Visa executives this week provided a rare look behind the scenes of its security apparatus, shedding light on the financial giant’s multi-layered cybersecurity approach.

The company’s more than 1,000 full-time cybersecurity specialists are its first layer of defense. They analyze petabytes of data to “protect Visa’s network from malware, zero-day attacks, and insider threats,” Visa Chief Risk Officer Paul Fabara wrote in a blog post. 

Machine learning (ML) models for network vulnerability prediction and mitigation occupy another level, with Visa’s security team monitoring and scanning client systems for vulnerabilities and suspicious activities on another, Fabara added. These feed into Visa’s global fraud services organization, which is a key component of this security system.

“Our mission statement is to ensure that we are proactively protecting and mitigating any large-scale attacks or data breaches within our ecosystem to make sure that our clients don't suffer catastrophic fraud losses,” Michael Jabbara, VP of global head of fraud at Visa, told SDxCentral.

Jabbara explained Visa’s security process within this organization. Part of the team is dedicated to building capabilities to proactively identify potential vulnerabilities that can be exploited by threat actors and developing early warning indicators for outstation events.

Then, its 24/7 risk operation center — acting as “the first responders” — uses those capabilities to continually monitor traffic across Visa’s network and alert clients of cyber incidents. Once mitigated, a separate global risk investigations team carries out an assessment to determine a threat actors' tactics, techniques, and procedures that Visa can use to inform its global ecosystem, Jabbara added.  

To prevent similar attacks, Visa also exchanges information with international law enforcement and intelligence agencies.

Visa spent more than $9 billion on boosting cybersecurity and reducing fraud over the past five years, including $500 million on artificial intelligence (AI) and data infrastructure, Fabara explained. 

“The fact is that we have invested so much in our security capabilities over time, that has actually become a key benefit for us,” Jabbara said, adding that the investments enabled the company to innovate data analytics in an agile and scalable way.

Fabara said those investments in security and AI power more than 60 different AI capabilities that can automate the “heavy-lifting” part of fraud detection. Another example is that Visa’s Advanced Authorization security capability helped prevent an estimated $26 billion in fraud in 2021 alone, he added.

For extreme cases that require security services at scale, “AI and ML can really give us that amplification power to provide that coverage for our ecosystem holistically,” Jabbara echoed.

“When it comes to fighting fraud, data is the most precious resource,” Fabara claims. “And Visa has access to 60% more data than its competitors combined.”

This huge amount of data allows Visa to achieve its ultimate goal — good customer experience, Jabbara said. Financial institutions cannot block all transitions to achieve zero fraud rate, but the large size of data “optimized that trade off where we're making sure that the good transactions are getting through and the bad transactions that are being declined,” he explained.

Visa’s security team can also cross-correlate different datasets to identify malicious IP addresses and potentially flag risky transactions. “We can get to these very much tailored risk profiles on an account-by-account basis,” Jabbara said. “That's incredibly powerful. Very few of any other entities have that level of insight into what we can do.”

That large amount of data combined with Visa’s AI and security investments allows the company to “deploy that superpower in a very targeted manner,” he added.

“It's hard for me to think about another innovation recently that is powering the global economy the same way that digital payments are,” Jabbara said. That combination is “the secret sauce and what keeps driving us forward as we kind of understand the ultimate value that we're bringing to this society and where we operate.”