If you missed Rick Van Luvender's session at the XP2 Educational Conference, here's the recap — what's changing inside Fiserv's cybersecurity program and why.
XP2 Educational Conference 2026 | Thursday, June 25
If you missed Rick Van Luvender's session at the XP2 Educational Conference, here's the recap — what's changing inside Fiserv's cybersecurity program and why.
Rick Van Luvender is Senior Vice President of Global Cybersecurity Services at Fiserv, overseeing cybersecurity outside North America, the Clover point-of-sale division, and the firm's money-transmitting businesses. His session centered on one shift: frontier AI models are now finding vulnerabilities that years of mature application security tooling missed.
For six years, Fiserv has run application security testing directly in developers' hands, with tools like Security Code Warrior offering just-in-time fixes. That foundation held up well, until Fiserv gained access to several frontier AI models and ran existing applications through them. The models surfaced issues nothing else had caught, using pattern recognition standard scanners don't apply. The response was a continuously running war room, pulling in CIOs and their teams for direct remediation guidance. The new policy: anything a frontier model flags gets fixed, regardless of severity rating, and old medium and low findings are being re-triaged for how easily an AI model could chain them into something serious.
What's changing, by the numbers
That urgency shows up in patch cadence too. Microsoft's Patch Tuesday bundle, along with monthly Linux and other OS patches, now has to be fully deployed enterprise-wide within 72 hours, staged in 24-hour windows across lower environments, QA, then production, without loosening change management. Fiserv is also piloting self-healing infrastructure in limited, low-risk areas, on the premise that machine-speed attacks can't be met with human-speed fixes alone.
On identity, Fiserv is pushing toward NIST authentication assurance level two or three, since SMS codes and knowledge-based questions no longer count as secure. Privileged access goes through quarterly SailPoint reviews, where unconfirmed access is automatically revoked, and CyberArk vaults credentials so admin privileges only exist for the duration of an approved change window. Sensitive data at rest, credit card numbers included, is protected with Voltage's format-preserving encryption, keeping enough digits visible for normal operations while every decryption is logged and tied to a business justification, feeding an insider threat model that flags unusual access patterns.
On detection, Fiserv is averaging roughly 14 minutes from security event to containment, aided by CrowdStrike and network detection tooling. Its Island Browser, now standard for daily work and newly acquired companies alike, isolates risky sites, blocks uploads and downloads, and watermarks content to trace leaks, all without employees feeling restricted. New acquisitions get validated through Wiz and Fortify on Demand before their networks connect to Fiserv's, a process that's taken as little as 90 days.
"Vulnerability management is no longer a technical debt or cyber hygiene issue. It's now a resilience and speed-of-remediation issue for the firm." — Rick's message to Fiserv's board
A client letter on the accelerated patch cadence for Fiserv products, including those hosted at credit union data centers, was expected out within days of the session. Want the full Q&A, including the discussion on Island Browser and XP2 compatibility? It's all in the recording and transcript above.