the last 5 to 15 minutes of relevant data, and one job: verify and summarize, not investigate or decide whether to escalate. That's a deliberate design choice for a company operating inside financial-services compliance requirements, where an opaque AI decision is a liability, not a feature.

The alert itself is rare, firing only a few times a year, so the raw time savings won't move Visa's overall security metrics much. What matters more is that this is Visa's first production agentic workflow of this kind, built as a proof of concept during a routine migration, and the four-stage pattern is now reusable across other detections. Visa's separate automation team, which currently runs SOAR-style orchestration on a different platform, has already asked for API access to Elastic. Consolidating detection and response onto one native surface, instead of stitching together separate tools, suddenly looks less like an experiment and more like where the whole SOC is headed.