Xygeni Blog

Four search terms, two completely different jobs. Managing the risk of AI is not the same discipline as using AI for risk management, and most organisations are staffing one while being sold the other. The interesting part is what happens when you realise they are the same programme.

Every board now asks the same question: what is our AI risk? Most teams answer with adjectives. Here are the AI risk metrics that produce a number, where each one comes from, and what an agentic AI strategy has to cover before any of them mean anything.

Two things get filed under the same heading and they are not the same problem. Attacks on AI systems and attacks powered by AI need different controls, different owners and different evidence. Ten threats, split into the two halves, and the one step that precedes all of them.

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident.

AI pentesting tools are four different product shapes. What agentic pentesting changes, seven evaluation criteria, and what it cannot do.

Agents now plan, code, review, ship and operate. What the agentic SDLC changes in every phase, and which controls quietly stop working.

Your last pentest tested code. AI pentesting tests behaviour: hijacked prompts, abused tools, leaked data. What to test, and how often.

Agents now write, install and ship code. The real risks of agentic coding, the practices that contain them & 8 lessons learned the hard way.