Xygeni Logo White
Start Free
Book a demo

Xygeni Blog

Must-Read Posts

npm Supply Chain Security

npm Supply Chain Security: your vulnerability scanner is looking for the wrong thing

Your npm vulnerability scanner checks for known flaws. Malicious packages have none. Here's what npm supply chain security needs in 2026.
6 min read
Agent harness engineering

Agent harness engineering: the model isn’t the attack surface, the harness is

Agent harness engineering turns models into useful agents. It also hands attackers a new target: the files that tell your agent what it can do.
7 min read
NIST risk management framework

NIST Risk Management Framework: Where Your AppSec Program Fits In

The NIST risk management framework is a process, not a checklist. Where AppSec fits in it, which NIST frameworks plug in, and how to feed it evidence.
6 min read
OWASP ASVS

OWASP ASVS: How to Benchmark Your AppSec Program Against It

OWASP ASVS turns 18. How teams really use it, where adoption breaks, and how to benchmark your AppSec program against it, level by level.
7 min read
Privilege Escalation Vulnerability

Privilege Escalation Vulnerability in CI/CD pipelines

A privilege escalation vulnerability in CI/CD pipelines needs no exploit. How attackers abuse tokens, triggers, and containers, and how to close each path.
10 min read
AI Application Security

AI Application Security: What we heard at OWASP Porto & Karlsruhe

AI application security dominated OWASP Porto and Karlsruhe. What ASPM really is, how it differs from SAST, and where AI triage and remediation help.
8 min read
AI risk management

AI risk management: two disciplines, one inventory

Four search terms, two completely different jobs. Managing the risk of AI is not the same discipline as using AI for risk management, and most organisations are staffing one while being sold the other. The interesting part is what happens when you realise they are the same programme.
9 min read
AI Risk Metrics

AI Risk: The Metrics That Tell You Whether Your Agentic AI Strategy Is Working

Every board now asks the same question: what is our AI risk? Most teams answer with adjectives. Here are the AI risk metrics that produce a number, where each one comes from, and what an agentic AI strategy has to cover before any of them mean anything.
9 min read
AI security threats

Top 10 AI security threats and how to map them

Two things get filed under the same heading and they are not the same problem. Attacks on AI systems and attacks powered by AI need different controls, different owners and different evidence. Ten threats, split into the two halves, and the one step that precedes all of them.
10 min read
Software Development Security

Software Development Security: A Requirements Checklist With 12 Lines You Can Verify

Most software development security requirements describe a desired state, which means nobody can pass or fail them. Here are 12 written as checks, each with the artifact that proves it.
10 min read
AI Red Team Tools

AI Red Team Tools Test What Your Model Says. They Don’t Test What Your Agent Does Next

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident.
9 min read
npm Package Vulnerabilities

npm Package Vulnerabilities: How to Find and Fix Them Before They Ship

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident.
9 min read
Load More